Add a Linked Tenable Nessus Scanner

Required Tenable Security Center User Role: Administrator

To retrieve the linking key in Tenable Security Center, you need the Administrator role. To run nessuscli, you also need root access on the Tenable Nessus scanner host.

You can link a Tenable Nessus scanner to Tenable Security Center through a Tenable Sensor Proxy. A linked scanner connects to the Sensor Proxy rather than directly to Tenable Security Center. For conceptual information, see Linked Scanning Overview.

Note: If you relink a scanner, the scanner restarts. For several minutes after you relink it, the scanner does not perform scan jobs.

Before you begin:

  • Link a Sensor Proxy to Tenable Security Center, as described in Link a Sensor Proxy to Tenable Security Center.

  • Confirm that your Tenable Nessus scanner is running a supported version. Tenable Nessus 10.12.0 or later is required for the scan-zone linking option.

  • Confirm that the Tenable Nessus scanner can reach the Sensor Proxy on TCP port 443.

  • (Optional) To add the scanner to one or more Tenable Security Center scan zones automatically at link time, confirm that those scan zones already exist and note their exact names. To create a scan zone, see Add a Scan Zone.

To link a Tenable Nessus scanner to a Sensor Proxy:

  1. Log in to Tenable Security Center as an administrator.

  2. In the left navigation, click Resources >Tenable Nessus Scanners.

    The Tenable Nessus Scanners page appears.

  3. At the top of the table, click Link Scanner.

    The Add Tenable Nessus Scanner page appears.

  4. Copy the linking key.

  5. On the Tenable Nessus scanner host, if the scanner is currently linked to another manager, unlink it with root privileges:

    Copy 
    nessuscli managed unlink

  6. With root privileges, link the scanner to the Sensor Proxy. Replace <linking_key> with the key that you copied, and replace <sensor_proxy_host> with the Sensor Proxy IP address or hostname:

    Copy 
    nessuscli managed link --key=<linking_key> --host=<sensor_proxy_host> --port=443 [--name=<scanner_name>] [--scan-zones="<zone1>,<zone2>"]

    For example:

    nessuscli managed link --key=b421118229f81c38d1fbdb3bb94f9fdd08c5a27fe2e14de764b299697b686868 --host=10.1.2.4 --port=443 --name="Nessus West" --scan-zones="Data Center,DMZ"

    Link command options

    Option

    Description

    --key

    The Tenable Security Center linking key that you copied from the Link Nessus Scanner pane.

    --host

    The IP address or hostname of the Sensor Proxy, not Tenable Security Center.

    --port

    The port that the Sensor Proxy listens on for sensor communication. Use 443.

    --name

    (Optional) A name for the scanner. If the name includes spaces, enclose it in quotation marks.

    --scan-zones

    (Optional) A comma-separated list of existing Tenable Security Center scan zones to add this scanner to at link time. Enclose the list in quotation marks if any zone name contains spaces. The --scan-zones option is an alias for the nessuscli --groups option, added for Tenable Security Center connections. Each value must match an existing scan zone name exactly. Names are case-sensitive. Tenable Security Center ignores values that do not match an existing scan zone and does not create new scan zones. When you deploy a Tenable Nessus scanner with the Docker image, use the SCAN_ZONES environment variable instead.

  7. In Tenable Security Center, return to the Resources > Tenable Nessus Scanners page and confirm that the scanner appears with the icon.

What to do next:

  • If you did not use --scan-zones, add the linked scanner to one or more scan zones, as described in Add a Scan Zone and Edit a Scan Zone.

  • Configure the Prefer Linked Scan Zones organization setting for your organization, as described in Organization Settings.

  • Configure an active scan that targets your scan zone, as described in Add an Active Scan.