Update Tenable Core Offline

Tenable recommends applying all offline updates to your Tenable Core machine in chronological order. Do not skip offline updates. There are two methods available to perform an offline update. For information about the contents of individual offline update files, see the Tenable Core Release Notes.

Tip: For more information about updating Tenable Core, see the FAQ.

Note: Service pack (SP) updates to OT Security may not be available for an online update in Tenable's repositories. Complete an offline update by downloading the latest installation ISO and performing the offline update procedure if you wish to update your version.

Note: While the quarterly update ISO can update your OT system, you may want to use the OT offline installer ISO as a source of updates. On the downloads page, you can select from two ISO types for your Tenable Core + Tenable OT Security deployment:
  • Tenable Core Tenable.ot Self-Contained Installation ISO - provides latest Tenable.OT ICP/Sensor and system updates (for example, Tenable-Core-Tenable.ot-offline-20231019.iso and Tenable-Core-Tenable.ot.Sensor-offline-20231019.iso)
  • Offline Update ISO Image - provides quarterly cadence for ICP/Sensor and system updates (for example, Tenable-Core-Offline-Update-2023-Q3.iso).
Note: Tenable OT has centralized sensor updates provided by the ICP as of Tenable Core + Tenable OT Security version 3.16.55. To ensure functionality, the ICP needs to have offline updates attached and mounted. When the sensor is connected to the ICP and the ICP has updates, running updates from the sensor installs the software served by the ICP. The ICP self-contained ISO, or quarterly offline ISO of the ICP, provides updates for the sensor. For sensor upgrade via the ICP, you can upload any offline ISO to the ICP. All three types; EM, ICP, and Sensor ISOs, contain the relevant sensor upgrade data. The Sensor ISO is the smallest by file size.
Tip: When offline updates are attached, Tenable Core also continues to attempt to retrieve updates from the online repositories. This is normally harmless. In certain network environments attempting to reach the online repositories can cause timeouts or undesirable flagged traffic in firewalls. In cases such as these, running the following commands prevents Tenable Core from attempting to use the online repositories:

sudo dnf config-manager --disable "tenable-*"

sudo dnf config-manager --enable "tenable-offline"

To upload a Tenable Core offline update .iso file, use one of the following methods:

Method 1

  1. Navigate to the Tenable Core Offline Update ISO section of the Tenable Downloads page and download the update you wish to apply.

  2. Go to the web interface on port 8000, click the Updates tab.

  3. In the Offline Updates section, click Upload New Offline Updates ISO.

  4. Click to check for and install updates.

  5. In the OT Security tab, click the blue arrow next to the version number to start the upgrade.

Method 2

  1. Go to /srv/tenablecore/offlineiso and delete any existing tenable-offline-updates.iso files.

  2. Upload the new ISO "Tenable-Core-OL8-Offline-Update-2024-Q4.iso" to /srv/tenablecore/offlineiso.

  3. Rename the uploaded "Tenable-Core-OL8-Offline-Update-2024-Q4.iso" to tenable-offline-updates.iso.

  4. Run the following command: [# sudo dnf update -y]

  5. Go to the web interface on port 8000, click the OT Security tab.

  6. Click the blue arrow next to version number to start the upgrade.

To update Tenable Core via external media:

  1. Navigate to the Tenable Core Offline Update ISO section of the Tenable Downloads page.

  2. Click and download the offline update .iso file.

  3. Burn the ISO to media (for example, DVD-DL, BD, or thumb drive).

  4. Attach the media to a system and have it mount automatically.

    Tenable Core updates with the new .iso file.

    Note: By default, the hardening on OL8 operating systems prevents USB media from mounting. In order to use USB drives with a Tenable Core OL8 operating system, the /etc/modprobe.d/usb-storage.conf file needs to be removed from that directory.

What to do next: