Credentials in Tenable Vulnerability Management Scans

You can use credentials to grant a Tenable Vulnerability Management scanner local access to scan a target system without requiring an agent. Credentialed scans can perform a wider variety of checks than non-credentialed scans, which can result in more accurate scan results. This approach facilitates scanning of a very large network to determine local exposures or compliance violations.

Credentialed scans can perform any operation that a local user can perform. The level of scanning depends on the privileges granted to the user account. The more privileges the scanner has via the login account (for example, root or administrator access), the more thorough the scan results.

In Tenable Vulnerability Management, you can create credentials for use in scans in the following ways:

Category	Description	Permissions
Scan-specific	You configure and store these credentials in an individual scan. If you delete the scan, you also delete the credentials. If you want to use the credentials in a different scan, you must either convert the scan-specific credential to a managed credential or recreate the scan-specific credential settings in the other scan.	User Permissions in Basic settings in the scan
Template-specific	You configure and store these credentials in a user-defined template. You can then use the template to create individual scans. If you add credentials to a user-defined template, other users can override those credentials by adding scan-specific or managed credentials to scans created from the template. Tenable recommends adding managed credentials to scans, instead of adding credentials to user-defined templates. If you delete the template, you also delete the template-specific credentials. However, Tenable Vulnerability Management retains the credentials in any scans you used the template to create before deletion. If you want to use the credentials in a different template, you must recreate the template-specific credentials in the other template.	User Permissions in Basic settings in the template
Managed	Tenable Vulnerability Management stores managed credentials centrally in the credential manager. You can configure managed credentials directly in the credential manager or during scan configuration. You can also convert a scan-specific credential to a managed credential during scan configuration. You can use managed credentials in multiple scans. You can also grant other users permissions to use managed credentials in scans. You cannot use managed credentials in templates.	Configure User Permissions for a Credential

The settings you configure for a credential vary based on the credential type. Credential types include:

• Cloud Services
• Database
• Host
• Miscellaneous
• Mobile Device Management
• Patch Management
• Plaintext authentication

For more information, see:

• Add a Credential to a Scan
• Edit a Credential in a Scan
• Convert a Scan-specific Credential to a Managed Credential
• Add a Credential to a User-defined Template
• Edit a Credential in a User-defined Template

Note: Tenable Vulnerability Management opens several concurrent authenticated connections. Ensure that the host being audited does not have a strict account lockout policy based on concurrent sessions.