Configuration Settings

The configuration menu includes the following settings:

Data Expiration Settings

Data expiration determines how long Tenable.sc retains acquired data.

Option

Description

Vulnerability Data Lifetime

Active

The number of days you want Tenable.sc to retain active scan vulnerability data stored in IP repositories. The default value of this option is 365 days.

Passive

The number of days you want Tenable.sc to retain NNM vulnerability data stored in IP repositories. The default value of this option is 7 days.

Event

The number of days you want Tenable.sc to retain LCE event data stored in IP repositories. The default value of this option is 365 days.

Compliance

The number of days you want Tenable.sc to retain audit compliance data stored in IP repositories. The default value of this option is 365 days.

Mitigated

The number of days you want Tenable.sc to retain mitigated vulnerability data. The default value of this option is 365 days.

Agent

The number of days you want Tenable.sc to retain agent scan vulnerability data stored in agent repositories. The default value of this option is 365 days.

User Generated Object Lifetime

Closed Tickets

The number of days you want Tenable.sc to retain closed tickets. The default value of this option is 365 days.

Scan Results

The number of days you want Tenable.sc to retain scan results. The default value of this option is 365 days.

Report Results

The number of days you want Tenable.sc to retain report results. The default value of this option is 365 days.

External Schedules Settings

The Tenable.sc external schedule settings determine the update schedule for the common tasks of pulling NNM data, IDS signature updates, and IDS correlation updates.

Option

Description

Nessus Network Monitor

Pull Interval

This option configures the interval that Tenable.sc uses to pull results from the attached NNM instances. The default setting is 1 hour. The timing is based from the start of the Tenable.sc service on the host system.

Log Correlation Engine

IDS Signatures

Specifies the frequency to update Tenable.sc IDS signatures via third-party sources. The schedule appears along with the specified time zone.

IDS Correlation Databases

Specifies the frequency to push vulnerability information to the LCE for correlation. The schedule appears along with the specified time zone.

You can also configure each of the update schedule times to occur by time in a particular time zone using the Time Zone link next to each hour selection.

Lumin Settings

If you have a Tenable.io license to use Lumin with Tenable.sc, you can configure your Tenable.sc data to synchronize to Tenable.io for Lumin analysis.

For more information, see Lumin Synchronization.

Mail Settings

The Mail option designates SMTP settings for all email-related Tenable.sc functions. Available options include SMTP host, port, authentication method, encryption, and return address. In addition, you can use the Test SMTP Settings in the upper-left of the page to validate the settings.

Note: The Return Address defaults to . Use a valid return email address for this option. If this option is empty or the email server requires emails from valid accounts, the email server cannot send the email.

Note: Type the Username in a format supported by your SMTP server (for example, or domain\username).

Miscellaneous Settings

The Miscellaneous Configuration section offers options to configure settings for web proxy, syslog, notifications, and enable or disable some report types.

Web Proxy

From this configuration page, you can configure a web proxy by entering the host URL (proxy hostname or IP address), port, authentication type, username, and password. The host name used must resolve properly from the Tenable.sc host.

Syslog

In the Syslog section, you can configure options to allow Tenable.sc to send log events to the local syslog service.

Option

Description

Enable Forwarding Enables log forwarding options.
Facility Type the facility you want to receive the log messages.
Severity Specifies which syslog message levels you want to forward: Informational, Warning, or Critical.

Scanning

The IP Randomization option specifies how you want Tenable.sc to send active scan target lists to Nessus and Tenable.io scanners.

You enable or disable IP randomization for all configured active scans; you cannot configure IP randomization on a per-scan basis.

  • When enabled, Tenable.sc randomizes the targets in the active scan before sending the target list to the scanners to reduce strain on network devices during large active scans.

    Scan Randomization
    1,000 or fewer targets

    Tenable.sc randomizes all the IP addresses in the target list.

    1,001 or more targets

    Tenable.sc randomizes all the IP addresses in the target list by:

    1. Ordering the IP addresses numerically and splitting them into 100 groups.
    2. Randomly selecting a group and choosing the lowest IP address from that group.
    3. Selecting groups and IP addresses until all IP addresses in all groups are randomized in the target list.

    If the active scan includes a Tenable.io scanner, Tenable.sc breaks the target list into smaller lists (256 IP addresses each) before sending to Tenable.io.

    Note: Some randomized target lists (such as very small target lists) may still contain sequences of increasing IP addresses. This is a possible outcome of randomization, not an indication that randomization failed.

  • When disabled, Tenable.sc organizes the target list by increasing IP address. Then, scanners scan targets, starting with the lowest IP address and finishing with the highest IP address.

Tip: The Max simultaneous hosts per scan scan policy option specifies how many IP addresses Tenable.sc sends to each scanner at a time. For more information, see Scan Policy Options.

Notifications

The Notifications section defines the Tenable.sc web address used when alerts and tickets generate notifications.

Report Generation

If your organization requires specialized reporting formats, such as DISA or CyberScope, you can enable Report Generation options based on your organization's needs.

  • Defense Information Systems Agency (DISA) reporting standards include the Assessment Summary Results (ASR), Assessment Results Format (ARF), and Consolidated Assessment Results Format (CARF) styles.

  • CyberScope reports utilize Lightweight Asset Summary Results Schema (LASR) style reports, which are used by some segments of governments and industry.

To allow users to choose these reports during report creation, you must enable the corresponding toggles. For more information about reports in Tenable.sc, see Reports.

Option

Description

Enable DISA ARF Enable the DISA ARF report format, which meets the standards of the Defense Information Systems Agency Assessment Results Format.
Enable DISA Consolidated ARF Enable the DISA consolidated ARF report format, which meets the standards of the Defense Information Systems Agency Consolidated Assessment Results Format.
Enable DISA ASR Enable the DISA ASR report format, which meets the standards of the Defense Information Systems Agency Assessment Summary Results.
Enable CyberScope Enable the CyberScope report format, which meets CyberScope reporting standards to support FISMA compliance.

Privacy

The Enable Usage Statistics option specifies whether Tenable collects anonymous telemetry data about your Tenable.sc deployment.

When enabled, Tenable collects usage statistics that cannot be attributed to a specific user or customer. Tenable does not collect personal data or personally identifying information (PII).

Usage statistics include, but are not limited to, data about your visited pages, your used reports and dashboards, your Tenable.sc license, and your configured features. Tenable uses the data to improve your user experience in future Tenable.sc releases. You can disable this option at any time to stop sharing usage statistics with Tenable.

After you enable or disable this option, all Tenable.sc users must refresh their browser window for the changes to take effect.

License Settings

The License Configuration section allows you to configure licensing and activation code settings for Tenable.sc and all attached Tenable products.

For information about the Tenable.sc license count, see License Requirements. To add or update a license, see Apply a New License or Update an Existing License.

Plugins/Feed Settings

The Plugins/Feed Configuration page displays the Plugin Detail Locale for Tenable.sc and the feed and plugin update (scanner update) schedules.

For more information, see Edit Plugin and Feed Settings and Schedules.

Update

Description

Tenable.sc Feed

Retrieves the latest Tenable.sc feed from Tenable. This feed includes data for general use, including templates (for example, dashboards, ARCs, reports, policies, assets, and audit files), template-required objects, some general plugin information, and updated VPR values.

Active Plugins

Retrieves the latest active plugins feed (for Nessus and Tenable.io scanners) from Tenable. Tenable.sc pushes the feed to Nessus and Tenable.io scanners.

Passive Plugins

Retrieves the latest passive plugins feed from Tenable. Tenable.sc pushes the feed to NNM instances.

Event Plugins

Retrieves the latest event plugins feed from Tenable. Tenable.sc uses the feed locally with LCE data but does not push the feed to LCE; LCE retrieves the feed directly from Tenable.

For information about Tenable.sc-Tenable plugins server communications encryption, see Encryption Strength.

Plugin Detail Locale

The local language plugin feature allows you to display portions of plugin data in local languages. When available, translated text displays on all pages where plugin details appear.

Select Default to display plugin data in English.

Note: Tenable.sc cannot translate text within custom files. You must upload a translated Active Plugins.xml file to display the file content in a local language.

For more information, see Configure Plugin Text Translation.

Schedules

Tenable.sc automatically updates Tenable.sc feeds, active plugins, passive plugins, and event plugins. If you upload a custom feed or plugin file, the system merges the custom file data with the data contained in the associated automatically updating feed or plugin.

You can upload tar.gz files with a maximum size of 1500 MB.

For more information, see Edit Plugin and Feed Settings and Schedules.

SAML Settings

Use the SAML section to configure SAML 2.0 or Shibboleth 1.3-based SAML authentication for Tenable.sc users. For more information, see SAML Authentication.

Security Settings

Use the Security section to define the Tenable.sc user interface login parameters and options for account logins. You can also configure banners, headers, and classification headers and footers.

Option

Description

Authentication Settings

Session Timeout

The web session timeout in minutes (default: 60).

Maximum Login Attempts

The maximum number of user login attempts Tenable.sc allows before locking out the account (default: 20). To disable this feature, set the value to 0.

Minimum Password Length

This setting defines the minimum number of characters for passwords of accounts created using the local TNS authentication access (default: 3).

Password Complexity

When enabled, user passwords must be at least 4 characters long and contain at least one of each of the following:

  • An uppercase letter
  • A lowercase letter
  • A numerical character
  • A special character

Note: After you enable Password Complexity, Tenable.sc prompts all users to reset their passwords the next time they log in to Tenable.sc.

Note: If you enable Password Complexity and set the Minimum Password Length to a value greater than 4, Tenable.sc enforces the longer password requirement.

Startup Banner Text

Type the text banner that appears before to the login interface.

Header Text

Adds custom text to the top of the Tenable.sc user interface pages. You can use the text to identify a company, group, or other organizational information (maximum 128 characters).

Classification Type

Adds a header and footer banner to Tenable.sc to indicate the classification of the data accessible via the software. Current options are None, Unclassified, Confidential, Secret, Top Secret, and Top Secret – No Foreign.

Sample header:

Sample footer:

Note: If you set Classification Type to an option other than None, users can only see the plain report styles. The Tenable report styles do not support the classification banners.

Allow API Keys When enabled, allows users to generate API keys as an authentication method for Tenable.sc API requests. For more information, see Enable API Key Authentication.
Allow Session Management This setting is disabled by default. When enabled, the Session Limit option appears. This feature displays the option that allows administrators to set a session limit for all users.
Disable Inactive Users

When enabled, Tenable.sc disables user accounts after a set period of inactivity. You cannot use a disabled user account to log in to Tenable.sc, but other users can use and manage objects owned by the disabled user account.

Days Users Remain Enabled When you enable Disable Inactive Users, specify the number of inactive days you want to allow before automatically disabling a user account.
Session Limit

Specifies the maximum number of sessions a user can have open at once.

If you log in and the session limit has already been reached, Tenable.sc notifies you that the oldest session with that username will be logged out automatically. You can cancel the login or proceed with the login and end the oldest session.

Note: This behavior is different for Common Access Cards (CAC) logins. The previously described behavior is bypassed as was the old login behavior.

Login Notifications Sends notifications for each time a user logs in.
WebSeal

Allows you to enable or disable WebSEAL. WebSEAL supports multiple authentication methods, provides Security Access Authorization service, and single sign-on capabilities.

Caution: Before the user that enabled WebSEAL logs out of Tenable.sc, Tenable.sc strongly recommends confirming, in a separate session, that at least one user (preferably an administrator user) is able to log in successfully via WebSEAL. Otherwise, if there is an issue, no one will be able to access Tenable.sc to turn WebSEAL off.

Caution: Any user created while WebSEAL is enabled will not have a password. An administrator must update the user account to establish a password. Any user that existed before enabling WebSEAL must revert to their old password.

PHP Serialization
Operational Status Summarizes your current setting.
PHP Serialization Mode

Specifies whether you want to allow or prevent PHP serialization in Tenable.sc.

  • PHP Serialization ONTenable.sc performs PHP serialization and Tenable.sc features operate as expected.
  • PHP Serialization OFFTenable.sc does not perform PHP serialization and prevents users from importing or exporting the following objects.
    • Assets
    • Scan policies
    • Assurance Report Cards
    • Reports
    • Audit files
    • Dashboards