Advanced Settings in Tenable Vulnerability Management Scans

When enabled, disables all plugins that may have an adverse effect on the remote host.

When enabled, Tenable Vulnerability Management stops scanning if it detects that the host has become unresponsive. This may occur if users turn off their PCs during a scan, a host has stopped responding after a denial of service plugin, or a security mechanism (for example, an IDS) has started to block traffic to a server. Normally, continuing scans on these machines sends unnecessary traffic across the network and delay the scan.

By default, Tenable Vulnerability Management scans a list of IP addresses in sequential order. When this option is enabled, Tenable Vulnerability Management scans the list of hosts in a random order within an IP address range. This approach is typically useful in helping to distribute the network traffic during large scans.

When enabled, if a credentialed scan tries to connect via SSH to a FortiOS host that presents a disclaimer prompt, the scanner provides the necessary text input to accept the disclaimer prompt and continue the scan.

The scan initially sends a bad ssh request to the target in order to retrieve the supported authorization methods. This allows you to determine how to connect to the target, which is helpful when you configure a custom ssh banner and then try to determine how to connect to the host.

When disabled, credentialed scans on hosts that present a disclaimer prompt fail because the scanner cannot connect to the device and accept the disclaimer. The error appears in the plugin output.

When disabled, to avoid overwhelming a host, Tenable Vulnerability Management prevents a single scanner from simultaneously scanning multiple targets that resolve to a single IP address. Instead, Tenable Vulnerability Management scanners serialize attempts to scan the IP address, whether it appears more than once in the same scan task or in multiple scan tasks on that scanner. Scans may take longer to complete.

When enabled, a Tenable Vulnerability Management scanner can simultaneously scan multiple targets that resolve to a single IP address within a single scan task or across multiple scan tasks. Scans complete more quickly, but hosts could potentially become overwhelmed, causing timeouts and incomplete results.

When enabled, the scanner creates a unique identifier (Tenable UUID) . Tenable Vulnerability Management and Tenable Security Center use the Tenable UUID to merge incoming scan data with historical results for the asset and ensure that license counts are accurately reflected.

For more information, see Why Tenable Tags and Agent IDs are created during authenticated scans.

Specifies CA certificates that the scan considers as trusted. This allows you to use self-signed certificates for SSL authentication without triggering plugin 51192 as a vulnerability in your Tenable Vulnerability Management environment.

Note: In addition to this setting, you can configure trusted CAs at the individual scanner level (for more information, see Trust a Custom CA in the Tenable Nessus User Guide). There is no precedence or hierarchy between trusted CAs configured in the Tenable Vulnerability Management scan configuration and trusted CAs configured on the Tenable Nessus scanner. Tenable Vulnerability Management uses the correct certificate needed to complete the scan and ignores irrelevant certificates, regardless of which product you configure them in.

Slow down the scan when network congestion is detected

When enabled, Tenable detects when it is sending too many packets and the network pipe is approaching capacity. If network congestion is detected, throttles the scan to accommodate and alleviate the congestion. Once the congestion has subsided, Tenable automatically attempts to use the available space within the network pipe again.

Use Linux kernel congestion detection

When enabled, Tenable Vulnerability Management uses the Linux kernel to detect when it sends too many packets and the network pipe approaches capacity. If detected, Tenable Vulnerability Management throttles the scan to accommodate and alleviate the congestion. Once the congestion subsides, Tenable Vulnerability Management automatically attempts to use the available space within the network pipe again.

Network timeout (in seconds)

Specifies the time that Tenable waits for a response from a host unless otherwise specified within a plugin. If you are scanning over a slow connection, you may want to set this to a higher number of seconds.

Max simultaneous checks per host

Specifies the maximum number of checks a Tenable scanner will perform against a single host at one time.

Max simultaneous hosts per scan

Depends on the Tenable-provided template used for the scan

Specifies the maximum number of hosts that Tenable Vulnerability Management submits for scanning at the same time in an individual scan task.

To further refine scan performance using host limits, Tenable recommends adjusting Advanced settings for your individual scanners (for example, max_hosts, global.max_hosts, and global.max_scans). For more information, see Advanced Settings in the Tenable Nessus User Guide.

If you set Max simultaneous hosts per scan to more than scanner’s max_hosts setting, Tenable Vulnerability Management caps Max simultaneous hosts per scan at the max_hosts value. For example, if you set the Max simultaneous hosts per scan to 150 and scanner's max_hosts is set to 100, with more than 100 targets, Tenable Vulnerability Management scans 100 hosts simultaneously.

Note: You can only adjust individual scanner settings for your organization's managed scanners. You cannot modify the settings of Tenable-hosted scanners.

Max number of concurrent TCP sessions per host

Specifies the maximum number of established TCP sessions for a single host.

This TCP throttling option also controls the number of packets per second the SYN scanner sends, which is 10 times the number of TCP sessions. For example, if this option is set to 15, the SYN scanner sends 150 packets per second at most.

Max number of concurrent TCP sessions per scan

None

Specifies the maximum number of established TCP sessions for each scan task, regardless of the number of hosts being scanned.

Note: The MAX NUMBER OF CONCURRENT TCP SESSIONS PER SCAN setting is not enforceable in a Discovery scan. The global.max_simult_tcp_sessions Nessus Engine setting (that you set on each scanner) is an absolute cap that applies across all running scans on a scanner. (For example, if you have four scanners and do not want them to generate more than 10000 simultaneous TCP sessions in total at any point in time, you can set that global setting to 2500 for each individual scanner.)

For scanners installed on any Windows host, you must set this value to 19 or less to get accurate results.

Command Timeout

The maximum number of seconds the find command is allowed to run on Unix systems. Not all Find commands use this timeout.

Note: For all Find command executions in the plugin to complete, and to prevent the plugin from timing out, its plugin timeout should be adjusted with timeout_<plugin ID> in the scanner's Advanced Settings,

Exclude Filepath

A plain text file containing a list of filepaths to exclude from all plugins that search using the find command on Unix systems.

In the file, enter one filepath per line, formatted per patterns allowed by the Unix find command -path argument. For more information, see the find command man page.

Exclude Filesystem

A plain text file containing a list of filesystems to exclude from all plugins that search using the find command on Unix systems.

In the file, enter one filesystem per line, using filesystem types supported by the Unix find command -fstype argument. For more information, see the find command man page.

A plain text file containing a list of filepaths to include from all plugins that search using the find command on Unix systems.

In the file, enter one filepath per line, formatted per patterns allowed by the Unix find command -path argument. For more information, see the find command man page.

Including filepaths increases the locations that are searched by plugins, which extends the duration of the scan. Make your inclusions as specific as possible.

Tip: Avoid having the same filepaths in Include Filepath and Exclude Filepath. This conflict may result in the filepath being excluded from the search, though results may vary by operating system.

When enabled, instead of running native operating system commands of find and unzip, plugins use binaries included within the plugin feed for agent-based scanning. This allows CPU consumption to be controlled for the Tenable Nessus Agent find command. Another benefit to enabling this setting is that if find or unzip are not found natively on the operating system, using the commands from the feed allows full plugin execution with these commands to continue.

This setting works in tandem with the Scan Performance setting, which you can set locally on the agent. If you enable this setting and have adjusted the Scan Performance to a setting other than the default (High), the resulting scan findings may be different than previous scans with the same configuration. This is because the scan may experience timeouts in finding files due to the lower CPU resources.

Note: Due to the need for thorough and complete results, audits do not leverage the find or unzip binaries from the Tenable feed.

Note: With this setting enabled, CPU usage may spike up or close to 100% when the plugin requests a batch of results to process. The CPU then drops down to a lower level until the next batch is requested for processing.

Windows Exclude Filepath

A plain text file containing a list of filepaths to exclude from all plugins that search using Tenable's unmanaged software directory scans.

In the file, enter one absolute or partial filepath per line, formatted as the literal strings you want to exclude. You can include absolute or relative directory names, examples such as E:\, E:\Testdir\, and \Testdir\.

Tip: The default exclusion paths include \Windows\WinSxS\ and \Windows\servicing\ if you do not configure this setting. If you configure this setting, Tenable recommends adding those two paths to the file; those directories are very slow and do not contain unmanaged software.

Windows Include Filepath

A plain text file containing a list of filepaths to include from all plugins that search using Tenable's unmanaged software directory scans.

In the file, enter one absolute or partial filepath per line, formatted as the literal strings you want to exclude. You can only include absolute directory names, examples such as E:\, E:\Testdir\, and C:\.

Note: The Windows Include Filepath overrides the default included directory (for example, the C: drive on Windows). Therefore, if you want to include the default directory in addition to other directories, you must list the default directory in an additional filepath line.

Caution: Avoid having the same filepaths in the Windows Include Filepath and Windows Exclude Filepath settings. This conflict results in the filepath being excluded from the search.

Enable plugin debugging

Disabled

Attaches available debug logs from plugins to the vulnerability output of this scan.

(Agents 8.2 and later) If set, each agent in the agent group delays starting the scan for a random number of minutes, up to the specified maximum. Staggered starts can reduce the impact of agents that use a shared resource, such as virtual machine CPU.

If the maximum delay you set exceeds your scan window, Tenable shortens your maximum delay to ensure that agents begin scanning at least 30 minutes before the scan window closes.

Controls the maximum output length for each individual compliance check value that the target returns. If a compliance check value that is greater than this setting's value, Tenable Vulnerability Management truncates the result.

Controls the maximum timeout duration for compliance checks.

This setting is used by checks with long run times, especially checks that run commands on remote targets for Windows and Unix audits. This timeout setting overrides all other timeout settings when it is available.

Determines whether Tenable Vulnerability Management attaches a compliance gold image .audit file to the scan results. You can download the gold image audit from the vulnerabilities tab labeled Compliance Export Gold Image Audit.

For more information, see Compliance Export Gold Image.

Determines whether Tenable Vulnerability Management attaches XCCDF results files to the scan results. You can download the generated XCCDF result files from the vulnerabilities tab labeled Export compliance results to XCCDF.

For more information, see Compliance Export XCCDF Results.

Determines whether Tenable Vulnerability Management attaches a .audit JSON file to the scan results. You can download the JSON files from the vulnerabilities tab labeled Export compliance results to JSON.

For more information, see Compliance Export JSON Results.

Determines whether the scan searches for unpatched vulnerabilities. This includes CVEs marked as Will Not Fix by the related vendor.

Enabling this setting may increase your overall findings count; each platform and package combination results in an individual plugin. If additional CVEs are found to affect a platform and package combination, the CVEs are added to the existing plugin.

Note: If you configure a scan to produce findings for unpatched vulnerabilities and then the setting is unchecked, Tenable Vulnerability Management remediates unpatched findings in the next scan. Additionally, if multiple scans target the same device and one has enabled findings for unpatched vulnerabilities and another does not, the findings results may vary per scan.