Basic Settings in Tenable Vulnerability Management Scans

Name

Specifies the name of the scan.

Description

(Optional) Specifies a description of the scan.

Scan Results

Specifies whether the results of the scan should appear in workbenches, dashboards, and reports, or be kept private.

When set to Keep private, the scan results Last Seen dates do not update and you must access the scan directly to view the results.

Private scan results do not show new Active findings in the workbenches, dashboards, and reports, and they do not transition the vulnerability states of previously discovered findings to Fixed or Resurfaced.

Note: Show in dashboard is always enabled for triggered scans.

Folder

Specifies the folder where the scan appears after being saved.

You cannot specify a folder when you launch a remediation scan. All remediation scans appear in the Remediation Scans folder only.

(Tenable Nessus Agent templates only) Specifies the agent group or groups you want the scan to target. In the drop-down box, select an existing agent group, or create a new agent group.

Scanner

Specifies the scanner that performs the scan.

Select the network of scanners and asset that you want to scan with.

Unless your organization has created and uses custom networks for specific business needs (for example, scanning different sub-organizations, differentiating between external and internal asset scanning, or differentiating between ephemeral and static asset scanning), Tenable recommends using the Default network, which all scanners and scanner groups are assigned to by default.

For more information about networks, see Networks.

(Required) Select whether to run a tag-based scan on Internal or External IP addresses.

• Internal — RFC 1918 (private) IP addresses.

• External — Non-RFC 1918 (public) IP addresses.

Note: You can use your organization's non-cloud scanners to scan both Internal and External targets. Cloud scanners can only be used to scan External targets.

Tip: If you need to scan both External and Internal targets with the same tag or tags, create two different scan configurations; one scan that targets External IPs, and one scan that targets Internal IPs.

Tenable Vulnerability Management evaluates the identifiers to determine a single target in the following order:

1. Last scan target

2. Most recent IPv4

3. Most recent IPv6

4. Most recent FQDN added

(Required) Specifies whether Tenable Vulnerability Management scans tagged assets only, or any assets that which the selected tags' rules apply to.

• Existing tagged assets only — Tenable Vulnerability Management scans all existing assets that have any of the specified tags applied.

• Targets defined by tags — Tenable Vulnerability Management scans all assets whose IP address or DNS matches the rules of the specified tag. The Targets defined by tags option only works for the following tag rules: IPv4, IPv6, and DNS.

  Note: If you select the Match All filter, you can have only one tag rule. Otherwise, the tag resolves to empty targets.

  If you select the Match Any filter, you are allowed to have more than one tag rule. All tag rules resolve as targets as long as the rules are for IPv4, IPv6, and DNS.

For example, you create a scan policy that scans for a tag with a tag rule that specifies a certain IPv4 range. The example tag name is My IPv4s.

• If you choose Existing tagged assets only, Tenable Vulnerability Management only scans assets that are already tagged with the My IPv4s tag.

• If you choose Targets defined by tags, Tenable Vulnerability Management scans any assets whose IPv4 addresses are within the range specified in the My IPv4s tag rule.

For more information about tags and tag rules, see Tags and Tag Rules.

(Tenable Nessus Scanner templates only) Specifies the timeframe after which the scan automatically stops. Use the drop-down box to select an interval of time, or click to type a custom scan window.

Note: The scan window timeframe only applies to the scan job. After the scan job completes within the timeframe, or once the scan job stops due to the scan window ending, Tenable Vulnerability Management may still need to index the scan job. This can cause the scan not to show as Completed after the scan window is complete. Once Tenable Vulnerability Management indexes the scan, it shows as Completed.

(Tenable Nessus Agent templates only) (Required) Specifies whether the agent scans occur based on a scan window or triggers:

• Scan Window — Specifies the timeframe during which agents must report in order to be included and visible in vulnerability reports. Use the drop-down box to select an interval of time, or click to type a custom scan window.

  Window scans must be explicitly launched or scheduled to launch at a particular time.

• Triggered Scan — Specifies the triggers that cause agents to report in. Use the drop-down boxes to select from the following trigger types:

  • Interval — The time interval (hours) between each scan (for example, every 12 hours).

  • File Name — The file name that triggers the agent scan. The scan triggers when the file name is detected in the trigger directory.

  Tip: You can set multiple triggers for a single scan, and the scan searches for the triggers in their listed order (in other words, if the first trigger does not trigger the scan, it searches for the second trigger).

  To learn more about triggered agent scanning, see Triggered Agent Scans.

  Note: Tenable Vulnerability Management ignores triggered agent scan data that is older than 14 days. This ensures that Tenable Vulnerability Management is not processing stale data from agents that have been offline for extended periods of time.

Triggered agent scans — After 10 scans

Scan Window agent scans — After 10 days

Note: Tenable highly recommends using the default values. Only lower the value if doing so is necessary for your organization.

(Tenable Nessus Agent vulnerability templates only) (Required) Specifies how often the agent scan should report unchanged Info-severity vulnerability findings. To learn more about this setting, see Info-level Reporting.

You can configure the agent scan to report all severity findings by launching a new baseline scan after one of the following intervals:

• After number of scans — The agent scan reports all findings every x number of scans. You choose from the following increments: 4, 7, 10, 15, or 20 scans.

• After number of days — The agent scan reports all findings after a set number of days after the previous day on which the agent scan last reported all findings. You choose from the following increments: 7, 10, 20, 30, 60, or 90 days.

  You can only set triggered agent scans to After number of scans. You can set Scan Window scans to either After number of scans or After number of days.

Target Groups

You can select or add a new target group to which the scan applies. Assets in the target group are used as scan targets.

Note: Tenable plans to deprecate target groups in the near future. Currently, you can still create and manage target groups. However, Tenable recommends that you instead use tags to group and scan assets on your Tenable Vulnerability Management instance.

Targets

Specifies one or more targets to be scanned. If you select a target group or upload a target file, you are not required to specify additional targets.

Targets can be specified using a number of different formats.

The targets you specify must be appropriate to the scanner you select for the scan. For example, cloud scanners cannot scan non-routable IP addresses. Select an internal scanner instead.

Tip: You can force Tenable Vulnerability Management to use a given hostname for a server during a scan by using the hostname[ip] syntax (for example, www.example.com[192.168.1.1]). However, you cannot use this approach if you enable scan routing for the scan.

Note: You cannot apply more than 300,000 IP address targets to a scan. To learn more about scan limitations in Tenable Vulnerability Management, see Scan Limitations.

Note: See Permissions for more information on how permissions affect targets.

Upload Targets

Uploads a text file that specifies the targets.

The targets file must be formatted in the following manner:

• ASCII file format
• Only one target per line
• No extra spaces at the end of a line
• No extra lines following the last target

Note: Unicode/UTF-8 encoding is not supported.

This setting appears only when the scan owner edits an existing scan that is based on a user-defined scan template.

Note: After scan creation, you cannot change the Tenable-provided scan template on which a scan is based.

In the drop-down box, select a user-defined scan template on which to base the scan. You can select user-defined scan templates for which you have Can View or higher permissions.

In most cases, you set the user-defined scan template at scan creation, then keep the same template each time you run the scan. However, you may want to change the user-defined scan template when troubleshooting or debugging a scan. For example, changing the template makes it easy to enable or disable different plugin families, change performance settings, or apply dedicated debugging templates with more verbose logging.

When you change the user-defined scan template for a scan, the scan history retains the results of scans run under the previously assigned template.

Frequency

Specifies how often the scan is launched.

• Once: Schedule the scan at a specific time.
• Daily: Schedule the scan to occur every 1-20 days, at a specific time.
• Weekly: Schedule the scan to occur every 1-20 weeks, by time and day or days of the week.
• Monthly: Schedule the scan to occur every 1-20 months, by:
  • Day of Month: The scan repeats monthly on a specific day of the month at the selected time. For example, if you select a start date of October 3, the scan repeats on the 3rd of each subsequent month at the selected time.
  • Week of Month: The scan repeats monthly on a specific day of the week. For example, if you select a start date of the first Monday of the month, the scan runs on the first Monday of each subsequent month at the selected time.

  Note: If you schedule your scan to recur monthly and by time and day of the month, Tenable recommends setting a start date no later than the 28th day. If you select a start date that does not exist in some months (for example, the 29th), Tenable Vulnerability Management cannot run the scan on those days.

• Yearly: Schedule the scan to occur every 1-20 years, by time and date.

Starts

Specifies the exact date and time when a scan launches.

The starting date defaults to the date when you are creating the scan. The starting time is the nearest half-hour interval. For example, if you create your scan on 09/08/2023 at 9:16 AM, the default starting date and time is set to 09/08/2023 and 09:30.

Timezone

Specifies the timezone of the value set for Starts.

Specifies what day of the week a scan repeats. This item appears only if you specify Weekly for Frequency.

The value for Repeat On defaults to the day of the week on which you create the scan.

Summary

Provides a summary of the schedule for your scan based on the values you have specified for the available settings.

Email Recipient(s)

Result Filters