Tenable Security Center Notes.md

Quick Reference

Security Center (dashboard): https://security-center.pvt.xdr.accenturefederalcyber.com (SAML Login) Nessus Manager (client-based scanning): https://nessus-manager-0.pvt.xdr.accenturefederalcyber.com:8834/ (Creds in Vault)

Service

systemctl status SecurityCenter
systemctl start nessusd
systemctl status nessusagent

Show Version

sudo /opt/nessus/sbin/nessuscli -v
sudo /opt/nessus_agent/sbin/nessuscli -v

Log location

/opt/sc/admin/logs  
/opt/sc/support/logs

Upgrading Nessus and Tenable.sc (Security Center)

Download the latest RPM from Tenable Download - Nessus
Check the sha256 on your mac with shasum -a 256 Nessus-8.15.1-es7.x86_64.rpm
Use teleport scp to upload the file to the TEST and PROD repo server; See How to add a new package to the Reposerver
Update the tenable repo per the Reposerver Notes above

Stop the service and take an EBS snapshot as a backup

systemctl stop SecurityCenter
systemctl start nessusd

Use the AWS cli to take a snapshot of all EBS volumes

aws --profile mdr-test-c2-gov ec2 create-snapshots --instance-specification 'InstanceId=i-01d72189085662b1e,ExcludeBootVolume=false' --tag-specifications 'ResourceType=snapshot,Tags=[{Key=Name,Value=security-center-0-pre-upgrade-backup-5.19.1}]'

Note: You can upgrade all three Nessus servers at the same time with
- salt nessus* cmd.run 'yum clean all && yum makecache fast'
Run yum clean all && yum makecache fast on the appropriate server or salt nessus* pkg.upgrade name=Nessus on salt-master to update the software from the repo server
For Nessus, you need to start the software after the upgrade with
- systemctl start nessusd.service
- salt nessus* cmd.run 'systemctl start nessusd.service'
For Tenable.sc, use this command: yum update SecurityCenter
To ensure everything is working, log into Tenable.sc with admin creds and look at the Resources > Nessus Scanners then click on Options > Update Status
If the Scanner shows a status of "Protocol Error" you were too fast and need to be patient; go browse a conservative news source for 5 minutes ;-)

NOTE: The Tenable Agents upgrade themselves through the Nessus Manager.

Security Patches

Occasionally Tenable will release patches for Tenable.sc. These patches need to be installed on the commandline and not through the reposerver.

Download the security patch to your Mac. But what if I am using a Windows laptop? Stop following these instructions and request a Mac laptop.
Check the hash against the tenable provided one
- shasum -a 256 SC-202110.1-5.x-rh7-64.tgz
- sha256sum SC-202204.3-5.x-rh7-64.tgz ( Or on RedHat)
Use teleport scp/web UI to upload the file directly to the Tenable.sc server ( see Reposerver Notes for example command. )

Stop Tenable.sc and take a backup via snapshots

systemctl stop SecurityCenter

Use the AWS cli to take a snapshot of all EBS volumes

aws --profile mdr-test-c2-gov ec2 create-snapshots --instance-specification 'InstanceId=i-01d72189085662b1e,ExcludeBootVolume=false' --tag-specifications 'ResourceType=snapshot,Tags=[{Key=Name,Value=security-center-0-pre-upgrade-backup-5.21.0}]'

Extract patch and apply per the Release Notes on Tenable's website

General Setup

svc-scan

See Tenable Knowledge Article - SSH Public Key Authentication for scanning. The private key for svc-scan is not in Vault because if you lose/need it, just generate a new one and push it out.

Add Custom CAs

See Tenable Knowledge Article - Upload a Custom CA certificate to Tenable.sc

These certs include the xdr root ca and intermediate from XDR WWW Certificates Subordinate CA v2 in AWS. I also grabbed the MDR Root CA G1. The Splunk Common CA is the last cert.

custom_CA.inc

#Splunk common CA

custom_feed_info.inc

PLUGIN_SET = "202109011330";
PLUGIN_FEED = "Custom";

Create a compressed tar archive of the 2 files: (Note: Applications such as 7-Zip or running the tar command on macOS are known not to work for this)

tar -zcvf upload_this.tar.gz custom_feed_info.inc custom_CA.inc

Tenable Nessus Manager Notes

Nessus manager is just a Nessus installation that includes the agent handler. As of this writing, it does not support SSO. The URL is https://nessus-manager-0.pvt.xdr.accenturefederalcyber.com:8834/ . The creds are in Vault.

setup

systemctl status nessusd

Use admin user to login ( shared cred in Vault )

Agent setup

systemctl status nessusagent

The agent key is generated and viewable in the Nessus Manager.

Scans are run and then sent to SC. The Agent Synchronization Job on SC pulls the scans from the Nessus mananger.

In Nessus manager, the agent scans are scheduled. Agents are linked to the Nessus Manager through the Linking Key in the Nessus Manager.

Agent Troubleshooting

When you are setting up a new server and you see this error for the Nessus agent, it means the Nessus Manager already has your agent in its inventory. To fix this, log into the Nessus Manager > Sensors > Find your agent > click on X to delete. Restart the agent to have it enroll again. Creds for Nessus Manager are in Vault.

Error message:

[error] [agent] Link fail: [409] An agent with the uuid '53543366-b28f-41de-937c-81d736e93a90' already exists

Tenable.sc Scanning Strategy

Tenable does not have a way to pull host information from AWS. To keep things dynamic and not require us to update IP lists, a host discovery scan is setup with all possible IPs. After the host discovery scan runs, the dynamic assets lists should pick up the correct IPs and scan only those IPs. This keeps the scan times shorter.

XDR Host Discovery (scan) -> Systems that have been Scanned (assets list) -> XDR OS Discovery (scan) -> All XDR IP / Agents (assets list) -> XDR Vulnerability Scan (scan)

Scan Troubleshooting

To run a diagnostic scan on a single IP, put the IP as the target of the scan and as the diagnostic target. You can put anything in the password. Note that you will not be able to view the results only send them to support.

Running a scan on a single host

Go to test tenable or the prod tenable
Got to scans->active scans
Find the 'single host' (test) or Single IP (prod) CIS scan you are interested in, and click on the name or 'edit'
Go to targets, change to 'ip/dns name', enter IP
Hit 'play', and click link 'view scan results' if you're fast, otherwise switch to Scan Results
Wait for complete, then view results.

Tenable Notes.md 12 KB History Raw