Tenable Lab Steps and Notes – Part 2 (Dashboards, Reports, Core, Nessus, NNM, Agent, Scanner Groups) – 51 Security

12. Hover over CIS Windows Server 2016 v2.0.0 (Explore) , and click Add .

a. Note: The version number may update. Select the same version number of the audit that you

used in the Compliance Scan lab.

13. Click Done .

Exports

Lab Exercise 24 : Exports

Part 1: Task 1 – Exporting a Dashboard

A dashboard can be exported as a report. Create and then export your newly created dashboard.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Vulnerability Management via cloud.tenable.com with the

credentials provided.

2. Select Dashboards from the menu located in the upper left corner.

3. Click New Dashboard , and then select Template Library .

4. Click in the Search Templates text bar at the top, and enter Quarterly VPR .

5. Select the Quarterly VPR Analysis (Explore) dashboard, and click Add .

6. Select Copy of Quarterly VPR Analysis (Explore) , and click View .

7. Click on Export and select PDF .

8. Wait for the export to fi then save it to your local computer. Open it with a PDF reader.

6. Click at the end of text in the Saved Filters fi and click AND . Then, select IPV4 ADDRESS .

7. Select Is equal to .

8. Type 10.0.0.0/24 and press Enter .

9. Select 19 Assets (the exact number may vary slightly in the lab environment) using the checkbox.

10. Click Export .

11. Change the Name to HQ Assets last 30 days .

12. Select CSV .

13. Enable the Schedule slider by clicking it.

14. Click the date and select tomorrow’s date .

15. Click the time , and select midnight .

16. Select your current Timezone .

17. Click Daily and select Weekly on {Day} .

18. Click Schedule Export .

6. Log back in, and click Update Management again to answer the challenge questions.

a. If you are not already in administrative mode, click Limited Access (at the top), and enter the

administrative password (Tenable123456789! ), and click Authenticate .

i. If it says Administrative access at the top, you may skip this step.

Part 2: Task 2 – Set Periodic Updates

Tenable Core can be set to perform updates automatically on a schedule. Set Tenable Core to update at

08:00AM on Saturdays.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Core + Nessus with the credentials provided.

2. If you are not already in administrative mode, click Limited Access (at the top), and enter the

administrative password (Tenable123456789! ), and click Authenticate .

a. If it says Administrative access at the top, you may skip this step.

3. Click Update Management .

4. Check the Unit State in the Scheduled System Updates section. If it says Enabled , leave it as it is.

Otherwise, click Edit and enable the toggle.

5. Click Edit on the Timer Config Line in the Scheduled System Updates section.

6. Enter Sat under Day of Week .

7. Enter * under Day of Month .

8. Enter 08 under Hour .

9. Enter 00 under Minute .

10. Click Save .

Part 2: Task 3 – Set Updates to Run on Startup

Configure updates to run at startup.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Core + Nessus with the credentials provided.

2. Click Update Management .

3. Locate the On-boot System Updates section. If the Unit State is enabled , then you can continue.

Otherwise, click Edit, and enable the toggle.

Part 3 – Enabling SNMP

SNMP is a useful protocol for retrieving information about hosts without logging in to them.

Part 3: Task 1 – Install the SNMP Service

Install the SNMP service on Tenable Core + Nessus.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Core + Nessus with the credentials provided.

2. If you are not already in administrative mode, click Limited Access (at the top), and enter the

administrative password (Tenable123456789! ), and click Authenticate . If it says Administrative access

at the top, you may skip this step.

3. Click SNMP . (The option is at the bottom of the page; you may need to scroll down)

4. Click Install SNMP .

5. Wait for the installation to fi

Part 3: Task 2 – Configure SNMPv3

Best practices call for using SNMPv3 whenever possible. Configure SNMPv3 so that it uses MD5 with read-only

credentials of user/readme12 and read-write credentials of admin/writeme12.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Core + Nessus with the credentials provided.

2. If you are not already in administrative mode, click Limited Access (at the top), and enter the

administrative password (Tenable123456789! ), and click Authenticate . If it says Administrative access

at the top, you may skip this step.

3. Click SNMP .

4. Locate the line Read-only Hash Algorithm , in the SNMPv3 access control setup section. Click the

drop-down to the right and select MD5 .

5. Type user in the read-only access username fi

6. Type readme12 in the read-only access user password fi

7. Click the Read-write Hash algorithm drop-down and select MD5 .

8. Type admin in the read-write access username fi

9. Type writeme12 in the read-write access user password fi

10. Click Save Configuration .

Optional Advanced Problems

This section is optional and can be completed during any free time you may have available while taking this course.

TOTAL ESTIMATED OPTIONAL EXERCISE TIME: 5:00 MINUTES

Task 1 – Create a Credentialed Scan of Tenable Core using SNMPv3

Using Tenable Vulnerability Management, create a credentialed scan of 10.0.0.181 (Tenable Core + Nessus) using

SNMPv3 credentials and run the scan. Do not use Tenable Core + NNM.

Task 2 – Disable Automatic Updates

Some organizations have change management controls that disallow automatic updates. Disable all

automatic updating of Tenable Core + Nessus.

Task 3 – Enable SNMPv3 on Tenable Core + NNM

Login to Tenable Core + NNM, enable SNMPv3 and create credentials similar to what you did for Tenable Core

+ Nessus.

Answer Key

Part 1: Task 1

1. What is the extension of the fi that was generated?

● tar.gz

Part 2: Task 1

1. Is this system up-to-date?

● Yes

2. Is there a way to determine what was updated and when?

● Yes, the system update history shows dates and what was updated. You can fi this on the

Update Management page by scrolling down.

Part 2: Task 2

1. Click Update Management and look for the entry Next Run . Is it set to 08:00AM?

● No. Explanation: To prevent the Tenable servers from being fl with update requests, a

random number of minutes between 00 and 60 is added to the update schedule.

2. Go to the terminal and type date . What time zone is the Tenable Core set to?

● U.S. Eastern Time

Part 2: Task 3

1. Click Edit next to Unit State in On-boot System Updates . What service is used to update?

● dnf-automatic-install.service

Part 3: Task 1

1. Examine the interface. Does Tenable Core support SNMPv1?

● No

2. What versions of SNMP are supported in Tenable Core?

● 2c and 3

Part 3: Task 2

1. Did the snmpd service restart?

● Yes.

2. What other items might you want to consider configuring for SNMPv3 support?

● The common items of contact and location.

Nessus

Lab Exercise 27: Tenable Nessus Installation

Part 1 – Configure Nessus and Connect to Tenable Vulnerability Management

In this part, your Hypervisor Management team has deployed a Tenable Core + Nessus in their Headquarters and

performed the initial configuration. Now, connect it to Tenable Vulnerability Management.

Part 1: Task 1 – Log in to Tenable Vulnerability Management and Obtain the Linking Key

Log in to Tenable Vulnerability Management and retrieve the linking key.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Vulnerability Management via cloud.tenable.com with the

credentials provided.

2. Click Vulnerability Management .

3. Click the Menu in the upper left corner, and select Settings .

4. Click Sensors located in the Scanning section.

5. Click + Add Nessus Scanner .

a. Note: DO NOT click Regenerate.

6. Click Copy to save the linking key to your clipboard.

7. Read the information in the rest of the window.

8. Click the X in the upper right corner to close the window.

9. Click Linked Scanners .

10. Open a text editor and paste the linking key. This way you can retrieve it later, in case you overwrite

what’s on your clipboard.

Part 1: Task 2 – Configure Tenable Nessus and Connect to Tenable Vulnerability Management

Log in to the management interface, connect to Nessus and use the linking key to perform initial

configuration.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Core + Nessus with the credentials provided.

2. Click Nessus on the left side.

3. Right-click the link to the right of URLs and open the link in an incognito window (or InPrivate ,

depending upon your browser).

4. Accept the certificate. If using Google Chrome, and you cannot accept the certificate, type thisisunsafe

(anywhere in the browser window, as all one word).

5. Once you see the Welcome to Nessus screen, click Continue .

6. Select Link Nessus to another Tenable product .

7. Click Continue .

8. Select Tenable Vulnerability Management from the Managed by drop-down.

9. Paste the linking key in the fi under Linking Key .

10. Click Continue .

11. Type admin in the Username fi

12. Type Tenable123456789! in the Password field

13. Click Submit .

a. Note: Wait for Nessus to display Compiling plugins .

14. Log into Tenable Vulnerability Management via cloud.tenable.com with the credentials provided.

15. Click Menu and select Settings .

16. Click Sensors located in the Scanning section.

17. Click Linked Scanners .

18. Confirm the new Nessus scanner has been attached.

Part 2 – Check Status and Rename Scanner

In this section, using the nessuscli application on the command line, check the status of the link and change

the name of the scanner.

Part 2: Task 1 – Check the Status of the Link

Connect to the Nessus management interface on port 8000 and use the Terminal to check the link status.

Note: On a “non- Tenable Core” scanner, these same instructions can be used from the command line.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Core + Nessus with the credentials provided.

2. Click Terminal .

3. Type sudo /opt/nessus/sbin/nessuscli managed status

4. Type Tenable123456789! when prompted for a password.

5. Confirm that the scanner is linked.

Part 2: Task 2 – Rename the Scanner

By default, when connecting to Tenable Vulnerability Management, the hostname is used for scanner names.

Using the command line, the name can be changed to something more descriptive. Unlink the scanner, then link it using the Name option. Note: On a “non- Tenable Core” scanner, these same instructions can be used from the command line.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Core + Nessus with the credentials provided.

2. Click Terminal .

3. Type sudo /opt/nessus/sbin/nessuscli managed unlink

a. Note: If prompted for a password, type Tenable123456789!

4. Type sudo /opt/nessus/sbin/nessuscli managed link –key={your linking key}

–cloud –name={your-name}_Scanner_Added

a. Note: Your linking key is what you copied from Part 1 Task 1 Step 5. “Yourname” is your name.

Do not type the brackets or braces. Also, be sure to type in the command above: do not copy

and paste the entire command, as there may be formatting errors. (Using copy/paste for the

linking key is fi though.)

5. Type Tenable123456789! if prompted for a password.

6. Open a new browser window.

7. Log into Tenable Vulnerability Management via cloud.tenable.com with the credentials provided.

8. Click the Menu and select Settings .

9. Click Sensors located in the Scanning section.

10. Click Linked Scanners .

11. Confirm that you see a scanner with the name {your-name}_Scanner_Added .

15. Select the eth0 (or ens5 ) box to the right of Monitored Network Interfaces .

16. Confirm that the Monitored Network Range is set to 10.0.0.0/24 .

17. Click Finish .

Part 1: Task 2 – Set the Polling Frequency to Every 15 Minutes

By default, NNM connects to Tenable Vulnerability Management once per hour and checks for work and

updates. Change this to every 15 minutes by changing the polling value.

Step-by-step Instructions:

1. Log in to Tenable Core + NNM with the credentials provided.

2. Click Nessus Network Monitor on the left side.

3. Right-click the link to the right of URLs and open the link in an Incognito window .

4. Type admin in the Username fi

5. Type Tenable123456789! in the Password fi

6. Click Sign In to Continue .

a. Note: If not already in the Configuration menu:

i. Click the ⚙ icon in the upper right corner and select Configuration .

ii. Click Cloud Settings from the NNM Settings menu.

iii. Type 15 in the Polling Frequency fi

iv. Click Update .

Agent

Part 1 – Networks

In this section, use networks when there are two network partitions using the same IP address range. Networks

allow you to differentiate the two networks for asset identification and scanning purposes.

NOTE: All of the tasks in Part 2 assume you are in a continuous session. Stay logged in after completing Part 1.

Part 1: Task 1 – Create a Headquarters Network

A recent acquisition of another company has resulted in there being two network partitions with the IP range

10.0.0.0/24. Create a network for Headquarters.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Vulnerability Management via cloud.tenable.com with the

credentials provided.

2. Click Vulnerability Management .

3. Click the Menu and select Settings .

4. Click Sensors located in the Scanning section.

5. Click Networks .

6. Click Add Network .

7. Type HQ Network in the Name fi

8. Click Create .

9. Click Save .

Part 1: Task 2 – Add Scanners and Move Assets

Once a network has been created, add scanners. Moving assets to the network is optional .

Step-by-step Instructions:

1. Click Move Assets in the Settings menu.

2. Select Default from the Network drop-down.

3. Type 10.0.0.0/24 in the Default fi

4. Click Search .

Part 2: Task 3 – Add HQ Assets to Network

Add the HQ assets to the network.

Step-by-step Instructions:

1. Select the check box to the left of assets.

2. Click Select all #### Assets .

3. Click the word Move (to the right of Select all <number> assets ).

Answer Key

Part1: Task 1

1. Can you assign the single scanner AWS-Student-Lab-Scanner_Scanner to the network? Why?

● No. Because the scanner is in a scanner group, you can only assign the scanner group.

2. Is it acceptable to assign the scanner group to this network?

● Yes. Both scanners can reach this range, so using both of them will be alright.

Part 1: Task 2

1. How can you fi the assets that have been scanned with Nessus (and therefore are part of HQ)?

● Click the Source column until the assets that have Nessus scan results are at the top.

Part 1: Task 3

1. Go to Assets, under Explore. Is there a way to view data on just the HQ Network?

● Yes. Search for and use the Network fi

2. From the Network window, there is no way to remove an asset from the network. Is there another way to

remove an asset from a network?

● Yes. From the Asset window you can click the Move icon (→) to move an asset to another

network, or to the default network.

Permissions & Access Control

Lab Exercise 36: Setting Up Permissions with Tags

Part 1 – Create a Tag for All Windows Assets at HQ

In this section, create a tag based on rules.

Part 1: Task 1 – Create a Tag

Create a tag based on the operating system, and a range of IPv4 addresses.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Vulnerability Management via cloud.tenable.com with the

credentials provided.

2. Click the Menu in the upper left corner and select Settings .

3. Click Tagging .

4. Click + Create Tag .

5. Type HQ Assets in the Select or Create Category fi

6. Click Create “HQ Assets” below.

7. Type Windows in the Create Value fi

8. Enable the Rules slider.

9. Click Select Filters .

10. Search for and select IPv4 Address .

11. Search for and select Operating System .

12. Click the X to close the Select Filters pop-out.

13. Click IPv4 Address: is equal to “” , and type 10.0.0.0/24 in the fi below is equal to .

14. Click Save .

15. Click Operating System: is equal to “” , and type *indows* in the fi below is equal to .

16. Click Save .

17. Wait a few minutes for the tag to take effect before answering the challenge questions. You may

proceed to the next task and come back to them.

Part 2 – Edit Permissions

In this section, update your default permissions, as well as the permissions for your newly created tag.

Part 2: Task 1 – Edit Default Permissions

Edit the “Access all Assets” permission to restrict access.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Vulnerability Management via cloud.tenable.com with the

credentials provided.

2. Click the Menu icon in the upper left corner and select Settings .

3. Click Access Control .

4. Click Permissions .

5. Click Access All Assets .

6. Click the X under Groups to remove the All Users group.

7. Locate Users , and then select your username.

8. Click Save .

Part 2: Task 2 – Edit the Permissions Related to the New Tag

A new permission exists in relation to the tag created in the fi task. Edit this permission so that assigned

users or user groups can use the tag for analysis and scanning.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Vulnerability Management via cloud.tenable.com with the

credentials provided.

2. Click the Menu icon in the upper left corner and select Settings .

3. Click Access Control .

4. Click Permissions .

5. Click the Permission tag ‘HQ Assets:WIndows’ owner permissions .

6. Click in the Permission Name , and edit it to HQ Windows Assets .

7. Click the X in the Permissions fi to remove the Can Edit permission.

8. Click the drop-down in the Permissions fi and enable both Can Scan and Can View .

9. Click Save .

Answer Key

Part 1: Task 1

1. How many assets were tagged?

● The number will vary depending upon the lab environment, but there should be at least 5 or

more assets.

2. How would you create a tag that fi on DNS names?

● Enable Rules , and select the DNS (FQDN) fi You can also set this same fi in

Explore>Assets , to immediately see if you have the results you want. Then, click the tag icon

from the Assets page to create the tag there, based on that fi Just be aware that there are

other default fi on that page that you may wish to remove fi

Part 2: Task 1

1. How else could you restrict access to assets for all users?

● You can simply delete the Access all Assets permission, or create a specific user group and

assign that group instead. Remember that administrator users will still have access to

everything regardless of permissions though. Role always supersedes permissions.

Part 2:Task 2

1. Who can currently access and scan the tagged HQ Windows assets?

● All Administrator users, by default. No other users can as no other users or user groups have yet

been assigned this permission.

3. Can a permission have more than one tag?

● Yes, however, the IPv4 address or IPv6 address rules must be different in the different tags.

Part 1 – Create a Group for IT Administrators in HQ

In this section, you have an HQ IT team. Create an access group and a user group for the team.

Part 1: Task 1 – Create a User Group

Create a user group for Headquarters.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Vulnerability Management via cloud.tenable.com with the

credentials provided.

2. Click the Menu in the upper left corner and select Settings .

3. Click Access Control .

4. Click Groups .

5. Click + Create Group .

6. Type HQ Security Group in the Name fi

7. Click Next .

8. Click Save .

Part 1: Task 2 – Create Permissions and Assign to User Group

Now that access controls are set, assign the permissions.

Step-by-step Instructions:

1. Click the Menu and select Settings .

2. Click Access Control .

3. Click Permissions .

4. Click Create Permission .

5. Select HQ-Security from the Permission Name fi

6. Click underneath Groups and select the user group you created in the previous task: HQ Security Group .

7. Select Can View from the Permission drop-down.

8. Select Can Scan from the Permission drop-down.

9. Repeat Step 8 for Can Use.

a. The Permissions fi should now display: Can View, Can Scan, Can Use

10. Select Regions:HQ from the Objects drop-down.

11. Click Save .

Part 1: Task 3 – Create a user and assign to the User Group

Create a new user, and assign to the user group.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Vulnerability Management via cloud.tenable.com with the

credentials provided.

2. Click the initials in the top right corner of the screen, and select My Profile .

3. Locate the email fi and copy the domain (the part after the @) to your clipboard.

4. Click Cancel .

5. Click the Menu in the upper left corner and select Settings .

12. Click Access Control .

13. Click Users .

14. Click Create User .

15. Type Jake Doe in the Full Name fi

16. Type jdoe@{domain} in the Username fi

a. Note: The domain is pasted from the domain you copied to your clipboard in Step 3 above.

17. Type Training@12345!a in the Password fi

18. Type the same password from Step 17 above into the Verify Password fi

19. Select the Scan Manager role.

20. Click Next .

21. Click the User Groups drop-down menu, and select HQ Security Group .

22. Click Next .

23. Click Save .

Answer Key

Part 1: Task 1

1. Have any members been added to this group?

● No, not yet.

Part 1: Task 2

1. Are users in the assigned user group able to edit the created permission?

● It depends on the user’s role. Administrator users can edit objects, regardless of their assigned

permissions. All other users would not be able to edit the permission, however, unless “Can Edit”

permission is explicitly assigned.

Part 1:Task 3

1. Why didn’t we assign any permissions in the Create User form?

● User permissions were not necessary, since the permissions were assigned at the user group

level instead.

2. Can a user be in more than one group?

● Yes. It’s important to track what groups you assign a user to, in order to ensure that the user will

have the correct permissions.

Lab Exercise 38: Object User Permissions

Part 1 – Assign Execute Permissions for a Scan

In this section, there are users in the HQ Security Group that need access to a scan that you have set up.

Part 1: Task 1 – Edit an Existing Scan, and Assign User Permissions to a User Group

Assign scan permissions to a user group so that they can control a scan.

Step-by-step Instructions:

1. Ensure you are logged into Tenable Vulnerability Management via cloud.tenable.com with the

credentials provided.

2. Click the Menu in the upper left corner and select Scans .

3. Click the Actions menu (⠇) to the right of Credentialed Scan of HQ , and select Edit .

4. Locate the Basic tab, and scroll down to the User Permissions section. click the plus (+) sign next to

User Permissions .

5. Search for and select HQ Security Group .

6. Click the permission drop-down next to HQ Security Group , and select Can Execute . (This should be the

default.)

7. Click Add then Save.

Answer Key

Part 1: Task 1

1. What users have access to manage this scan?

● All Administrator users, and all users that belong to the HQ Security Group .

2. How can you verify that you have set permissions correctly?

● Use the User Assist function for one of the users within the user group, to see what that user

can see and do.

3. What permission would you select if you wanted the users in the group to be able to update any settings

in the scan?

● Can Edit