WIXLIB

ForeScout Extended Module for Tenable Vulnerability ManagementConfiguration GuideVersion 2.7.1

ForeScout Extended Module for Tenable Vulnerability ManagementConfiguration GuideTable of ContentsAbout Tenable Vulnerability Management Module . 4Compatible Tenable Vulnerability Products. 4About Support for Dual Stack Environments . 5Additional Tenable Documentation . 5Concepts, Components, Considerations . 5Concepts . 5Components . 8Considerations . 8Tenable Server Authentication . 10What to Do . 10Requirements . 10CounterACT Software Requirements . 10ForeScout Extended Module License Requirements . 11Supported Tenable Versions . 13Install the Module . 13Configure the Module . 14Add a Tenable Server . 15Synchronize Scan Parameters and Select Defaults . 20Set Auto-Deletion of Scan Results . 21Test the Module Configuration . 21Define Test Configuration Parameters . 22Run a Module Test . 23Export the Test Results . 23Run Tenable Vulnerability Management Policy Templates . 24CounterACT Policy Coordination Considerations . 25Basic Tenable Scan Trigger Policy Template . 27Risk Factor Results Policy Template . 31Create Custom Tenable Vulnerability Management Policies . 34Policy Properties - Detecting Vulnerabilities . 36TenableTenableTenableTenableTenableScanner is Reachable . 38Scan Results . 38Scan Status . 40Server IP . 41Vulnerability Summary . 41Policy Actions - Scanning Endpoints . 43Start Tenable Scan . 43Using the Tenable VM Module. 43Display Tenable VM Asset Inventory Events . 44Version 2.7.12

ForeScout Extended Module for Tenable Vulnerability ManagementConfiguration GuideStart Tenable Scan . 44Additional CounterACT Documentation . 45Documentation Downloads . 45Documentation Portal . 46CounterACT Help Tools. 46Version 2.7.13

ForeScout Extended Module for Tenable Vulnerability ManagementConfiguration GuideAbout Tenable Vulnerability ManagementModuleThe ForeScout CounterACT Tenable Vulnerability Management (VM) Module letsyou integrate CounterACT with Tenable SecurityCenter , Tenable.io andNessus scanners so that you can: Trigger Nessus scanner, SecurityCenter, or Tenable.io (cloud-basedvulnerability management platform) scan requests based on networkactivity detected by CounterACT. For example, delay a scan if theendpoint is offline, or trigger a scan if a specific application is installedor if the previous scan was not within a certain time frame. See BasicTenable Scan Trigger Template. Monitor, manage, restrict and remediate endpoints based on scanresults. See Risk Factor Results Template. Use the CounterACT Asset Inventory to see which endpoints have beenidentified as vulnerable by the module. See Display Tenable VM AssetInventory Events.To use the module, you should have a solid understanding of Tenable concepts,functionality and terminology, and understand how CounterACT policies and otherbasic features work.Compatible Tenable Vulnerability ProductsThe module lets you integrate CounterACT with either of the following TenableNetwork Security vulnerability products: Version 2.7.1Nessus versions 6.0.x through 6.10.x. Vulnerability andconfiguration assessment product that features configuration auditing,asset profiling, sensitive data discovery, patch managementintegration, and vulnerability analysis of your security posture.4

ForeScout Extended Module for Tenable Vulnerability ManagementConfiguration Guide SecurityCenter versions 4.8.2, 5.4.2, 5.4.5 and 5.6.x. Centralizedmanagement system to control and view scan data from multipleNessus scanners deployed throughout your organization. Tenable.io - The Tenable cloud-based vulnerability managementplatform.About Support for Dual Stack EnvironmentsCounterACT version 8.0 detects endpoints and interacts with network devicesbased on both IPv4 and IPv6 addresses. However, IPv6 addresses are not yetsupported by this component. The functionality described in this document isbased only on IPv4 addresses. IPv6-only endpoints are typically ignored or notdetected by the properties, actions, and policies provided by this component.Additional Tenable DocumentationRefer to Tenable online documentation for more information about the Tenableand SecurityCenter , Components, ConsiderationsThis section provides a basic overview of Tenable VM / CounterACT architecture: Concepts – basic integration concepts. Components – devices in your network that participate in theintegration. Considerations – setup details and common network structure issues tokeep in mind when you implement this module.ConceptsA typical deployment requires multiple CounterACT Appliances and TenableNetwork Security vulnerability products to provide regular, frequent complianceauditing. The network design of Appliances and vulnerability products shouldensure that scanners are not overloaded, and that scan results are available in atimely fashion.In this integration, each Nessus, Tenable.io or SecurityCenter is connected to oneor more CounterACT devices. When configuring the Tenable VM module, ensurethat each one can scan the entire range of IP addresses associated with itsassigned CounterACT Appliances or Enterprise Manager.Version 2.7.15

ForeScout Extended Module for Tenable Vulnerability ManagementVersion 2.7.1Configuration Guide6

ForeScout Extended Module for Tenable Vulnerability ManagementConfiguration GuideDeployment OptionsThere are two topologies for setting up multiple CounterACT devices and multipleNessus scanners, Tenable.io or SecurityCenter servers. The actual deployment can combine both topologies to meet particularnetwork requirements. When the SecurityCenter is configured to allow Session Management(under Security Configuration Authentication Settings in the Tenabledashboard), you can set the maximum number of registered users thatcan connect to the SecurityCenter.Peer-to-Peer: One or more CounterACT devices communicate directly with oneSecurityCenter or Nessus scanner. This is a one-to-one relationship, where eachCounterACT Appliance prompts the connected SecurityCenter or Nessus scannerto initiate scans whenever required. This is the typical topology for remote sites inwhich a remote Tenable vulnerability product and a remote CounterACT deviceare deployed.Version 2.7.17

ForeScout Extended Module for Tenable Vulnerability ManagementConfiguration GuideAppliance Proxy: A connecting CounterACT device serves as a channel (proxy)to the SecurityCenter, Tenable.io, or Nessus scanner for other devices. Theconnecting device queues scan requests from all the assigned CounterACTAppliances, including itself. The connecting device controls the number of scanrequests as well as the number of endpoints per any one scan request. Thisensures more efficient traffic control and avoids overloading scanners.ComponentsConnecting CounterACT Device: This CounterACT device communicatesdirectly with the Nessus scanner, Tenable.io, or SecurityCenter server andhandles queries and requests submitted by all the devices assigned to theTenable vulnerability product. In an environment where more than oneCounterACT device is assigned to a Tenable vulnerability product, the connectingdevice functions as a proxy between the Tenable vulnerability product and all theCounterACT devices assigned to it. The proxy forwards all requests by otherCounterACT devices assigned to the Tenable vulnerability product. The connectingCounterACT device functions as a CounterACT device assigned to itself.Assigned CounterACT Device: This CounterACT device is assigned to a Tenablevulnerability product, but it does not communicate with the Tenable productdirectly. All communication between the Tenable vulnerability product and itsassigned CounterACT devices is handled by the connecting CounterACT devicedefined for the Tenable product. All the IP addresses handled by an assigneddevice must also be handled by the Tenable vulnerability product to which thedevices are assigned.Default Nessus Scanner/SecurityCenter: All unassigned CounterACT devicesare assigned to this Tenable vulnerability product through its connectingCounterACT device.ConsiderationsConsider the following when mapping CounterACT devices to Nessus scanners,SecurityCenter or Tenable.io:Multiple Time Zones: Clock synchronization is required when resolving scannerattributes. If multiple CounterACT devices and scanners are deployed acrossmultiple time zones, all CounterACT devices and scanners must use the same NTPserver and regularly synchronize their clocks.Timing: The module and its policy templates are configured to handle networktraffic and to carry out other tasks using default thresholds. Based on networkactivity or other requirements, you may need to update these defaults.Version 2.7.1 By default, a CounterACT policy created using the Basic Tenable ScanTrigger Template checks the Tenable server responsiveness once anhour. This value can be updated by editing the Recheck value in theScanner is reachable sub-rule condition. By default, the minimum delay between consecutive scan requests is10 seconds. The maximum number of endpoints per single scanrequest is 20. It is advised to review the scanner performance over anextended period. Optimize these settings to reduce scanner load andyet minimize scan latency.8

ForeScout Extended Module for Tenable Vulnerability ManagementConfiguration GuideMatch IP Address Ranges: Verify that Nessus, SecurityCenter or Tenable.iohandles the same IP address range as the CounterACT devices assigned to it. Tosee CounterACT device IP address assignments, on the CounterACT Consoleselect Tools Options CounterACT Devices, double-click the device, andselect the IP Assignments tab.Synchronization with Scan Policies, Repositories, Zones, and Credentials:When CounterACT triggers a Tenable product scan, it passes certain informationto Tenable. For each scan, it passes the specific endpoint IP to be scanned, and aNessus scan policy name. In addition, when triggering a SecurityCenter scan,CounterACT passes a repository name, an optional zone, and one or moreoptional credentials for in-depth scanning. These values must be appropriate forthe endpoint's group or segment.Lists of the available scan policies, repositories, scanners, zones and credentialsare shown in the Tenable VM module configuration tabs. The SecurityCenteroperator can update the Tenable server and their scan policies, repositories,zones, and credentials at any time. However, when a scan is requested, theinformation passed must match the information stored on the Tenable server. If ascan policy name, repository name, zone, or credential is modified or if additionalitems are added, be sure to synchronize the Tenable VM module configurationbefore triggering a scan using that information. To synchronize the configuration,on the CounterACT Console select Tools Options Tenable VM, and in theTenable Servers tab, select Sync.Additional Considerations: CounterACT recognizes only those scan reports thatit triggered. There is an option to recognize scans that are initiated directly bySecurityCenter, Tenable.io, and Nessus. By default, CounterACT uses the machinegenerated name for each scan, and deletes each scan 30 days after creation. For complex deployments with multiple CounterACT devices, multipleSecurityCenter servers, Tenable.io or Nessus scanners, and diverse scancompliance policies, see Policy Properties - Detecting Vulnerabilities.Version 2.7.19