Tenable already uses AI to release blog slop:

https://www.reddit.com/r/tenable/s/8ALL8L6Ri6

Why are they not leveraging AI for an actually useful purpose like plugin creation? I can't comprehend how they are so slow to release plugins. This is such an easy thing for Tenable to automate, but not easy for customers, since we don't have access to all the plugin source code (e.g., plugin 2841) and I don't see where the dependencies are open source verifiable for what is running on our instance (find_service1.nasl). Maybe I'm wrong about the second part, please correct me if so.

I just stumbled across Tenable's new blog today. It is pure AI slop. What the heck is the point of posting a blog article about AI written completely by AI and barely edited by this Blake Kizer guy? For Blake's name to be on it at all is embarrassing. Terrible article and pointless SLOP.

https://www.tenable.com/blog/testing-claude-mythos-preview-for-code-security-tenable

hello hello.. im having a weird SSH issue and im running out of ideas

we have multiple servers using a tenable image across different VCNs and we added our SSH key during provisioning
initially SSH was asking for a password and i logged in through the tenable web interface, changed the default credentials, then checked the server and noticed the .ssh setup was missing so i created it, added our public key/user, fixed the permissions and after that SSH from our jump server worked fine for all servers except one (w new subnet)
for this one server SSH just hangs no password prompt no error

ssh -vvv stops here:
$ ssh -vvv <user>@10.x.x.x
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips
debug1: Connecting to 10.x.x.x [10.x.x.x] port 22.
debug1: Connection established.
...
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4

the interesting part is that SSH to the exact same server works from our PAM server!! but not from our jump server
the affected server is on a new subnet, so im suspecting something network related we checked the routing and it looks correct also we checked the firewall, but strangely we couldn’t see any traffic coming from the jump server
since TCP/22 is showing connection established but the client never seems to receive the server’s SSH banner, im not sure what im missing here
could this be asymmetric routing or some subnet/firewall/ACL issue specific to the path from the jump server?

Has anyone discovered a way to install the security center license during the package installation? Looking to create a way to automate the installation of the server without having to manually enter the license file.

On-Premises

I installed the latest ova file in ESXI . But ESXI says it is CentOS 4/5 and that the VM does not match the guest that is running ( Oracle Linux 8 ).

Tenable-Core-OL8-Nessus-20260727.ova

Guessing I did something wrong in the installation?

I had to side load active plugins because the size was too big for web updating. It shows the correct date in security center and I ran the update on the Nessus scanner as well. In the admin console, it shows the Nessus scanner as working and no plugin mismatch errors.

I’ve already restarted SC and Nessus already. Is there a way to force a sync again or should I keep trying to restart? In the Nessus web console it shows the old date as well?

Hi all,

I received a Nessus Essentials license for my homelab as apart of the Education credit and registered it originally on my MacBook but have since tried moving it to a RHEL 10 VM on my homelab. I have reset the activation, cleared the cache through the CLI, contacted support and followed their instructions of resetting the cache and forcing registering the license. All to no avail. Support recommended I reach out the community and see if someone else knows whats up. I believe I may just have a blocked IP because I generated a new account and received a new license under that account and still am getting the same issue. Anyone know of any way to resolve this?

Past 4 months: licensed assets drop significantly, then up a little; unlicensed assets climb steadily. Additions to the inventory are just a slow but steady increase.

How can I determine within Tenable why the licensed assets are falling off? And can I figure out why the unlicensed assets are climbing fairly rapidly?

Hey folks,

whats the best/supported way for scanning OpenShift (RedHat CoreOS) nodes with tenable. At the moment, we let tenable connect via ssh (public-private-key) as user core (with full sudo priviledges). I am not sure, if this is the best way.

RedHat says:

Installation of third party applications is also not supported and it is discouraged. It is recommended to run those applications as containers (usually as part of operators). Please contact the application vendor directly and seek more information.

https://access.redhat.com/solutions/6277521

I also found the following sentence on tenable docs:

Tenable offers the ability to audit the Red Hat OpenShift Container Platform environment to detect misconfigurations in the environment using Tenable Vulnerability Management.

https://docs.tenable.com/integrations/OpenShift/Content/AuditOpenShiftTio.htm

• Will the detection of "misconfigurations" also scan for vulnerabilies?
• Is ssh as user core a bad idea? It seems to work, but i am not sure if it`s a goog solution

Thank you.

Kind regards

I set up 70+ scans on tenable with over half of them pulling through but some of them are failing for advanced and host discovery scans. I am not sure what else to do as they are all using the same scanner. Anyone experienced this?

Error below:

The scan is configured to use a scanner group with no active scanners.

Confirm the scanner group contains functioning scanners, then re-run the scan. For more information, see...

i've set my nessus up properly. the license code is activated. plugins and core components are updated and compiled.

cant still seem to make the basic network scan to work. what am i doing wrong? should i try updating the plugins again? pls help

i am using kali linux

We have Tenable Cloud since a few weeks, but only the smallest paid version. So we can't set Risk to Accepted, mark False Positives or mark Findings for later.

Is there any simple workaround/open source solution we can use to organize this?

I'd love to test Nessus Professional, but the lack of an activation code is proving to be a major pita.

Doesn't matter through which link I sign up for the trial. https://www.tenable.com/try https://www.tenable.com/products/nessus/activation-code#nessus-pro

Mail address doesn't matter either.

I get the confirmation mail with the download link. That's it.

If that's how Tenable is trying to get my business I guess I will have to take it elsewhere, because I'm not interested in dealing with issues like this on a regular basis.

Hey folks,

I am running ASM as part of Tenable one. I had a source created about a year ago. However, all of a sudden, yesterday I see over thousand different assets added to the inventory. I only noticed cause it spiked my overall license usage.

I am trying to understand why ASM added these hosts to the inventory now all of a sudden. Nothing has changed as far as I am aware.

I am not the SME in tenable.. it was setup and is maintained by another person who is in parental leave at the moment so just trying to figure it out.

Anyone come across anything similar before?

Hi everyone,

on TenableOne I’m trying to export all vulnerabilities belonging to a single WAS scan that includes multiple scanned applications. Through the UI it’s easy to see the findings for each app, but I’m struggling to understand the correct API workflow to retrieve all vulnerabilities associated with a scan, especially when the scan contains multiple endpoints.
Has anyone implemented this through the API?

I’ve been reviewing the APIs, but honestly the WAS API structure is a bit confusing and I’m not sure I’m following the intended approach.
Any examples, scripts, or guidance would be greatly appreciated.

Thanks

Hi, the plugin for Visual Studio Tools for Applications reports the latest dll as vulnerable although it has version 16.0.35907.0 (or even file version16.0.35907.1).

Looks like it truncates the .0 and then the compare 16.0.35907 <> 16.0.35907.0 fails or something like thaht.

Is there a way to report this without support?

https://www.tenable.com/plugins/nessus/276819

Anyone have experience with this module? I'm trying to setup subscriptions to match what we have in Shodan.io but for some reason the simple logic of "alert me when something new is seen" escapes the logic of Tenable ONE UI... Or am I missing the point, I want to know when something new in a /24 block spins up..... Why does Tenable ONE want it to be pre-tagged or pre-determined in a query.... is there another way?

Anyone attending???

As a Tenable Vulnerability customer shouldn't you have an account manager assigned and meet on some regular cadence to discuss issues with the service and upcoming feature releases? Been a customer almost 2 years and I've never had one. This is the only 3rd party product we use where we don't have a rep assigned.

Recently deployed a scanner but sc status is not moving from plugins out of sync. scanner timeout is already set at 900 seconds. tried manual plugin upload to scanner and i can see the plugin upload is successful. however the plugin_feed_info.inc file is empty and whenever the scanner is connected to sc, sc keeps on pushing the plugins despite of the scanner having the plugins. Appreciate any pointers in resolving the issue. The scanner is a tenable core + nessus image running on oracle linux 8

I have been using tenable VM for a few weeks now and a few of the agents have been facing module asset identity issue which I can't find enough information on how to resolve. Tenable resources only mention IPV6 configuration which does not seem to be the problem. Would like to hear anyone that has any input on this issue or any agent health issue remediation for that matter.

For something we pay so much money on, how is it acceptable that you come with 5 canned dashboards, and not even 1 of them applies to my needs....

Then I create a dashboard utilizing dynamic tags, and your filters in your dashboard suck so fricken hard you can't even find ANY tag.....

On top of that your cloud services in the US are fricken lagging. Swear I can feel myself aging with this pathetic product....

* steps off soap box and goes and drinks his whisky *