Skip to main content
To deploy the Tenable sensor for AWS
  1. Log into AWS, and launch a new EC2 instance.
    • Enter a Name and tags for the instance.
    • Search for and select the Application and OS Images for the instance.
    AWS Ec2instance
  2. Select Tenable Core + Tenable Security Center (OL8).
    AWS Tenable Core
  3. Select Subscribe Now.
    AWS Tenable Subscribe
  4. Set the following configuration:
    • Select the Instance Type.
    • Select the Key Pair name. This is needed to connect to the instance.
    • Enter the VPC and Subnet for the Network Settings.
    • Enable the Auto-assign Public IP.
    • Enable SSH to access the Tenable sensor.
  5. Once done, click Launch Instance.
    AWS Instance Config
    AWS Instance Config2
  6. Continue creating the VM until you get a successful confirmation message.
    AWS Created VM
  7. Take note of the Public and Private IP addresses of the deployed VM.
    AWS IP
  8. Connect to the Tenable sensor via SSH.
    AWS SSH
  9. Log into cloud.tenable.com to get the Linking Key.
    GCP Tenable Cloud
  10. Click the burger menu, and then select Settings.
    Azure Burgermenu
    Hyper V Tenable Cloud
  11. Select Sensors.
    Hyper V Tenable Cloud Sensors
  12. Click Add Nessus Scanner to view the Linking Key.
    Hyper V Add Nessus Scanner
  13. Copy the Linking Key.
    Hyper V Copy Linking Key
  14. In the Tenable sensor CLI, use the Linking Key to link the Tenable sensor. 
    sudo /opt/nessus/sbin/nessuscli managed link --key=”Linking Key” –cloud
    AWS Tenable Link
    Once done, you should see a “Successfully linked” message.
    AWS Tenable Link OK
  15. Return to the Tenable cloud page, and verify that the Tenable sensor is linked correctly and is in Online status.
    AWS Tenable Online
    AWS Tenable Online2
VERIFICATION / TROUBLESHOOTING
  • If the sensor does not link properly:
  • If the scans do not find hosts:
    • Confirm that the scanner can reach the target network (routing, security groups/NSGs, and target host firewalls).
    • For credential scans, confirm that the credentials work and the required auth ports are reachable.