LevelBlue Vulnerability Scanner Guide

LevelBlue USM is modernizing its vulnerability scanning capabilities. The legacy jOVAL scanning engine has been replaced with Tenable Vulnerability Scanner technology, delivered through the LevelBlue Vulnerability Scanner BlueApp. This change improves scanning accuracy and coverage, while preserving the existing LevelBlue USM user experience. No workflow changes are required for day-to-day scanning operations. Important considerations after enabling the scanner:

• All assets must be visible to Tenable.
  • Public assets should use the Tenable Cloud Scanner.
  • Private assets require a locally installed Nessus scanner.
• Review and validate asset credentials before running authenticated scans.

By default, the LevelBlue Vulnerability Scanner is licensed for unlimited endpoints, but there is an API limit of 8192 endpoints per scan.

​

Configure and enable LevelBlue Vulnerability Scanner

1. Navigate to Data Sources and open the Available BlueApps tab.
2. Filter by Scanner, and then select LevelBlue Vulnerability Scanner Powered by Tenable.

3. Click Configure API, and then select the region where the configuration data will be stored.

4. Click Save.

A Tenable tenant and user account are automatically created during configuration. Login credentials for the Tenable portal are sent to the same email address used for LevelBlue USM.

5. Once the configuration is complete, you will receive an email confirmation.

6. Log into the Tenable portal using the temporary credentials provided.
7. In the Authorize Apps tab of the LevelBlue Vulnerability Scanner page, open Scanner Settings, and then select a default scan template.

8. Navigate to the assets or asset groups, and then run scans as usual.
9. Open the Scheduling tab to configure periodic scans.

​

Manage Asset Credentials

Existing LevelBlue USM credentials are fully supported. If credentials have been previously configured, then no reconfiguration is required. You can:

• Add new credentials

• Assign credentials to assets

​

Run an Authenticated Scan

1. Open the Asset page.
2. Confirm that credentials have been assigned.
3. Click Actions.
4. Select Authenticated Scan.

​

Run an Asset Group Authenticated Scan

1. Open the Asset Group page.
2. Confirm all assets in the group have been assigned credentials.
3. Click Actions.
4. Select Authenticated Scan.

​

Run an Asset Scan Action

1. From the Actions menu, select Run BlueApp Action.

2. Select Run LevelBlue Vulnerability Scanner powered by Tenable.

3. Select Run Scan.

4. Click Run.

​

Run a Scheduled Scan Periodically

The user experience does not change. Refer to Managing Credentials in USM Anywhere for more information

​

Download a Scan Result File

1. Open the Asset orAsset Group page.
2. Select the Scan History tab.
3. Locate the Scan File column.
4. Click the scan entry to download the file.

​

Test Credentials for an Asset

The user experience does not change. Refer to Managing Credentials in USM Anywhere for more information.

​

Review Authenticated Scanner Status in a Sensor

1. Navigate to Sensors.
2. Select the sensor to review.
3. Open the Authenticated Scanner tab.

​

Install the Nessus Scanner on Assets

1. Open this page and download the Nessus scanner: https://www.tenable.com/downloads/nessus.
2. Follow the installation guide: https://docs.tenable.com/nessus/Content/InstallNessus.htm
3. When prompted, select Link to another Tenable product.
4. Link the scanner to your Tenable portal using these instructions: https://docs.tenable.com/vulnerability-management/Content/Settings/Sensors/LinkaSensor.htm.

​

Helpful links

• Vulnerability Management Scanning Best Practices
• Credentials in Tenable Vulnerability Management Scans
• Frequently Asked Questions