This project demonstrates how to deploy a Tenable Nessus Agent on a Linux virtual machine, connect it to the Tenable Cloud platform, and perform an agent-based vulnerability assessment.
The objective of this lab is to gain hands-on experience deploying endpoint security software, initiating vulnerability scans, analyzing findings, and understanding how organizations continuously monitor systems for security risks.
- Provision a Linux Virtual Machine
- Configure a Nessus Agent Group
- Deploy a Nessus Agent
- Connect the endpoint to Tenable Cloud
- Trigger a vulnerability scan
- Analyze scan results
- Document findings
- Remove lab resources
- Linux Administration
- SSH Remote Access
- Vulnerability Management
- Endpoint Security
- Cloud Security
- Bash
- Security Monitoring
- Risk Assessment
- Cybersecurity Documentation
- Troubleshooting
- Ubuntu Linux
- Tenable.io
- Nessus Agent
- SSH
- Bash
- Virtual Machine
| Component | Description |
|---|---|
| Operating System | Ubuntu Linux |
| Scanner | Nessus Agent |
| Platform | Tenable Cloud |
| Access Method | SSH |
| Shell | Bash |
Create a Linux virtual machine that will serve as the endpoint for vulnerability scanning.
I provisioned a Linux VM and created a secure administrator account using a strong password rather than the default credentials.
This ensures the endpoint is properly secured before connecting it to the Tenable platform.
Using strong credentials is a basic but essential security control.
Create an Agent Group to organize managed endpoints.
Within the Tenable Cloud portal, I created a new Nessus Agent Group.
The agent group allows multiple endpoints to be centrally managed and scanned together.
Agent Groups simplify vulnerability management across multiple systems.
Create a scan that can be manually triggered from the endpoint.
I configured a Triggered Basic Agent Scan and associated it with the newly created Agent Group.
I also selected a trigger filename that would later initiate the scan "start.txt".
Triggered scans allow the endpoint itself to initiate vulnerability assessments.
Access the Linux endpoint remotely.
I connected to the Linux virtual machine using SSH.
ssh username@IP-ADDRESS
SSH provides secure encrypted remote administration of Linux systems.
Generate an installation command that registers the endpoint with Tenable Cloud.
Inside Tenable Cloud, I created a new Nessus Agent installation command and customized it with my Agent Group information.
The registration key securely links the endpoint to the Tenable Cloud platform.
Install and register the Nessus Agent.
I elevated to root privileges and executed the installation command.
sudo -icurl -H 'X-Key: XXXXXXX' https://sensor.cloud.tenable.com/install/... | bash
The endpoint is now managed through Tenable Cloud.
Initiate the agent scan.
I manually created the trigger file used by the Nessus Agent.
touch /opt/nessus_agent/var/nessus/triggers/start.txt
Creating the trigger file instructs the agent to begin scanning.
Verify that the agent accepted the trigger.
I monitored the trigger directory until the trigger file disappeared.
cd /opt/nessus_agent/var/nessus/triggersls -lasht
Once the trigger file disappears, the Nessus Agent has started the vulnerability scan.
Confirm successful registration.
I navigated to the Nessus Agents page and verified my endpoint appeared online.
- Agent Name
- Online Status
- Registration Date
- Agent Group
Review vulnerabilities discovered by the Nessus scan.
After the scan completed, I reviewed the vulnerability report and analyzed the discovered findings.
- Severity Levels
- CVEs
- CVSS Scores
- Vulnerability Descriptions
- Recommended Remediation
Understanding vulnerability severity helps prioritize remediation efforts.
Observe the Nessus Agent process.
I monitored the Linux system using the top command.
topMonitoring system processes helps verify the scan is actively running.
After completing the lab, I cleaned up all cloud resources.
- Deleted the scan
- Deleted the Agent Group
- Unlinked the Nessus Agent
- Deleted the Linux VM
This prevents unnecessary cloud resources from remaining active.
- Verified the installation
- Restarted the Nessus Agent
- Waited for synchronization
- Confirmed the endpoint successfully registered
- Vulnerability Management
- Agent-Based Scanning
- Endpoint Security
- Continuous Monitoring
- CVEs
- CVSS Scoring
- Risk Prioritization
During this lab, I learned how endpoint-based vulnerability scanning differs from traditional network scanning.
I also gained hands-on experience installing and configuring a Nessus Agent, connecting it to Tenable Cloud, triggering scans manually, and analyzing vulnerability data.
This project improved my Linux command-line skills and reinforced the importance of continuous vulnerability management in enterprise environments.
- Deploy multiple endpoints
- Compare authenticated vs. unauthenticated scans
- Integrate results with a SIEM
- Automate deployment using Ansible
- Practice vulnerability remediation and rescanning
- Vulnerability Management
- Linux Administration
- Bash
- SSH
- Endpoint Security
- Tenable Nessus
- Cloud Security
- Security Monitoring
- CVE Analysis
- Risk Assessment
- Troubleshooting
- Technical Documentation