Tenable Blog

The Log Correlation Engine can be used to track DHCP leases and Active Directory authentication logs to automatically learn each user's Ethernet address and then alert when this relationship changes. Tenable has released a TASL script named user_to_mac.tasl which can perform this function with a variety of DHCP sources and Active Directory "successful login" events. This script is useful for several reasons:

We've gotten requests for more webinars on a variety of topics. Below is the current schedule of webinars presented by Tenable in the month of October. These include an additional "Future of Vulnerability Management" talk, as well as sessions on the Nessus 3 compliance audit capabilities, network behavioral anomaly detection and passive SCADA network monitoring. Each session requires registration and completion of a short survey.

If you are faced with the task of finding network probes and attacks in an endless stream of IDS, firewall, netflow and application events, then using one or more honeypots to help find low-and-slow probes, stealthy attacks and internal abusers may be for you. This blog entry will discuss several different types of honeypot types, monitoring techniques, and how this can be implemented with the Tenable Security Center and Log Correlation Engine.

If you've invested a lot of money into a commercial patch management system or perhaps you've grown your own, how do you know how effective it is? With Nessus's agent-less host based patch audits, it can effectively be used to understand how effective your patching solution has been. It can also be used to identify hosts which are not being patched or are under management. Lastly, we will discuss how to determine how effective your patch management system has been.

A common question our support group receives from