Passively analyze your network with Nessus Network Monitor
Get continuous visibility into managed and unmanaged assets
Nessus Network Monitor (NNM) provides deep packet inspection so you can eliminate blind spots within your network and continuously monitor all of your assets for vulnerabilities and network security issues. From operation technology (OT) to traditional IT and modern assets like the mobile devices and the cloud, Nessus Network Monitor is the real-time network monitoring tool you can count on for continuous visibility and immediate vulnerability detection.
Definitive guide to continuous network monitoring
A network monitor is a great tool to help you reduce risk for your attack surface, uncover vulnerabilities, and get a comprehensive picture of everything happening across your network. Continuous network monitoring enables you to adopt an automated, holistic approach for monitoring all of your assets. It’s critical in identifying even short-lived or transient assets so you can eliminate blind spots and keep an eye on your network for real-time threats.
But many security teams are hesitant to adopt continuous monitoring practices. There’s a concern that it can disrupt systems and technology and inadvertently create unnecessary downtime for organization. That’s why a passive network monitoring tool, like Nessus Network Monitor, can reduce that worry, giving you the insight you need to move away from legacy vulnerability management practices and fully embrace a risk-based approach that can help you stay one step ahead of attackers.
In this white paper, “The Definitive Guide to Continuous Network Monitoring,” you can explore the many benefits of network monitors and learn more about:
- Complex, evolving modern attack surfaces
- Increasing number of network security threats
- Why infrequent and periodic monitoring puts you at risk
- How to reduce your attack surface
- How to improve your network defenses
- How a network monitor can help you reach your compliance requirements
- What to consider when evaluating a network monitoring solution
Tenable Connect community: Your go-to resource for network monitors
Are you new to deploying network monitors? Do you have questions about how they work or do you want to take your network monitoring practices to the next level? Tenable Connect is a great place to connect with other information security professionals to explore the benefits of network monitors and how to configure them to get the most out of your processes.
Make Nessus Network Monitor (NNM) monitor all IP addresses
While NNM can be set to monitor every IP address, it may pollute or degrade the quality of vulnerability data for your actual hosts that should be monitored.
Free up disk space in Nessus Network Monitor
Freeing disk space from the Nessus Network Monitor (NNM) installation can be done manually by removing files via the Command Line Interface or by adjusting settings via the GUI.
Uploading a PCAP to Nessus Network Monitor (NNM)
NNM is a passive scanner that listens on the span port of a switch to detect vulnerabilities ... During troubleshooting, providing a PCAP from the NNM host can provide valuable insight into what NNM is seeing.
Network Monitors frequently asked questions
Are you new to network monitors? Do you have questions about network monitoring, but not sure where to start?
This FAQ is a great place to find answers:
-
What is a network monitor?
-
A network monitor is a tool that continuously monitors your environments to discover all of your assets and related vulnerabilities and security issues. In cybersecurity, network monitors give you non-intrusive continuous visibility into your network for all of your assets such as traditional IT, mobile devices, cloud-hosted applications and assets, operational technologies (OT), operating systems, databases, endpoints, web apps, virtual machines, network devices, hypervisors and more. Network monitors can analyze your network traffic at a packet level so you can discover vulnerabilities, both server and client-side, and monitor network usage. A network monitor can also discover PII and sensitive data in transit as well as identify port scans and other port-related activities. You can use a network monitor to spot suspicious activities and prevent them from compromising your network, data, and systems.
-
What is a network monitoring system?
-
A network monitoring system includes all of the hardware and software you need to monitor your network traffic. Continuous network monitoring, for example with Nessus Network Monitor, will give you non-intrusive insight into all of your assets throughout all of your environments so you can discover vulnerabilities, traffic and bandwidth issues, misconfigurations and other network security issues.
-
How does a network monitor work?
-
A network monitor works by communicating with devices and servers that connect to your network to collect information about those assets and monitor them for a variety of parameters and security issues. There are a few different ways your network monitor may communicate with these assets. For example, a network monitor can send a ping, or a signal, out to a device and then record if the device received the signal, how long it took for it to receive the signal, and if there is data loss. This pinging technique can help you see if the device is active or dormant or there are any other communication issues, such as packet loss. A network monitor can also use a standard protocol such as simple network management protocol (SNMP) or windows machine interface (WMI), HTTP, FTP, SMTP, TCP, and more. Other communication methods could include sending a syslog automated message or activating scripts that control specific actions, for example, changing a configuration on a device. The goal of these communication protocols is to query each asset, check it against a predetermined set of standards, and then notify you if something is askew or out of your acceptable control ranges.
-
Why is network monitoring important?
-
A network monitor is important for a number of reasons, but primarily it’s about the insight and information you can collect about performance and network security and then use that information to make changes that improve performance and make it more secure. Continuous network monitoring gives you instant insight into when there are changes to your network and whether any of these changes introduce an unacceptable risk for your organization. Network monitoring can also help ensure that you’re meeting all of your legal, contractual, compliance, and regulatory requirements. They’re also a great resource that can help you see potential issues that may cause a disruption or downtime so you can take steps to prevent data or service loss.
-
What are the types of network monitoring?
-
There are several types of network monitoring applications. Here are some examples:
- Intrusion detection: These network monitor tools scan your network and look for non-approved connections, for example from an unapproved IP.
- Off-network monitors: You can use off-network monitors for insight into traffic to and from your cloud, including access if you allow employees to use their own devices.
- Packet analyzation: With packet analyzers you can get insight into data packets as they traverse your network to gain a better understanding of network access and usage.
- Monitoring of services and applications: These tools give you insight into potential issues so you can address them before you experience any network downtime.
-
What are some examples of network devices?
-
Here are some examples of network devices you can monitor with a network monitor tool: switches, servers, routers, firewalls, next generation firewalls (NGFW), hubs, modems, gateways, bridges, repeaters, and access points.
-
What does network monitoring do?
-
Network monitoring is a way for you to keep an eye on and manage your network performance and where you may have security or other issues, such as device vulnerabilities, high traffic or bandwidth usage issues that exceed your typical usage. Network monitoring gives you insight into a range of devices, for example, your routers, servers, firewalls, and other hardware and software.
-
How do I monitor my network?
-
To monitor your network, select a network monitoring tool, such as Nessus Network Monitor, then do an inventory of all the assets on your network, specifying which ones are critical for operations. Next, set your network monitoring policies and establish a baseline for performance. After you set that baseline, you should configure alerts and notifications within your network monitoring tool so you will get updates when there are discrepancies. By using a continuous monitoring tool like NNM, you can always have insight into any issues and trust that your alerts will let you know when there is a problem that needs your attention.
-
What are some benefits of network monitors?
-
There are several benefits of network monitoring. For example, you can get insight into all of the assets that access your network so you know where you may have different types of network security issues. You can get insight into when a rogue asset connects, when there are unauthorized port scans, or when you have unusually high network traffic. You can use a network monitor to send you alerts when anything happens outside of your baseline, alerting you to issues that you may be able to resolve before there is a significant disruption or downtime. You can also use a network monitor to build reports on your network performance and security issues.
-
How are credentialed and non-credentialed scans different?
-
Credentialed and non-credentialed scans have the same purpose—to scan your assets for vulnerabilities, misconfigurations, and other types of network security issues, but they are also different. The core difference is a credentialed scan, also known as an authenticated scan, uses system privileges to do a deeper evaluation of the asset, compared to a non-credentialed (or unauthenticated) scan that provides a higher-level look at vulnerabilities and other issues through exposed ports, protocols and other services. A non-credentialed scan gives you insight into how a threat actor might exploit your network through those exposures without the need of credentials.
-
How are active querying and passive monitors different?
-
Passive and active monitors can both be used to monitor your network and assets, but they are different. With an active detection, you actively query devices to discover assets state and security issues . With a passive detection, you can configure an automated system to continuously monitor your network, instantly identifying policy violations, anomalous events or the detection of signatures., and to alert you whenever there are issues that arise outside of your preset baselines.
-
How can a network monitor help ensure regulatory compliance?
-
Network monitors gather a range of data and information about your network, devices, software, and applications. Data, as you know, plays a vital role in ensuring compliance. You can use a network monitor to analyze your compliance and security control effectiveness, document required information, and generate reports as needed for assessment and audits.
Reaping the benefits of continuous network monitoring
For far too long, many organizations have relied on static, point-in-time vulnerability scans to evaluate their attack surfaces for vulnerabilities and other network security issues. Unfortunately, that approach is no longer effective for today’s modern and evolving attack surfaces.
Why? Because periodic scans leave you with blind spots. You can only see the assets connected to your network when you run the scan. What about rogue assets or devices that rarely connect? You miss them with static scans.
That’s one of the many benefits of adopting continuous network monitoring instead. It gives you instant insight into all of your devices, as soon as they connect to your network, sending you real-time alerts about where you may have risks. This continuous monitoring empowers you with situational awareness you’d otherwise not have.
Here are some other benefits of network monitoring:
- You can discover types of network security threats and make plans to prioritize remediation
- Receive alerts when something, like a vulnerability or unauthorized traffic, needs your attention
- Have insight into your changing environment, across your entire attack surface, including IT, mobile, cloud, IoT, IIoT, OT and more
- With reporting and network-wide insight, you’ll have insight into current technology usage within your organization
- By monitoring your network traffic and bandwidth, you can understand how your organization uses resources and where you may to need adjustments/upgrades
- You can identify which assets/people/technologies cause security risks, identify trends and respond before a security incident
- Visibility when there have been changes to devices, operating systems, or others within your network
- See how deployment of new assets/software/applications affect the rest of your network and other devices
- Automate tasks that eliminate duplicate, repetitive work for your network security teams
- Insight to help decrease downtime
- Get insight when make network or device changes to see how those changes impact the rest of your network
- Continuous network monitoring gives you visibility into network issues outside of routine office hours when your network otherwise may not have been subject to monitoring or review
What to look for when selecting a network monitoring solution
Like any software solution or hardware decision, finding the right networking monitoring tool when there are lots of options in the market is challenging. How do you know which is right for your organization? How can you look past the marketing pitch to find one that does what you need today and will scale with your organization in the future? How do you know which one to trust?
Here are some tips to help you get started. Look for a solution that:
- Includes passive network sensors
- Has a log management system
- Offers frequent (daily) security updates including new plug-ins
- Has an industry-respected security research team
- Is easy to deploy and use
- Has industry recognized customer support
- Offers customer support 24/7/365 through a variety of communication channels
- Enables you to deploy new scanners as you need them
- Facilitates reporting and analytics with customizable reports and dashboards
- Helps you meet your compliance and regulatory requirements such as HIPAA, FISMA, PCI DSS, and more, as well as security frameworks such as CIS, NIST, ISO, and others
- Supports access controls down to a granular level
- Supports inventory management
- Supports patch management
- Supports mobile device management
- Supports risk management
- Supports incident management
- Facilitates penetration testing
- Helps you prioritize risks and plan remediation activities
- Supports integration with a variety of hardware and software across your enterprise, including, but not limited to next generation firewalls (NFGWs), security information and event management (SIEM), your cloud environments, and more
- Have clear, easy-to-understanding pricing and licensing options
- Support unlimited scans with no extra fees
- Has flexible deployment options
- Can scale with you as your organization grows and changes
- Supports credentialed and non-credentialed scans
- Trusted by thousands of global organizations, including most of the Fortune 500
Avoid solutions that:
- Require vendor-leased scanning hardware appliances
- Operate on vendor-specific (proprietary) operating systems or platforms
Need help determining which network monitoring solution may be best for you? Check out this white paper for a more in-depth look at network monitors, including key features and other important buying considerations.
Risk-based vulnerability management best practices
While risk-based vulnerability management is a relatively new approach to vulnerability management, you can take steps toward a risk-driven program for your organization by implementing these best-practice recommendations:
- Install your network monitor. If you’re using Nessus Network Monitor, you can get installation help for Linux, Windows, or Mac OS here.
- Select assets to scan and which to exclude. For your first scan, it might be helpful to begin with operationally critical assets like your network, servers and firewalls.
- Group hosts and assign categories for your assets.
- Determine the type of scan you want to do. With Nessus Professional, you can choose a scan template that meets your specific needs. Here are some examples:
- Non-credentialed (unauthenticated) scan that does not require system credentials
- Credentialed (authenticated) scan that requires authentication?
- Configure scan settings, such as frequency, IP range, and how many checks to run simultaneously on one host.
- Set auditing policies, for example, unauthorized applications, unauthorized software, configuration changes or open ports that should be closed.
- Run your scan.
- Customize your dashboard for the insight and you need.
- Create reports to share what you discover with team members and key stakeholders.
- Prioritize vulnerabilities and plan for remediation.
This is a high-level overview of a Nessus scan. You can go deeper with this Nessus Scan walkthrough or, if you’re looking at a non-product specific overview, you can find one in this Definitive guide to continuous network monitoring.
Real-time, continuous monitoring with Nessus Network Monitor
Your attack surface is constantly changing, meaning there’s always more vulnerabilities and potential weaknesses attackers can exploit. It’s challenging to stay one step ahead, but with Nessus Network Monitor, you’ll always have continuous insight into all the assets across your environment, so you can see where you have risks and make plans to prioritize remediation to keep your attack surface safe.
Network monitor blog bytes
New capabilities to automatically discover and assess rogue assets
Finding and assessing all your assets is challenging, especially if your organization’s attack surface includes IT, OT, mobile, cloud and more. Because of this, many organizations have long struggled with getting comprehensive insight. They often rely on vulnerability scanning tools that leave them with blind spots because they can’t see all assets across all of the environments. One study even revealed that less than 30% of security professionals say they have enough visibility into their attack surface. The good news is you don’t have to be left in the dark. Nessus Network Monitor, for example, has the industry’s broadest asset coverage, meaning you can see what’s happening on your network at all times. In discovery mode, you can even use NNM to find rogue assets.
How to maximize your penetration tests with Nessus
While people often confuse penetration tests with vulnerability assessments, they are not the same things; however, both can help you discover weaknesses in your network. Your goal with a vulnerability assessment is to discover, quantify and analyze vulnerabilities across your attack surface, whereas with a penetration test, you’re doing an authorized attack on that attack surface to exploit vulnerabilities. Did you know you can use Nessus Professional’s active scanning to find the areas you should focus on for a penetration test? Then you can use your penetration test to dive further into those weaknesses to provide valuable data so you know where you need to prioritize remediation to reduce risk.
What you need to know about vulnerability management best practices
Legacy vulnerability management practices have been common throughout the cybersecurity industry for decades, but they’re becoming increasingly unreliable for true attack surface protection and defense. Why? Because legacy vulnerability management doesn’t give you insight into all of today’s modern assets like mobile, cloud and more. You can, however, improve your practices with a risk-based approach, including using a network monitor in conjunction with Tenable’s Vulnerability Priority Rating (VPR) to create a dynamic list of assets that might be targeted in an attack.
Eliminate blind spots and monitor everything with Nessus Network Monitor
With Nessus Network Monitor (NNM) you can see and protect everything across your evolving attack surface including traditional IT, operational technology (OT), cloud applications, web servers, web apps, operating systems, devices on your network, databases, mobile devices, and more.
NNM gives you unprecedented insight into all of your assets. With deep packet inspection, you can continuously monitor your network to discover new assets, track users, and discover vulnerabilities and other weaknesses that put your organization at risk.
Continuous visibility
- Continuously monitor and assess your entire network without disruptions
- Keep an eye on network traffic at the packet level to discover server and client-side issues
- Have confidence that as you scale, NNM will scale with your expanding network
Suspicious traffic insight
- Discover unencrypted personally identifiable information (PII) and sensitive data in motion
- Awareness when internal systems conduct port scans
- Insight into interactive and encrypted network sessions
Automatic vulnerability discovery
- Automatically assess your infrastructure for vulnerabilities
- Discover server and client-side weaknesses in new and transient assets
- Find vulnerabilities on communicating systems and related protocols and apps
Asset discovery
- OT
- Servers and endpoints
- Web apps
- Network devices
- Cloud assets
- Mobile devices
Compliance management
- Identification of all systems related to compliance mandates
- Provide evidence of controls
- Monitor data flows
Tenable One
Request a demo
The world’s leading AI-powered exposure management platform.
Thank You
Thank you for your interest in Tenable One.
A representative will be in touch soon.
Form ID: 7469
Form Name: one-eval
Form Class: c-form form-panel__global-form c-form--mkto js-mkto-no-css js-form-hanging-label c-form--hide-comments
Form Wrapper ID: one-eval-form-wrapper
Confirmation Class: one-eval-confirmform-modal
Simulate Success