CB Protection: Allow Tenable Security Center/Nessus scans to run on Windows endpoints

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Agent is preventing Tenable/Nessus scans from completing successfully.

Environment

• CB Protection Agent: All Verisons
• Microsoft Windows: All Supported Versions
• Tenable Security Center/Nessus Agent

Cause

Nessus utilizes .bat files that are unique to each endpoint, and aren’t signed by a publisher.

Resolution

1. Create a new custom rule for 'Execution Control' using the following settings:
   1. Name: Nessus Scan Allow
   2. Description: Allow Nessus scans
   3. Status: Enabled
   4. Platform: Windows
   5. Rule Type: Execution Control
   6. Execute Action: Allow
   7. Path or File:
      1. c:\windows\temp\nessus*.bat
      2. c:\windows\tenable_mw_scan*.exe
   8. Process: Specific Process
      1. c:\windows\tenable_mw_scan*.exe
      2. c:\windows\system32\services.exe
      3. c:\windows\system32\cmd.exe
   9. User or Group: Any User
   10. Rule Applies To: All Policies

Additional Information

• Instructions for creating a custom rules can be found in the CB Protection User Guide.