Installation guide

84
Available fields include Job ID, Type, Obj ID, Status, PID, Organization, Initiator, Start Time, and Targeted Time. This
information is not generally required for the day to day operations of SecurityCenter, but may be requested by Tenable
Support when troubleshooting issues.
Job options include “Detail”, which lets you view individual job details and “Kill Job”, which lets you kill a currently running
job. Killing any process is not recommended except at the request of Tenable Support.
Jobs may be searched using the “Filters” bar at the top of the page. The available filters are “Type”, “Status”,
“Organization”, and “Initiator”. These filters may be used individually or in combination to narrow the displayed list of jobs.
Table 38 – Filters
Option
Description
Type
This is a text field that will narrow the search as you type. It will match on the text
entered and is not case sensitive.
Status
This will display the jobs with the selected status.
Organization
Only the jobs owned by the selected organization will be displayed.
Initiator
Only the jobs owned by the initiator with the name or partial name entered in the field
will be displayed.
Logs
SecurityCenter logs contain detailed filter options to troubleshoot unusual system or user activity. The logs include filters
that allow users to search logs based on parameters such as date, user, module, severity, keywords, and source. An
example keyword and source search based on the word “attempt” is displayed below:
This search flexibility improves debugging and maintains an audit trail of users who access SecurityCenter or perform
basic functions such as changing passwords, recasting risks, or running Nessus scans.
Audit Admin & User Activity
SecurityCenter provides the ability to audit user activity either through the console web interface or via a flat ASCII log file
in the /opt/sc4/orgs/[organization id]/logs and /opt/sc4/admin/logs directories on the SecurityCenter
server. Authorized system administrators are also able to sort through audit data using operating system commands such
as “grep”, “awk”, and “sed”.
Startup and Shutdown of the Audit Functions
The audit functions are built into the SecurityCenter application and are started when SecurityCenter is started, usually at
system boot time or manually by a system administrator. The audit functions cannot be shut down while SecurityCenter is
running.