Tenable.io
Vulnerability Management- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Tenable Vulnerability Management connector integrates with Tenable.io to synchronize host assets, vulnerability scan results, vulnerability/violation definitions, compliance findings, and scan metadata into the Brinqa platform. It uses the v2 Asset Export API for enhanced asset type filtering and the standard Vulnerability/Compliance Export APIs for findings.
Data retrieved from Tenable Vulnerability Management
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Host | Yes | Host |
| Scan | Yes | Assessment |
| Vulnerability | Yes | Vulnerability |
| VulnerabilityDefinition / ViolationDefinition | Yes | Vulnerability Definition |
| Violation (Compliance Finding) | Yes | Violation |
Model relationships
note
For detailed steps on how to view the data retrieved from Tenable Vulnerability Management in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Tenable Vulnerability Management from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| API URL | No | https://cloud.tenable.com | Tenable Vulnerability Management API URL, defaults to https://cloud.tenable.com |
| Access Key | Yes | Default - (user input, Required) | Tenable Vulnerability Management API account access key |
| Secret Key | Yes | Default - (user input, Required) | Tenable Vulnerability Management API account secret key |
| Page size | No | 100 | Maximum number of records to get per API request |
| Parallel requests | No | 3 | Maximum number of parallel API requests |
| Maximum retries | No | 5 | The maximum number of retry attempts before giving up a request |
| Custom properties | No | Default - (user input) | Comma delimited list of case-insensitive custom property names to be promoted to Tenable IO Asset models |
Authentication
Method
API Key authentication using an Access Key and Secret Key pair.
Endpoint
| Method | URL |
|---|---|
GET | https://cloud.tenable.com/* |
Request Headers
| Header | Value |
|---|---|
X-ApiKeys | accessKey={accessKey};secretKey={secretKey} |
Usage
All API requests include the API key pair in the X-ApiKeys header. No separate token exchange is required.
How to obtain Tenable Vulnerability Management credentials
Generate Tenable Vulnerability Management API keys
In order for the Tenable Vulnerability Management connector to successfully retrieve data from the Tenable Vulnerability Management API, the access key and secret key must be tied to a Basic user role with Can View permissions. For additional information, see Tenable Vulnerability Management documentation on permissions.
For the Tenable Vulnerability Management connector to use the Tenable Vulnerability Management API, you must provide an access key and secret key. Tenable Vulnerability Management does not allow retrieving the access key and secret key for an existing user, therefore, you must generate new keys instead.
To generate new access keys, follow these steps:
-
Log in to your Tenable Vulnerability Management account.
-
Click the Menu button on the upper-left corner of the page. A navigation pane appears.
-
Click Settings, and then click My Account.
-
Click the User Account button on the upper-right corner of the page, and then click the API Keys tab.
-
Click Generate. The Generate API Keys window appears.
-
Review the warning on the page and click Generate.
Your new Tenable Vulnerability Management access key and secret key display. Copy the access key and secret key to a safe and secure location.
To generate a new access key and secret key for another user as an administrator, follow these steps:
-
Log in to your Tenable Vulnerability Management account as an administrator.
-
Click the Menu button on the upper-left corner of the page. A navigation pane appears.
-
Click Settings, and then click Access Control.
-
Click the name of the user for which you want to generate an access key and secret key. The Edit User page appears.
-
In the API Keys section, click Generate API Keys.
-
Review the warning on the page and click Replace & Generate.
The new Tenable Vulnerability Management access key and secret key display. Copy the access key and secret key to a safe and secure location.
Note: If you do not have permissions to create Tenable Vulnerability Management access and secret keys, contact your Tenable Vulnerability Management administrator. For additional information, see Tenable Vulnerability Management documentation on API keys.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Host
| Source Field Name | SDM Attribute |
|---|---|
asset.agent_names | AGENT_NAMES |
asset.agent_uuid | TENABLE_UUID |
asset.cloud.aws.availability_zone | AWS_AVAILABILITY_ZONE |
asset.cloud.aws.ec2_instance_ami_id | AWS_EC2_INSTANCE_AMI_ID |
asset.cloud.aws.ec2_instance_group_name | AWS_EC2_INSTANCE_GROUP_NAME |
asset.cloud.aws.ec2_instance_id | AWS_EC2_INSTANCE_ID |
asset.cloud.aws.ec2_instance_id / azure.vm_id / gcp.instance_id | INSTANCE_ID |
asset.cloud.aws.ec2_instance_state_name | AWS_EC2_INSTANCE_STATE |
asset.cloud.aws.ec2_instance_type | AWS_EC2_INSTANCE_TYPE |
asset.cloud.aws.ec2_name | AWS_EC2_NAME |
asset.cloud.aws.ec2_name / hostnames / fqdns / ipv4s | NAME |
asset.cloud.aws.ec2_product_code | AWS_EC2_PRODUCT_CODE |
asset.cloud.aws.owner_id | AWS_OWNER_ID |
asset.cloud.aws.region | AWS_REGION |
asset.cloud.aws.subnet_id | AWS_SUBNET_ID |
asset.cloud.aws.vpc_id | AWS_VPC_ID |
asset.cloud.azure.resource_id | AZURE_RESOURCE_ID |
asset.cloud.azure.vm_id | AZURE_VM_ID |
asset.cloud.gcp.instance_id | GCP_INSTANCE_ID |
asset.cloud.gcp.project_id | GCP_PROJECT_ID |
asset.cloud.gcp.zone | GCP_ZONE |
asset.custom_attributes[].value | CUSTOM_{name} |
asset.deleted_by | DELETED_BY |
asset.has_agent | HAS_AGENT |
asset.has_plugin_results | HAS_PLUGIN_RESULTS |
asset.id | UID |
asset.installed_software | INSTALLED_SOFTWARE |
asset.is_licensed | IS_LICENSED |
asset.is_public | IS_PUBLIC |
asset.manufacturer_tpm_ids | MANUFACTURER_TPM_IDS |
asset.mcafee_epo_agent_guid | MCAFEE_EPO_AGENT_GUID |
asset.mcafee_epo_guid | MCAFEE_EPO_GUID |
asset.network.bios_uuid | BIOS_UUID |
asset.network.fqdns | DNS_NAMES |
asset.network.fqdns | PRIVATE_DNS_NAME |
asset.network.fqdns | PUBLIC_DNS_NAME |
asset.network.hostnames + netbios_names + fqdns | HOSTNAME |
asset.network.hostnames + netbios_names + fqdns | HOSTNAMES |
asset.network.ipv4s | PRIVATE_IP_ADDRESSES |
asset.network.ipv4s | PUBLIC_IP_ADDRESSES |
asset.network.ipv4s | PUBLIC_IP_ADDRESS |
asset.network.ipv4s + ipv6s | IP_ADDRESSES |
asset.network.mac_addresses | MAC_ADDRESSES |
asset.network.network_id | NETWORK_ID |
asset.network.network_name | NETWORK_NAME |
asset.network.ssh_fingerprints | SSH_FINGERPRINTS |
asset.network_device_serial_identifier | NETWORK_DEVICE_SERIAL_IDENTIFIER |
asset.open_ports | OPEN_PORTS |
asset.operating_systems | OPERATING_SYSTEM |
asset.operating_systems | OPERATING_SYSTEMS |
asset.ratings.acr.score | ACR_SCORE |
asset.ratings.aes.score | AES_SCORE |
asset.resource_tags | RESOURCE_TAGS |
asset.scan.first_scan_time | FIRST_SCANNED |
asset.scan.last_authenticated_scan_date | LAST_AUTHENTICATED_SCAN |
asset.scan.last_authentication_attempt_date | LAST_AUTHENTICATION_ATTEMPT_DATE |
asset.scan.last_authentication_scan_status | LAST_AUTHENTICATION_SCAN_STATUS |
asset.scan.last_authentication_success_date | LAST_AUTHENTICATION_SUCCESS_DATE |
asset.scan.last_licensed_scan_date | LAST_LICENSED_SCAN |
asset.scan.last_scan_id | LAST_SCAN_UUID |
asset.scan.last_scan_target | LAST_SCAN_TARGET |
asset.scan.last_scan_time | LAST_SCANNED |
asset.scan.last_schedule_id | LAST_SCAN_SCHEDULE_UUID |
asset.sources[].name | SOURCES |
asset.system_types + constants | CATEGORIES |
asset.tags | TAGS |
asset.tenable_agent_days_since_active | TENABLE_AGENT_DAYS_SINCE_ACTIVE |
asset.terminated_by | TERMINATED_BY |
asset.third_party_ids.servicenow_sysid | SERVICE_NOW_ID |
asset.timestamps.created_at | SOURCE_CREATED_DATE |
asset.timestamps.deleted_at | DELETED_AT |
asset.timestamps.first_seen | FIRST_SEEN |
asset.timestamps.last_seen | LAST_SEEN |
asset.timestamps.terminated_at | TERMINATED_AT |
asset.timestamps.terminated_at / deleted_at / aws.ec2_instance_state_name | STATUS |
asset.timestamps.updated_at | SOURCE_LAST_MODIFIED |
asset.types | ASSET_TYPES |
| Generated | DESCRIPTION |
Instant.now() | LAST_CAPTURED |
lastScan.name | LAST_SCAN_NAME |
Scan
| Source Field Name | SDM Attribute |
|---|---|
detail.hosts | TARGETS |
detail.info.scan_end | END_TIME |
detail.info.scan_start | START_TIME |
Instant.now() | LAST_CAPTURED |
scan.creation_date | SOURCE_CREATED_DATE |
scan.id | UID |
scan.last_modification_date | SOURCE_LAST_MODIFIED |
scan.name | NAME |
scan.owner | OWNER |
scan.rrules | R_RULES |
scan.schedule_uuid | SCHEDULE_UUID |
scan.startTime | SCHEDULE_START_TIME |
scan.status | STATUS |
scan.type | SCAN_TYPE |
scan.uuid | SCAN_UUID |
Vulnerability
| Source Field Name | SDM Attribute |
|---|---|
| Generated | UID |
Instant.now() | LAST_CAPTURED |
vuln.asset.agent_uuid | AGENT_UUID |
vuln.asset.fqdn | PRIVATE_DNS_NAME / PUBLIC_DNS_NAME |
vuln.asset.hostname + netbios_name | HOSTNAME |
vuln.asset.ipv4 | IP_ADDRESSES |
vuln.asset.mac_address | MAC_ADDRESSES |
vuln.asset.uuid | TARGETS |
vuln.first_found | FIRST_FOUND |
vuln.last_fixed | LAST_FIXED |
vuln.last_found | LAST_FOUND |
vuln.output | RESULTS |
vuln.plugin.id | TYPE |
vuln.port.port | PORT |
vuln.port.protocol | PROTOCOL |
vuln.resurfaced_date | RESURFACED_DATE |
vuln.scan.schedule_uuid | SCHEDULE_UUID |
vuln.scan.uuid | SCAN_UUID |
vuln.severity | SEVERITY |
vuln.severity | SOURCE_SEVERITY |
vuln.severity | SEVERITY_SCORE |
vuln.severity_modification_type | SEVERITY_MODIFICATION_TYPE |
vuln.state | SOURCE_STATUS |
vuln.state | PROVIDER_STATUS |
VulnerabilityDefinition / ViolationDefinition
| Source Field Name | SDM Attribute |
|---|---|
Instant.now() | LAST_CAPTURED |
PID-{plugin.id} | UID |
plugin.cpe | AFFECTED |
plugin.cve | CVE_IDS / CVE_RECORDS |
plugin.cvss3_base_score | CVSS_V3_BASE_SCORE |
plugin.cvss3_temporal_score | CVSS_V3_TEMPORAL_SCORE |
plugin.cvss_base_score | CVSS_V2_BASE_SCORE |
plugin.cvss_temporal_score | CVSS_V2_TEMPORAL_SCORE |
plugin.description | DESCRIPTION |
plugin.exploit_available | EXPLOIT_AVAILABLE |
plugin.exploit_code_maturity | EXPLOIT_CODE_MATURITY |
plugin.exploit_framework_* | EXPLOITS |
plugin.exploitability_ease | EXPLOIT_EASE |
plugin.family | CATEGORIES |
plugin.has_patch | PATCH_AVAILABLE |
plugin.name | NAME |
plugin.risk_factor | SEVERITY |
plugin.risk_factor | SOURCE_SEVERITY |
plugin.risk_factor | SEVERITY_SCORE |
plugin.solution | RECOMMENDATION |
plugin.synopsis | SUMMARY |
plugin.vpr.score | VPR_SCORE |
plugin.xref | REFERENCES |
| plugin_modification_date | SOURCE_LAST_MODIFIED |
| vuln_publication_date / plugin_publication_date | PUBLISHED_DATE |
Violation (Compliance Finding)
| Source Field Name | SDM Attribute |
|---|---|
finding.asset_uuid | TARGETS |
finding.check_info | DESCRIPTION |
finding.check_name + check_error + audit_file + expected_value + actual_value | RESULTS |
finding.first_seen | FIRST_SEEN |
finding.last_seen | LAST_SEEN |
finding.plugin_id | TYPE |
finding.reference | REFERENCES |
finding.solution | RECOMMENDATION |
finding.status | STATUS |
finding.status | SOURCE_STATUS |
| Generated | UID |
Instant.now() | LAST_CAPTURED |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Host
Operation options
This object does not support any operation options.
Delta sync
The connector README does not document sync behavior for this object.
API
- Type: REST endpoint (v2 asset export)
- Default filters:
sources=NESSUS_AGENT,NESSUS_SCAN,PVS,AWS,SSM,types=host
Scan
Operation options
This object does not support any operation options.
Delta sync
The connector README does not document sync behavior for this object.
API
- Type: REST endpoint (JSON)
Vulnerability
Operation options
This object does not support any operation options.
Delta sync
The connector README does not document sync behavior for this object.
API
- Type: REST endpoint (vulnerability export)
VulnerabilityDefinition / ViolationDefinition
Operation options
This object does not support any operation options.
Delta sync
The connector README does not document sync behavior for this object.
API
- Type: REST endpoint (JSON)
Violation (Compliance Finding)
Operation options
This object does not support any operation options.
Delta sync
The connector README does not document sync behavior for this object.
API
- Type: REST endpoint (compliance export)
Changelog
The Tenable Vulnerability Management connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.1.50 | Improvements - Transient 502 Bad Gateway and 503 Service Unavailable responses from Tenable.io during an export request (Host, Violation, Vulnerability) are now retried with exponential backoff. If the upstream remains unavailable after retries, the affected source is skipped with a clear log entry so the rest of the sync completes instead of failing the whole run. | N/A |
| 3.1.49 | No changes in this release. | N/A |
| 3.1.48 | Bug Fixes - Violation — Corrected the "First seen" and "Last seen" attributes to be stored as proper timestamps (were stored as numbers), matching the value returned by the API. | • Violation: the date attributes listed above changed from numbers to timestamps. Re-sync the Tenable IO VM connector to repopulate these records with the corrected type. |
| 3.1.47 | No changes in this release. | N/A |
| 3.1.46 | Improvements Dependency Upgrades - Refreshed internal model and CVSS scoring libraries to the latest stable releases to pick up upstream fixes and stay aligned with the rest of the Brinqa connector platform. Cross-Connector Attribute Consolidation - Every connector-defined custom attribute now participates in cross-connector consolidation by default. When the same asset or finding is observed by another connector, Brinqa will merge values for these attributes consistently rather than treating each connector's values as independent. | • Re-sync the connector after upgrading so that previously synced records pick up the new consolidation mappings. Existing data remains intact; the re-sync ensures consolidated values for assets and findings shared with other connectors converge correctly. |
| 3.1.45 — Withdrawn | This release shipped a regression and has been superseded by 3.1.46. Customers should skip 3.1.45 and upgrade directly from 3.1.44 to 3.1.46. | N/A |
| 3.1.44 | Improvements Dependency Upgrades - Upgraded internal framework and storage libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | Several attributes were removed in the underlying framework and replaced with renamed multi-valued (or boolean-equivalent) counterparts. Values previously stored under the old attribute names remain in place but will no longer be updated; new syncs populate the new attribute names. Action: Re-sync the connector after upgrade. | Model | Old Attribute | New Attribute | |:---|:---|:---| | Host | HOSTNAME | HOSTNAMES | | Host | PUBLIC_DNS_NAME | PUBLIC_DNS_NAMES | | Host | PUBLIC_IP_ADDRESS | PUBLIC_IP_ADDRESSES | | Vulnerability | HOSTNAME | HOSTNAMES | | Vulnerability | PRIVATE_DNS_NAME | PRIVATE_DNS_NAMES | | Vulnerability | PUBLIC_DNS_NAME | PUBLIC_DNS_NAMES | | Vulnerability Definition | PATCH_AVAILABLE | PATCHABLE | | Violation Definition | PATCH_AVAILABLE | PATCHABLE | |
| 3.1.43 | No changes in this release. | N/A |
| 3.1.42 | Bug Fixes - Upgraded to Tenable v2 Asset Export API — The connector now uses the newer assets/v2/export endpoint instead of the deprecated v1 API, providing richer asset data and better performance. - Support for host asset type — Asset type filtering is now configurable via the types operation option (comma-separated). Defaults to host for VM. Improvements - 17+ new asset attributes available — Additional asset fields are now synced, including network details (network name, BIOS UUID, SSH fingerprints, open ports, network device serial identifier), scan-authentication fields (last authentication attempt/success date, scan status, scan target), Tenable ratings (ACR score, AES score), and asset metadata (asset types, manufacturer TPM IDs, has plugin results, is licensed, is public, agent days since active, resource tags). - Custom properties support — You can now configure custom asset properties via the customProperties configuration field. Specified properties will be synced with a CUSTOM_ prefix. - Improved resilience to API changes — All asset model classes now ignore unknown fields from the Tenable API, so the connector will not break if Tenable adds new fields to their responses. - Improved handling of missing data — The connector now gracefully handles cases where the Tenable v2 export API omits optional fields, preventing sync errors on incomplete API responses. Note: MCAFEE_EPO_AGENT_GUID and MCAFEE_EPO_GUID may be empty when McAfee ePO integration is not active or configured. | • Breaking change: If you have downstream logic that depends on ACR_SCORE or AES_SCORE being decimal values, update it to expect whole numbers (integers). |
| 3.1.41 | Improvements - Finding records now capture the time each finding was last observed during a sync, improving the accuracy of "last seen" reporting for vulnerabilities and compliance violations. | N/A |
| 3.1.40 | No changes in this release. | N/A |
| 3.1.39 | Improvements - Improved resilience when Tenable returns transient service-unavailable or gateway-timeout responses, reducing failed syncs caused by temporary platform outages. | N/A |
| 3.1.38 | No changes in this release. | N/A |
| 3.1.37 | Improvements - Refined how vulnerability finding data is populated for more consistent results across syncs. | N/A |
| 3.1.36 | Improvements - Reworked the asset export model to share a common base across asset types, expanding the cloud-provider metadata captured for hosts (additional AWS, Azure, and GCP fields). | N/A |
| 3.1.35 | New Features - Resurfaced date — Vulnerability findings now include a "Resurfaced date" attribute indicating when a previously remediated finding was detected again. | N/A |
| 3.1.34 | Improvements - Internal refinements to plugin-based finding handling. No customer-visible behavior change. | N/A |
| 3.1.33 | Improvements - Host records now capture when the asset was last observed by Tenable, improving "last seen" accuracy. | N/A |
| 3.1.32 | Improvements - Hardened handling of transient service-unavailable responses from Tenable to reduce sync failures during temporary platform outages. | N/A |
| 3.1.31 | No changes in this release. | N/A |
| 3.1.30 | Bug Fixes - Corrected vulnerability finding population for more reliable results. | N/A |
| 3.1.29 | Bug Fixes - Vulnerability — Refined how the finding source status is populated so it reflects the resolved status value. | N/A |
| 3.1.28 | Improvements - Vulnerability — Finding status is now normalized into a standard status and status category, and the original Tenable status is preserved separately as the provider status. This produces more consistent open/closed reporting across connectors. | N/A |
| 3.1.27 | No changes in this release. | N/A |
| 3.1.26 | Bug Fixes - Vulnerability Definition / Violation Definition — "Vulnerability age" is now stored as a whole number again (was temporarily stored as text), so it can be used in numeric comparisons. | • The "Vulnerability age" attribute changed from text back to a number. Re-sync the connector so existing definition records are repopulated with the corrected type. |
| 3.1.25 | Improvements - Host — Added an "Installed software" attribute listing software packages reported for the asset. | N/A |
| 3.1.24 | Improvements - Restructured the asset and plugin-based finding models around shared base classes, improving consistency of attribute handling across Host, Vulnerability, Vulnerability Definition, Violation, and Violation Definition records. | N/A |
| 3.1.23 | Improvements - CVSS scoring — CVSS v2 and v3 sub-scores (including impact sub-score) are now derived directly from the parsed CVSS vector, producing more accurate and complete scoring details on vulnerability definitions. | N/A |
| 3.1.22 | Bug Fixes - Host — The original Tenable status is now preserved as the provider status while the normalized source status is populated separately, improving status reporting consistency. | N/A |
| 3.1.21 | Bug Fixes - Vulnerability Definition / Violation Definition — Corrected the data types of two attributes to match their actual values: "Exploit available" is now a true/false value (was text) and "Threat recency" is now a number (was text). | • The "Exploit available" attribute changed from text to a boolean and "Threat recency" changed from text to a number. Re-sync the connector so existing definition records are repopulated with the corrected types. |
| 3.1.20 | No changes in this release. | N/A |
| 3.1.19 | New Features - Compliance findings — The connector now syncs Tenable compliance audit results as two new models: Violation and Violation Definition, alongside the existing vulnerability data. | N/A |
| 3.1.18 | No changes in this release. | N/A |
| 3.1.17 | Improvements - Improved handling of additional asset fields returned by the Tenable export API. | N/A |
| 3.1.16 | Bug Fixes - Vulnerability Definition — CVSS scores (including CVSS v3 impact score and VPR score) are now parsed and stored as decimal values consistently, fixing cases where scores delivered as different numeric formats were mishandled. | • The "CVSS v3 impact score" and "VPR score" attributes changed from single-precision to double-precision decimals. Re-sync the connector so existing definition records are repopulated with the corrected type. |
| 3.1.15 | Bug Fixes - Vulnerability / Vulnerability Definition — Reworked severity handling so both the original (source) severity and its numeric score are recorded alongside the normalized Brinqa severity and score, fixing inconsistent severity values. | • Severity attributes were re-keyed and rescaled, and the "Product coverage" and "Vulnerability age" attribute types changed. Re-sync the connector so existing vulnerability records are repopulated with the corrected severity values and types. |
| 3.1.14 | No changes in this release. | N/A |
| 3.1.13 | No changes in this release. | N/A |
| 3.1.12 | Improvements - Sync tuning options (page size, parallelism, and max retries) now fall back to sensible connector defaults when not explicitly configured, improving out-of-the-box sync reliability. | N/A |
| 3.1.11 | Improvements - Standardized hostname and MAC address normalization across asset and finding records for more consistent matching with data from other connectors. | N/A |
| 3.1.10 | No changes in this release. | N/A |
| 3.1.9 | No changes in this release. | N/A |
| 3.1.8 | No changes in this release. | N/A |
| 3.1.7 | Improvements - Internal model framework refinements shared across the Tenable connectors. No customer-visible behavior change. | N/A |
| 3.1.6 | No changes in this release. | N/A |
| 3.1.5 | No changes in this release. | N/A |
| 3.1.4 | No changes in this release. | N/A |
| 3.1.3 | Bug Fixes - Assessment — Improved how scanned targets are collected for scan assessments. | N/A |
| 3.1.2 | No changes in this release. | N/A |
| 3.1.1 | Improvements - Assessment — Added scan schedule details (recurrence rules and schedule start time) and improved date/time parsing so creation and modification timestamps are stored as proper timestamps. | N/A |
| 3.1.0 | Improvements - Refinements to asset and scan assessment handling for more reliable syncs. | N/A |
| 3.0.16 | New Features - Scan assessments — The connector now syncs Tenable scans as a new Assessment model, capturing scan timing, schedule, type, owner, and the assets covered by each scan. | N/A |
| 3.0.15 | Improvements - Host — Reworked hostname, operating system, and identifier selection so multi-valued hostnames and operating systems are captured and the primary name/identifier is chosen more reliably. | N/A |
| 3.0.14 | Improvements - Host — Hostnames and DNS names are now de-duplicated and DNS names lower-cased for more consistent matching. | N/A |
| 3.0.13 | Improvements - Standardized sync operation option handling across the Tenable connectors. No customer-visible behavior change. | N/A |
| 3.0.12 | New Features - Full re-sync option — A new syncInterval option lets you force a sync from the beginning of time rather than only changes since the last run. | N/A |
| 3.0.11 | New Features - Vulnerability — Added a "Severity modification type" attribute indicating whether a finding's severity was recast by Tenable. | N/A |
| 3.0.10 | Bug Fixes - Vulnerability Definition — Score fields now return no value (rather than defaulting to zero) when Tenable does not provide them, avoiding misleading zero scores. | N/A |
| 3.0.9 | Bug Fixes - Vulnerability Definition — Vulnerability age bounds now return no value (rather than zero) when Tenable does not provide them. | N/A |
| 3.0.8 | New Features - Host — Added dedicated cloud instance identifiers for AWS (instance ID), Azure (VM ID and resource ID), and GCP (instance ID), so cloud assets are identified more precisely. | N/A |
| 3.0.7 | Improvements - Host — Expanded and reordered the default asset sources so more asset types (including SSM-discovered assets) are included by default. | N/A |
| 3.0.6 | Improvements - Reworked the asset and finding export pipeline (chunk handling and scan correlation) for more reliable large exports, and added a "Last scan name" attribute to host records. | N/A |
| 3.0.5 | Improvements - Vulnerability Definition — Added several new finding-definition attributes including agent, compliance, default account, threat intensity/recency/sources, and product coverage. | N/A |
| 3.0.4 | Bug Fixes - Vulnerability Definition — Corrected severity scoring so the normalized severity score is populated as a proper score value. | • The finding-definition severity score attribute was re-keyed (from "severity number" to "severity score"). Re-sync the connector so existing vulnerability definition records pick up the corrected attribute. |
| 3.0.3 | Bug Fixes - Vulnerability Definition — Fixed CVSS v3 vector parsing, which previously parsed the v2 vector by mistake, so CVSS v3 details are now derived correctly. | N/A |
| 3.0.2 | New Features - Vulnerability Definition — Added a numeric severity attribute derived from the normalized severity. | N/A |
| 3.0.1 | Bug Fixes - Host — Asset name and identifier selection now falls back to IPv4, IPv6, or MAC address when no hostname is available, so assets are no longer left without a usable name. | N/A |
| 3.0.0 | Overview The Tenable Vulnerability Management connector integrates with Tenable.io to synchronize host assets, vulnerability findings, and their underlying vulnerability definitions. Category: Vulnerability Management Models | N/A |