Tenable.io

Tenable.io is a cloud-based vulnerability management tool that scans hosts in your network and generates vulnerabilities against those hosts. You can bring asset and security data from Tenable.io into Brinqa to enhance your vulnerability management capabilities, gain insights into the relationship between the vulnerabilities and your assets, construct a unified view of your attack surface, and strengthen your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Tenable.io and how to obtain that information from Tenable. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings

When setting up a data integration, select Tenable.io from the Connector drop-down. If you cannot find the connector in the drop-down, make sure that you have installed it first. You must provide the following information to authenticate Tenable.io with Brinqa:

• API URL: The Tenable.io API URL. The default URL is https://cloud.tenable.com.

• Access key and Secret key: The access key and secret key associated with the Tenable.io account, which must have permissions to log in to the API server and return data.

Generate Tenable.io access key and secret key

In order for the Tenable.io connector to successfully retrieve data from the Tenable.io API, the access key and secret key must be tied to a Basic user role with Can View permissions. For additional information, see Tenable.io documentation on permissions.

For the Tenable.io connector to use the Tenable.io API, you must provide an access key and secret key. Tenable.io does not allow retrieving the access key and secret key for an existing user, therefore, you must generate new keys instead.

To generate new access keys, follow these steps:

1. Log in to your Tenable.io account.

2. Click the Menu button on the upper-left corner of the page. A navigation pane appears.

3. Click Settings, and then click My Account.

4. Click the User Account button on the upper-right corner of the page, and then click the API Keys tab.

5. Click Generate. The Generate API Keys window appears.

6. Review the warning on the page and click Generate.

   Your new Tenable.io access key and secret key display. Copy the access key and secret key to a safe and secure location.

To generate a new access key and secret key for another user as an administrator, follow these steps:

1. Log in to your Tenable.io account as an administrator.

2. Click the Menu button on the upper-left corner of the page. A navigation pane appears.

3. Click Settings, and then click Access Control.

4. Click the name of the user for which you want to generate an access key and secret key. The Edit User page appears.

5. In the API Keys section, click Generate API Keys.

6. Review the warning on the page and click Replace & Generate.

   The new Tenable.io access key and secret key display. Copy the access key and secret key to a safe and secure location.

note

If you do not have permissions to create Tenable.io access and secret keys, contact your Tenable.io administrator. For additional information, see Tenable.io documentation on API keys.

Additional settings

The Tenable.io connector contains additional options for specific configuration:

• Page size: The maximum number of records to get per API request. The default setting is 1000. It is not recommended to go over 1000.

• Parallel requests: The maximum number of parallel API requests. The default setting is 8.

• Maximum retries: The maximum number of times that the integration attempts to connect to the Tenable.io API before giving up and reporting a failure. The default setting is 10.

Types of data to retrieve

The Tenable.io connector can retrieve the following types of data from the Tenable.io API:

Table 1: Data retrieved from Tenable.io

Connector Object	Required	Maps to Data Model
Host	Yes	Host
Finding	Yes	Violation
Scan	No	Assessment
Vulnerability	Yes	Vulnerability
Vulnerability Definition	Yes	Violation Definition, Vulnerability Definition

info

• For detailed steps on how to view the data retrieved from Tenable.io in the Brinqa Platform, see How to view your data.

• Tenable compliance audit results can be found under Violations.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes.

Host

Table 2: Host attribute mappings

Source Field Name	Maps to Attribute
asset.aws_ec2_name	name
asset.agent_names	Local variable
asset.agent_uuid	Local variable
asset.aws_availability_zone	Local variable
asset.aws_ec2_instance_ami_id	Local variable
asset.aws_ec2_instance_group_name	Local variable
asset.aws_ec2_instance_id	Local variable
asset.aws_ec2_instance_state_name	Local variable
asset.aws_ec2_instance_type	Local variable
asset.aws_ec2_name	Local variable
asset.aws_ec2_product_code	Local variable
asset.aws_owner_id	Local variable
asset.aws_region	Local variable
asset.aws_subnet_id	Local variable
asset.aws_vpc_id	Local variable
asset.azure_resource_id	Local variable
asset.azure_vm_id	Local variable
asset.created_at	sourceCreatedDate
asset.deleted_at	Local variable
asset.deleted_by	Local variable
asset.description	description
asset.fqdns	privateDnsName, publicDnsName
asset.first_scan_time	Local variable
asset.first_seen	firstSeen
asset.gcp_instance_id	Local variable
asset.gcp_project_id	Local variable
asset.gcp_zone	Local variable
asset.has_agent	Local variable
asset.hostnames	hostname
asset.hostnames	hostnames
asset.ipv4s	privateIpAddresses, publicIpAddress
asset.ipv6s	ipAddresses
asset.last_authenticated_scan_date	Local variable
asset.last_scan_time	lastScanned
asset.last_seen	lastSeen
asset.mac_addresses	macAddresses
asset.mcafee_epo_agent_guid	Local variable
asset.mcafee_epo_guid	Local variable
asset.network_id	Local variable
asset.operating_systems	operatingSystem
asset.servicenow_sysid	Local variable
asset.sources	Local variable
asset.tagList.tags.tag.tagName	tags
asset.terminated_at	Local variable
asset.terminated_at/asset.deletee_at	status
asset.terminated_by	Local variable
asset.updated_at	sourceLastModified
categories	categories
description	description
dnsNames	dnsNames
getDescription	description
getHostname	hostname
getName	name
instanceId	instanceId
lastScan.name	Local variable
LAST_LICENSED_SCAN	Local variable

Finding

Table 3: Finding attribute mappings

Source Field Name	Maps to Attribute
finding.actual_value	results
finding.asset_uuid	targets
finding.audit_file	results
finding.check_error	results
finding.check_id	uid
finding.check_info	description
finding.check_name	results
finding.db_type	Local variable
finding.expected_value	results
finding.first_seen	firstSeen
finding.last_seen	lastSeen
finding.plugin_id	uid
finding.profile_name	Local variable
finding.reference	references
finding.see_also	Local variable
finding.solution	recommendation
finding.status	status
finding.uuid	uid
finding.value	Local variable

Scan

Table 4: Scan attribute mappings

Source Field Name	Maps to Attribute
detail.hosts	targets
detail.info.scan_end	endTime
detail.info.scan_start	startTime
scan.creation_date	sourceCreatedDate
scan.id	uid
scan.last_modification_date	sourceLastModified
scan.name	name
scan.owner	Local variable
scan.rrules	Local variable
scan.schedule_uuid	Local variable
scan.startTime	Local variable
scan.status	status
scan.type	Local variable
scan.uuid	Local variable

Vulnerability

Table 5: Vulnerability attribute mappings

Source Field Name	Maps to Attribute
uid	uid
vuln.asset.agent_uuid	Local variable
vuln.asset.fqdn	privateDnsName, publicDnsName
vuln.asset.hostname, vuln.asset.netbios_name	hostname
vuln.asset.ipv4	ipAddresses
vuln.asset.mac_address	macAddresses
vuln.asset.uuid	targets
vuln.first_found	firstFound
vuln.last_fixed	lastFixed
vuln.last_found	lastFound
vuln.output	results
vuln.plugin.id	type
vuln.port.port	port
vuln.port.protocol	protocol
vuln.scan.schedule_uuid	Local variable
vuln.scan.uuid	Local variable
vuln.severity	severity, sourceSeverity, severityScore, sourceSeverityScore
vuln.severity_modification_type	Local variable
vuln.state	sourceStatus, statusCategory, status, providerStatus

Vulnerability Definition

Table 6: Vulnerability Definition attribute mappings

Source Field Name	Maps to Attribute
agent	Local variable
compliance	Local variable
cpe	affected
cve	cveIds, cveRecords
cvss_base_score	cvssV2BaseScore
cvss_temporal_score	cvssV2TemporalScore
cvss_v2_vector	Use CVSS calculator
cvss3_base_score	cvssV3BaseScore
cvss3_temporal_score	cvssV3TemporalScore
cvss_v3_vector	Use CVSS calculator
default_account	Local variable
description	description
exploits	exploits
exploit_available	Local variable
exploit_code_maturity	Local variable
exploited_by_malware	Local variable
exploited_by_nessus	Local variable
exploitability_ease	Local variable
family	categories
has_patch	patchAvailable
in_the_news	Local variable
intel_type	Local variable
lower_bound	Local variable
patch_publication_date	Local variable
plugin_modification_date	sourceLastModified
plugin.name	name
plugin_type	Local variable
product_coverage	Local variable
risk_factor	severity, sourceSeverity, severityScore, sourceSeverityScore
score	Local variable
see_also	Local variable
solution	recommendation
synopsis	summary
threat_intensity_last28	Local variable
threat_sources_last28	Local variable
unsupported_by_vendor	Local variable
Uid	uid
vuln_publication_date, plugin_publication_date	publishedDate
vpr	Local variable
CVSS_V2_IMPACT_SCORE	Local variable
CVSS_V3_IMPACT_SCORE	Local variable

info

Use CVSS calculator indicates that the CVSS (Common Vulnerability Scoring System) vectors and scores aren't directly mapped to a specific attribute on the UDM. Instead, a specialized library calculates the CVSS scores from the provided CVSS vector strings.

info

Local variable indicates that the field is processed within a specific context, such as a particular workflow or calculation. Unlike other attributes, local variables aren't mapped to the unified data models. They only exist on the source data model.

Operation options

The Tenable.io connector supports the following operation options. Expand the sections below to view the operation options per supported connector object. See connector operation options for information about how to apply them.

Host operation options

Table 7: Host operation options

Connector Object	Option	All Possible Values	Description	Example
Host	chunk_size	Any number ranges from 100-10000	Specifies the number of hosts that are exported in a batch. Tenable recommends not exceeding 5000.	Key: chunk_size Value: 100. This key and value combination only retrieves 100 hosts at a time. Once 100 hosts are exported, the next group of 100 hosts exports.
	has_plugin_results	true or false	Filters hosts by whether or not they have plugin results associated with it.	Key: has_plugin_results Value: true. This key and value combination only retrieves hosts that have plugin results.
	is_deleted	true or false	Filters hosts by whether or not they have been deleted.	Key: is_deleted Value: false. This key and value combination only retrieves hosts that exist and are active.
	is_licensed	true or false	Filters hosts by whether or not they are included in the asset count for Tenable.io.	Key: is_licensed Value: true. This key and value combination only retrieves hosts that are licensed and authorized to run.
	is_terminated	true or false	Filters hosts by whether or not they have been terminated.	Key: is_terminated Value: true. This key and value combination only retrieves hosts that have been terminated.
	last_assessed	Any date value in the Unix timestamp format	Returns all hosts with a last assessed time later than the specified date.	Key: last_assessed Value: 1593000000. This key and value combination only retrieves hosts that have been assessed since (UTC) July 12th, 2020 at 21:40:00.
	servicenow_sysid	true or false	Filters hosts by whether or not they have a ServiceNow Sys ID.	Key: servicenow_sysid Value: true. This key and value combination only retrieves hosts that have a ServiceNow Sys ID.
	sources	AWS, NESSUS_AGENT, PVS, NESSUS_SCAN, or WAS	A comma-separated list of sources that filter hosts by whether or not they are discovered by the specified source.	Key: sources Value: NESSUS_SCAN, AWS. This key and value combination only retrieves hosts that are from AWS or discovered in a Nessus scan.
	tag.<category>	Any Tenable.io tag category name	Filters hosts with the specified tag category. For additional information on tags, see Tenable.io documentation	Key: tag.<category> Value: Test2. This key and value combination only retrieves hosts with the Test2 tag category.

note

The option keys and values are case-sensitive as they are shown in this documentation.

Finding operation options

Table 8: Violation operation options

Connector Object	Option	All Possible Values	Description	Example
Finding	chunkTimeout	Any time value in seconds	Specifies the maximum amount of time in seconds to wait for a chunk of violation data to be retrieved.	Key: chunkTimeout Value: 60. This key and value combination sets the timeout for chunk retrieval to 60 seconds.
	exportTimeout	Any time value in seconds	Specifies the maximum amount of time in seconds to wait for the entire violation data export process to complete.	Key: exportTimeout Value: 300. This key and value combination sets the export process timeout to 5 minutes.
	initialTimeout	Any time value in seconds	Defines the initial waiting time in seconds before the export process begins.	Key: initialTimeout Value: 30. This key and value combination sets an initial delay of 30 seconds before starting the export.
	last_seen	Any date value in the Unix timestamp format	Returns all violations with a last seen time later than the specified date.	Key: last_seen Value: 1609459200. This key and value combination only retrieves violations seen after January 1, 2021.
	num_findings	Any number ranges from 50-5000	Specifies the number of findings used to chunk the vulnerabilities.	Key: num_findings Value: 1000. This key and value combination retrieves violations for 1000 findings at a time. Once the violations for the 1000 findings are exported, the violations for the next group of 1000 findings export.
	pollInterval	Any time value in seconds	Sets the interval time in seconds between polling attempts for new data.	Key: pollInterval Value: 10. This key and value combination sets the polling interval for new violations to 10 seconds.

note

The option keys and values are case-sensitive as they are shown in this documentation.

Vulnerability operation options

Table 9: Vulnerability operation options

Connector Object	Option	All Possible Values	Description	Example
Vulnerability	cidr_range	Any range of IP addresses assigned to the hosts in your network	Restricts search for vulnerabilities to the hosts assigned an IP address within the specified CIDR range.	Key: cidr_range Value: 192.168.0.0/24. This key and value combination only retrieves vulnerabilities on the hosts bearing the IP addresses from 192.168.0.1 to 192.168.0.254.
	include_unlicensed	true or false	Filters vulnerabilities by whether or not to include unlicensed hosts.	Key: include_unlicensed Value: true. This key and value combination retrieves vulnerabilities from both licensed and unlicensed hosts.
	num_assets	Any number ranges from 50-5000	Specifies the number of hosts used to chunk the vulnerabilities.	Key: num_assets Value: 100. This key and value combination retrieves vulnerabilities for 100 hosts at a time. Once the vulnerabilities for the 100 hosts are exported, the vulnerabilities for the next group of 100 hosts export.
	plugin_family	Any Tenable.io plugin family string	Filters vulnerabilities by whether or not they are related to the specified plugin family.	Key: plugin_family Value: operating systems. This key and value combination only retrieves vulnerabilities related to the operating systems plugin family.
	plugin_id	Any supported Tenable.io plugin ID number	Filters vulnerabilities by whether or not they are related to the specific plugin ID.	Key: plugin_id Value: 10150. This key and value combination only retrieves vulnerabilities associated with plugin ID 10150.
	plugin_type	Any supported plugin type: remote, local, combined, etc.	Filters vulnerabilities by whether or not they are related to the specified plugin type.	Key: plugin_type Value: mobile. This key and value combination only retrieves vulnerabilities associated with the mobile plugin type.
	severity	low, medium, high, or critical	Returns all vulnerabilities of the specified severity.	Key: severity Value: critical. This key and value combination only retrieves the critical vulnerabilities found in a scan.
	since	Any date value in the Unix timestamp format	Returns all vulnerabilities seen since the specified date value.	Key: since Value: 1593000000. This key and value combination only retrieves vulnerabilities that exist since (UTC) July 12th, 2020 at 21:40:00.
	state or status	fixed, open, or reopened	Returns all vulnerabilities with the specified state or status.	Key: status Value: open. This key and value combination only retrieves open vulnerabilities. You can use state for the key in place of status and it produces the same result.
	tag.<category>	Any Tenable.io tag category name	Returns all vulnerabilities with the specified tag category. For additional information on tags, see Tenable.io documentation	Key: tag.<category> Value: Test2. This key and value combination only retrieves vulnerabilities with the Test2 tag category.
	vpr_score	Any numeric value from 0.1-10.0	Retrieve all vulnerabilities with a Vulnerability Priority Rating (VPR) score of the specified value or higher.	Key: vpr_score Value: 7. This key and value combination retrieves all vulnerabilities with a VPR score of 7 or higher.

note

The option keys and values are case-sensitive as they are shown in this documentation.

APIs

The Tenable.io connector uses the Tenable.io REST API. Specifically, it uses the following endpoints:

Table 10: Tenable.io REST API Endpoints

Connector Object	API Endpoints
Host	POST /assets/export
	POST /assets/export/{export_uuid}/cancel
	GET /assets/export/{export_uuid}/chunks/{chunkId}
	GET /assets/export/{export_uuid}/status
Finding	GET /compliance/export
	GET /compliance/export/{exportUuid}/cancel
	GET /compliance/export/{exportUuid}/chunks/{chunkId}
	GET /compliance/export/{exportUuid}/status
Scan	GET /scans
	GET /scans/{scan_id}
Vulnerability	GET /vulns/export
	GET /vulns/export/{exportUuid}/cancel
	GET /vulns/export/{exportUuid}/chunks/{chunkId}
	GET /vulns/export/{exportUuid}/status
Vulnerability Definition	GET /plugins/families
	GET /plugins/families/{familyId}
	GET /plugins/plugin

Changelog

The Tenable.io connector has undergone the following changes:

3.1.26

• Changed the VULNERABILITY_AGE attribute type on the Vulnerability Definition object from string to integer.

3.1.25

• Added the INSTALLED_SOFTWARE attribute to the Host object.

3.1.24

• Fixed an issue where the Violation Definition and Vulnerability Definition syncs were failing.

3.1.23

• Fixed an issue where the CVSS v3 impact score was not returning any values.

• Added the VULNERABILITY_AGE attribute to the Vulnerability Definition object.

3.1.22

• Added support for Data lifecycle management to the Host and Vulnerability objects.

• Added the PROVIDER_STATUS attribute to the Vulnerability object.

3.1.21

• Changed the EXPLOIT_AVAILABLE attribute type on the Vulnerability Definition object from string to boolean.

• Changed the THREAT_RECENCY attribute type on the Vulnerability Definition object from string to integer.

3.1.19

• Added two connector objects, Violation and Violation Definition.

• Started fetching Tenable Compliance Check results and storing them as violations.

3.1.17

• Changed the data type of 'acr_score' and 'exposure_score' from Integer to Double to align with the API response format.

3.1.16

• Addressed precision issues by changing the data type for CVSS scores from Float to Double.

3.1.15

• Changed the SOURCE_SEVERITY attribute to a String type.

• Added a SOURCE_SEVERITY_SCORE attribute in the Vulnerability and Vulnerability Definition object.

3.1.12

• Added a new setting to configure maximum retries.

3.1.11

• Added a SOURCE_STATUS attribute in the Vulnerability object to store the source finding statuses.

• Added a method to normalize the source finding statuses.

3.1.3

• Started retrieving scans of all statuses.

3.1.2

• Added a check for null or empty dates.

3.1.1

• Started retrieving name, rrules, starttime, and uuid from the Tenable vulnerability management scans.

3.0.11

• Added a SEVERITY_MODIFICATION_TYPE attribute in the Vulnerability object.

3.0.8

• Added some new attributes in the Host object, including AWS_EC2_INSTANCE_ID, AZURE_RESOURCE_ID, and GCP_INSTANCE_ID.

• Used AZURE_VM_ID, if available, as the instance ID of Azure hosts.

3.0.7

• Added 'SSM' as a valid source for hosts.

3.0.6

• Added a LAST_SCAN_NAME attribute in the Host object.

3.0.5

• Added a PATCH_PUBLICATION_DATE attribute in the Vulnerability Definition object.

3.0.3

• Fixed an issue in parsing CVSS v3 vectors.

3.0.0

• Initial Integration+ release.