Tenable.io

Vulnerability Management

Overview

The Tenable Vulnerability Management connector integrates with Tenable.io to synchronize host assets, Nessus agents and agent groups, vulnerability scan results, vulnerability/violation definitions, compliance findings, and scan metadata into the Brinqa platform. It uses the v2 Asset Export API for enhanced asset type filtering and the standard Vulnerability/Compliance Export APIs for findings.

---

Data retrieved from Tenable Vulnerability Management

Connector Object	Required	Maps to Data Model
Host	Yes	Host
Scan	Yes	Assessment
Agent Group	Yes	Agent Group
Agent	Yes	Agent
Vulnerability	Yes	Vulnerability
VulnerabilityDefinition / ViolationDefinition	Yes	Vulnerability Definition
Violation (Compliance Finding)	Yes	Violation

Model relationships

note

For detailed steps on how to view the data retrieved from Tenable Vulnerability Management in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Tenable Vulnerability Management from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	No	https://cloud.tenable.com	Tenable Vulnerability Management API URL, defaults to https://cloud.tenable.com
Access Key	Yes	Default - (user input, Required)	Tenable Vulnerability Management API account access key
Secret Key	Yes	Default - (user input, Required)	Tenable Vulnerability Management API account secret key
Page size	No	1000	Maximum number of records to get per API request
Parallel requests	No	Available processors	Maximum number of parallel API requests
Maximum retries	No	10	The maximum number of retry attempts before giving up a request
Custom properties	No	Default - (user input)	Comma delimited list of case-insensitive custom property names to be promoted to Tenable IO Asset models

Authentication

Method

API Key authentication using an Access Key and Secret Key pair.

Endpoint

Method	URL
GET	https://cloud.tenable.com/*

Request Headers

Header	Value
X-ApiKeys	accessKey={accessKey};secretKey={secretKey}

Usage

All API requests include the API key pair in the X-ApiKeys header. No separate token exchange is required.

---

Sync Behavior

The connector performs a mix of incremental (delta) and full syncs depending on the data category. Most models sync incrementally: when a sync token from a prior run is available, records are filtered by that timestamp; on the first run, or when no token is present, a full sync is performed. Agent Group is the exception — the Tenable agent-groups endpoint exposes no date field to filter on, so every run re-fetches the complete list. Each model's #### Sync Duration Parameter section states its own behavior.

---

How to obtain Tenable Vulnerability Management credentials

Generate Tenable Vulnerability Management API keys

In order for the Tenable Vulnerability Management connector to successfully retrieve data from the Tenable Vulnerability Management API, the access key and secret key must be tied to a Basic user role with Can View permissions. For additional information, see Tenable Vulnerability Management documentation on permissions.

For the Tenable Vulnerability Management connector to use the Tenable Vulnerability Management API, you must provide an access key and secret key. Tenable Vulnerability Management does not allow retrieving the access key and secret key for an existing user, therefore, you must generate new keys instead.

To generate new access keys, follow these steps:

1. Log in to your Tenable Vulnerability Management account.

2. Click the Menu button on the upper-left corner of the page. A navigation pane appears.

3. Click Settings, and then click My Account.

4. Click the User Account button on the upper-right corner of the page, and then click the API Keys tab.

5. Click Generate. The Generate API Keys window appears.

6. Review the warning on the page and click Generate.

   Your new Tenable Vulnerability Management access key and secret key display. Copy the access key and secret key to a safe and secure location.

To generate a new access key and secret key for another user as an administrator, follow these steps:

1. Log in to your Tenable Vulnerability Management account as an administrator.

2. Click the Menu button on the upper-left corner of the page. A navigation pane appears.

3. Click Settings, and then click Access Control.

4. Click the name of the user for which you want to generate an access key and secret key. The Edit User page appears.

5. In the API Keys section, click Generate API Keys.

6. Review the warning on the page and click Replace & Generate.

   The new Tenable Vulnerability Management access key and secret key display. Copy the access key and secret key to a safe and secure location.

Note: If you do not have permissions to create Tenable Vulnerability Management access and secret keys, contact your Tenable Vulnerability Management administrator. For additional information, see Tenable Vulnerability Management documentation on API keys.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Host

Source Field Name	SDM Attribute
asset.agent_names	AGENT_NAMES
asset.agent_uuid	TENABLE_UUID
asset.cloud.aws.availability_zone	AWS_AVAILABILITY_ZONE
asset.cloud.aws.ec2_instance_ami_id	AWS_EC2_INSTANCE_AMI_ID
asset.cloud.aws.ec2_instance_group_name	AWS_EC2_INSTANCE_GROUP_NAME
asset.cloud.aws.ec2_instance_id	AWS_EC2_INSTANCE_ID
asset.cloud.aws.ec2_instance_id / azure.vm_id / gcp.instance_id	INSTANCE_ID
asset.cloud.aws.ec2_instance_state_name	AWS_EC2_INSTANCE_STATE
asset.cloud.aws.ec2_instance_type	AWS_EC2_INSTANCE_TYPE
asset.cloud.aws.ec2_name	AWS_EC2_NAME
asset.cloud.aws.ec2_name / hostnames / fqdns / ipv4s	NAME
asset.cloud.aws.ec2_product_code	AWS_EC2_PRODUCT_CODE
asset.cloud.aws.owner_id	AWS_OWNER_ID
asset.cloud.aws.region	AWS_REGION
asset.cloud.aws.subnet_id	AWS_SUBNET_ID
asset.cloud.aws.vpc_id	AWS_VPC_ID
asset.cloud.azure.resource_id	AZURE_RESOURCE_ID
asset.cloud.azure.vm_id	AZURE_VM_ID
asset.cloud.gcp.instance_id	GCP_INSTANCE_ID
asset.cloud.gcp.project_id	GCP_PROJECT_ID
asset.cloud.gcp.zone	GCP_ZONE
asset.custom_attributes[].value	CUSTOM_{name}
asset.deleted_by	DELETED_BY
asset.has_agent	HAS_AGENT
asset.has_plugin_results	HAS_PLUGIN_RESULTS
asset.id	UID
asset.installed_software	INSTALLED_SOFTWARE
asset.is_licensed	IS_LICENSED
asset.is_public	IS_PUBLIC
asset.manufacturer_tpm_ids	MANUFACTURER_TPM_IDS
asset.mcafee_epo_agent_guid	MCAFEE_EPO_AGENT_GUID
asset.mcafee_epo_guid	MCAFEE_EPO_GUID
asset.network.bios_uuid	BIOS_UUID
asset.network.fqdns	DNS_NAMES
asset.network.fqdns	PRIVATE_DNS_NAME
asset.network.fqdns	PUBLIC_DNS_NAME
asset.network.hostnames + netbios_names + fqdns	HOSTNAME
asset.network.hostnames + netbios_names + fqdns	HOSTNAMES
asset.network.ipv4s	PRIVATE_IP_ADDRESSES
asset.network.ipv4s	PUBLIC_IP_ADDRESSES
asset.network.ipv4s	PUBLIC_IP_ADDRESS
asset.network.ipv4s + ipv6s	IP_ADDRESSES
asset.network.mac_addresses	MAC_ADDRESSES
asset.network.network_id	NETWORK_ID
asset.network.network_name	NETWORK_NAME
asset.network.ssh_fingerprints	SSH_FINGERPRINTS
asset.network_device_serial_identifier	NETWORK_DEVICE_SERIAL_IDENTIFIER
asset.open_ports	OPEN_PORTS
asset.operating_systems	OPERATING_SYSTEM
asset.operating_systems	OPERATING_SYSTEMS
asset.ratings.acr.score	ACR_SCORE
asset.ratings.aes.score	AES_SCORE
asset.resource_tags	RESOURCE_TAGS
asset.scan.first_scan_time	FIRST_SCANNED
asset.scan.last_authenticated_scan_date	LAST_AUTHENTICATED_SCAN
asset.scan.last_authentication_attempt_date	LAST_AUTHENTICATION_ATTEMPT_DATE
asset.scan.last_authentication_scan_status	LAST_AUTHENTICATION_SCAN_STATUS
asset.scan.last_authentication_success_date	LAST_AUTHENTICATION_SUCCESS_DATE
asset.scan.last_licensed_scan_date	LAST_LICENSED_SCAN
asset.scan.last_scan_id	LAST_SCAN_UUID
asset.scan.last_scan_target	LAST_SCAN_TARGET
asset.scan.last_scan_time	LAST_SCANNED
asset.scan.last_schedule_id	LAST_SCAN_SCHEDULE_UUID
asset.sources[].name	SOURCES
asset.system_types + constants	CATEGORIES
asset.tags	TAGS
asset.tenable_agent_days_since_active	TENABLE_AGENT_DAYS_SINCE_ACTIVE
asset.terminated_by	TERMINATED_BY
asset.third_party_ids.servicenow_sysid	SERVICE_NOW_ID
asset.timestamps.created_at	SOURCE_CREATED_DATE
asset.timestamps.deleted_at	DELETED_AT
asset.timestamps.first_seen	FIRST_SEEN
asset.timestamps.last_seen	LAST_SEEN
asset.timestamps.terminated_at	TERMINATED_AT
asset.timestamps.terminated_at / deleted_at / aws.ec2_instance_state_name	STATUS
asset.timestamps.updated_at	SOURCE_LAST_MODIFIED
asset.types	ASSET_TYPES
Generated	DESCRIPTION
Instant.now()	LAST_CAPTURED
lastScan.name	LAST_SCAN_NAME

Scan

Source Field Name	SDM Attribute
detail.hosts	TARGETS
detail.info.scan_end	END_TIME
detail.info.scan_start	START_TIME
Instant.now()	LAST_CAPTURED
scan.creation_date	SOURCE_CREATED_DATE
scan.id	UID
scan.last_modification_date	SOURCE_LAST_MODIFIED
scan.name	NAME
scan.owner	OWNER
scan.rrules	R_RULES
scan.schedule_uuid	SCHEDULE_UUID
scan.startTime	SCHEDULE_START_TIME
scan.status	STATUS
scan.type	SCAN_TYPE
scan.uuid	SCAN_UUID

Agent Group

Source Field Name	SDM Attribute
group.agents_count	AGENT_COUNT
group.creation_date	SOURCE_CREATED_DATE
group.id	UID
group.last_modification_date	SOURCE_LAST_MODIFIED
group.name	NAME
group.owner	OWNER
group.uuid	UUID
Instant.now()	LAST_CAPTURED
scanner.id	SCANNER_IDS

Agent

Source Field Name	SDM Attribute
agent.aws_account_id	AWS_ACCOUNT_ID
agent.aws_instance_id	AWS_INSTANCE_ID
agent.core_build	CORE_BUILD
agent.core_version	CORE_VERSION
agent.distro	DISTRO
agent.groups[].id	AGENT_GROUPS
agent.id	UID
agent.ip	IP
agent.last_connect	LAST_CONNECT
agent.last_scanned	LAST_SCANNED
agent.linked_on	LINKED_ON
agent.name	NAME
agent.network_name	NETWORK_NAME
agent.network_uuid	NETWORK_UUID
agent.platform	PLATFORM
agent.plugin_feed_id	PLUGIN_FEED_ID
agent.status	STATUS
agent.supports_remote_logs	SUPPORTS_REMOTE_LOGS
agent.supports_remote_settings	SUPPORTS_REMOTE_SETTINGS
agent.uuid	UUID
Instant.now()	LAST_CAPTURED
scanner.id	SCANNER_IDS

Vulnerability

Source Field Name	SDM Attribute
Generated	UID
Instant.now()	LAST_CAPTURED
vuln.asset.agent_uuid	AGENT_UUID
vuln.asset.fqdn	PRIVATE_DNS_NAME / PUBLIC_DNS_NAME
vuln.asset.hostname + netbios_name	HOSTNAME
vuln.asset.ipv4	IP_ADDRESSES
vuln.asset.mac_address	MAC_ADDRESSES
vuln.asset.uuid	TARGETS
vuln.first_found	FIRST_FOUND
vuln.last_fixed	LAST_FIXED
vuln.last_found	LAST_FOUND
vuln.output	RESULTS
vuln.plugin.id	TYPE
vuln.port.port	PORT
vuln.port.protocol	PROTOCOL
vuln.resurfaced_date	RESURFACED_DATE
vuln.scan.schedule_uuid	SCHEDULE_UUID
vuln.scan.uuid	SCAN_UUID
vuln.severity	SEVERITY
vuln.severity	SOURCE_SEVERITY
vuln.severity	SEVERITY_SCORE
vuln.severity_modification_type	SEVERITY_MODIFICATION_TYPE
vuln.state	SOURCE_STATUS
vuln.state	PROVIDER_STATUS

VulnerabilityDefinition / ViolationDefinition

Source Field Name	SDM Attribute
Instant.now()	LAST_CAPTURED
PID-{plugin.id}	UID
plugin.cpe	AFFECTED
plugin.cve	CVE_IDS / CVE_RECORDS
plugin.cvss3_base_score	CVSS_V3_BASE_SCORE
plugin.cvss3_temporal_score	CVSS_V3_TEMPORAL_SCORE
plugin.cvss_base_score	CVSS_V2_BASE_SCORE
plugin.cvss_temporal_score	CVSS_V2_TEMPORAL_SCORE
plugin.description	DESCRIPTION
plugin.exploit_available	EXPLOIT_AVAILABLE
plugin.exploit_code_maturity	EXPLOIT_CODE_MATURITY
plugin.exploit_framework_*	EXPLOITS
plugin.exploitability_ease	EXPLOIT_EASE
plugin.family	CATEGORIES
plugin.has_patch	PATCH_AVAILABLE
plugin.name	NAME
plugin.risk_factor	SEVERITY
plugin.risk_factor	SOURCE_SEVERITY
plugin.risk_factor	SEVERITY_SCORE
plugin.solution	RECOMMENDATION
plugin.synopsis	SUMMARY
plugin.vpr.score	VPR_SCORE
plugin.xref	REFERENCES
plugin_modification_date	SOURCE_LAST_MODIFIED
vuln_publication_date / plugin_publication_date	PUBLISHED_DATE

Violation (Compliance Finding)

Source Field Name	SDM Attribute
finding.asset_uuid	TARGETS
finding.check_info	DESCRIPTION
finding.check_name + check_error + audit_file + expected_value + actual_value	RESULTS
finding.first_seen	FIRST_SEEN
finding.last_seen	LAST_SEEN
finding.plugin_id	TYPE
finding.reference	REFERENCES
finding.solution	RECOMMENDATION
finding.status	STATUS
finding.status	SOURCE_STATUS
Generated	UID
Instant.now()	LAST_CAPTURED

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Host

Operation options

Option	Type	Default	Description
initialTimeout	String (Duration)	3h	Maximum wait for the export job to start
chunkTimeout	String (Duration)	30m	Maximum wait for a single chunk to become available
exportTimeout	String (Duration)	24h	Maximum total duration for the entire export
pollInterval	String (Duration)	2s	Polling interval to check export status
network_id	String	null	Filter by Tenable network ID
network_name	String	null	Filter by Tenable network name
tag.<category>	Object	—	Filter by tag category (e.g. tag.tvm_export=true)
chunk_size	Integer	1000	Number of assets per export chunk
since	Instant	Sync token	Override the since timestamp
sinceFilter	String	last_assessed	Field to filter on: last_assessed, created_at, updated_at, etc.
types	String	host	Comma-separated asset types to export (e.g., host, webapp, host,webapp). Passed to the v2 export filters.types parameter
sources	String	NESSUS_AGENT,NESSUS_SCAN,PVS,AWS,SSM	Comma-separated asset sources to include
is_terminated	Boolean	null	Include terminated assets
is_deleted	Boolean	null	Include deleted assets
is_licensed	Boolean	null	Filter by license status
servicenow_sysid	Boolean	null	Filter by ServiceNow sys_id presence
has_plugin_results	Boolean	null	Filter by plugin results
last_scan_id	String	null	Filter by last scan UUID

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_assessed.

API

• Type: REST endpoint (v2 asset export)
• Default filters: sources=NESSUS_AGENT,NESSUS_SCAN,PVS,AWS,SSM, types=host

Scan

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_modification_date.

API

• Type: REST endpoint (JSON)

Agent Group

Operation options

Option	Type	Default	Description
limit	Integer	pageSize config	Agent groups per page; a non-positive value falls back to the configured pageSize
filter	String	null	Tenable filter expression(s) sent as f; multiple expressions are separated by &
TRANSACTION_ID	String	null	Transaction ID scoping the temporary key-value store used to deduplicate groups across scanners

Delta sync

Not supported. The connector performs a full sync of Agent Group on every run and applies no incremental date filter.

API

• Type: REST endpoint (JSON)

note

• Agent groups are collected across all scanners and deduplicated by group ID. A group visible on more than one scanner produces a single record whose SCANNER_IDS lists every scanner it was seen on.
• If a single scanner fails to return its agent groups, that scanner is skipped with a logged error and the sync continues with the remaining scanners.

---

Agent

Operation options

Option	Type	Default	Description
limit	Integer	pageSize config	Agents per page; a non-positive value falls back to the configured pageSize
filter	String	null	Tenable filter expression(s) sent as f, in addition to the last_connect delta filter; multiple expressions are separated by &
TRANSACTION_ID	String	null	Transaction ID scoping the temporary key-value store used to deduplicate agents across scanners

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_connect.

API

• Type: REST endpoint (JSON)
• Default filters: last_connect:date-gt:<since epoch seconds> when a since timestamp is available

note

• Agents are collected across all scanners and deduplicated by agent ID. An agent linked to more than one scanner produces a single record whose SCANNER_IDS lists every scanner it was seen on.
• Because the delta filter keys off last_connect, an agent whose metadata changed without reconnecting (for example a group membership, name, or status change) is not returned by an incremental sync and keeps its previously synced values until the agent next connects.
• If a single scanner fails to return its agents, that scanner is skipped with a logged error and the sync continues with the remaining scanners.

---

Vulnerability

Operation options

Option	Type	Default	Description
initialTimeout	String (Duration)	3h	Maximum wait for the export job to start
chunkTimeout	String (Duration)	30m	Maximum wait for a single chunk to become available
exportTimeout	String (Duration)	24h	Maximum total duration for the entire export
pollInterval	String (Duration)	2s	Polling interval to check export status
network_id	String	null	Filter by Tenable network ID
network_name	String	null	Filter by Tenable network name
tag.<category>	Object	—	Filter by tag category (e.g. tag.tvm_export=true)
num_assets	Integer	1000	Number of assets per export chunk
use_since_filter	Boolean	false	Enable since-based filtering
since	Instant	Sync token	Override the since timestamp
sinceFilter	String	last_found	Field to filter on: last_found, last_fixed, indexed_at
state / status	String	open,reopened,fixed	Comma-separated vulnerability states
severity	String	low, medium, high, critical	Comma-separated severity levels
include_unlicensed	Boolean	false	Include unlicensed assets
plugin_family	String	null	Filter by plugin family
plugin_id	String	null	Filter by plugin ID(s)
plugin_type	String	null	Filter by plugin type
cidr_range	String	null	Filter by CIDR range

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_found.

API

• Type: REST endpoint (vulnerability export)

VulnerabilityDefinition / ViolationDefinition

Operation options

Option	Type	Default	Description
SYNC_INTERVAL	String	—	Set to BEGINNING to force full re-sync
TRANSACTION_ID	String	null	Transaction ID for incremental sync

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_updated.

API

• Type: REST endpoint (JSON)

Violation (Compliance Finding)

Operation options

Option	Type	Default	Description
initialTimeout	String (Duration)	3h	Maximum wait for the export job to start
chunkTimeout	String (Duration)	30m	Maximum wait for a single chunk to become available
exportTimeout	String (Duration)	24h	Maximum total duration for the entire export
pollInterval	String (Duration)	2s	Polling interval to check export status
network_id	String	null	Filter by Tenable network ID
network_name	String	null	Filter by Tenable network name
tag.<category>	Object	—	Filter by tag category (e.g. tag.tvm_export=true)
num_findings	Integer	1000	Number of findings per export chunk

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_seen.

API

• Type: REST endpoint (compliance export)

Changelog

Changelog

The Tenable Vulnerability Management connector has undergone the following changes:

Version	Description	Migration Steps
3.1.53	Improvements - Multi-valued asset and plugin attributes (for example, operating systems, installed software, open ports, and threat sources) now declare collection-criteria mappings, so their values consolidate consistently during sync and cross-connector correlation. - CVSS sub-metrics and severity are now derived consistently from the reported CVSS vectors, including the CVSS v3 Scope attribute, which was not previously recorded. Where the source reports its own base or temporal score, that value is now preserved instead of being replaced by one recalculated from the vector.	N/A
3.1.52	New Features - Agent and Agent Group are now available for synchronization. Nessus agents are retrieved with their platform, distribution, IP address, status, core version and build, plugin feed, network, AWS instance and account IDs, remote log/settings support, link and last-connect times, and the agent groups they belong to; agent groups are retrieved with their owner, agent count, and creation and modification dates. Both are collected across every scanner on the account and deduplicated, so an agent or group visible on more than one scanner produces a single record listing every scanner it was seen on. Agents sync incrementally on their last connection time; agent groups are fully re-fetched on each run because Tenable exposes no date field to filter them on. If a single scanner fails to return its agents or groups, that scanner is skipped and the sync continues with the remaining scanners.	N/A
3.1.51	No changes in this release.	N/A
3.1.50	Improvements - Transient 502 Bad Gateway and 503 Service Unavailable responses from Tenable.io during an export request (Host, Violation, Vulnerability) are now retried with exponential backoff. If the upstream remains unavailable after retries, the affected source is skipped with a clear log entry so the rest of the sync completes instead of failing the whole run.	N/A
3.1.49	No changes in this release.	N/A
3.1.48	Bug Fixes - Violation — Corrected the "First seen" and "Last seen" attributes to be stored as proper timestamps (were stored as numbers), matching the value returned by the API.	• Violation: the date attributes listed above changed from numbers to timestamps. Re-sync the Tenable IO VM connector to repopulate these records with the corrected type.
3.1.47	No changes in this release.	N/A
3.1.46	Improvements Dependency Upgrades - Refreshed internal model and CVSS scoring libraries to the latest stable releases to pick up upstream fixes and stay aligned with the rest of the Brinqa connector platform. Cross-Connector Attribute Consolidation - Every connector-defined custom attribute now participates in cross-connector consolidation by default. When the same asset or finding is observed by another connector, Brinqa will merge values for these attributes consistently rather than treating each connector's values as independent.	• Re-sync the connector after upgrading so that previously synced records pick up the new consolidation mappings. Existing data remains intact; the re-sync ensures consolidated values for assets and findings shared with other connectors converge correctly.
3.1.45 — Withdrawn	This release shipped a regression and has been superseded by 3.1.46. Customers should skip 3.1.45 and upgrade directly from 3.1.44 to 3.1.46.	N/A
3.1.44	Improvements Dependency Upgrades - Upgraded internal framework and storage libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	Several attributes were removed in the underlying framework and replaced with renamed multi-valued (or boolean-equivalent) counterparts. Values previously stored under the old attribute names remain in place but will no longer be updated; new syncs populate the new attribute names. Action: Re-sync the connector after upgrade. | Model | Old Attribute | New Attribute | |:---|:---|:---| | Host | HOSTNAME | HOSTNAMES | | Host | PUBLIC_DNS_NAME | PUBLIC_DNS_NAMES | | Host | PUBLIC_IP_ADDRESS | PUBLIC_IP_ADDRESSES | | Vulnerability | HOSTNAME | HOSTNAMES | | Vulnerability | PRIVATE_DNS_NAME | PRIVATE_DNS_NAMES | | Vulnerability | PUBLIC_DNS_NAME | PUBLIC_DNS_NAMES | | Vulnerability Definition | PATCH_AVAILABLE | PATCHABLE | | Violation Definition | PATCH_AVAILABLE | PATCHABLE |
3.1.43	No changes in this release.	N/A
3.1.42	Bug Fixes - Upgraded to Tenable v2 Asset Export API — The connector now uses the newer assets/v2/export endpoint instead of the deprecated v1 API, providing richer asset data and better performance. - Support for host asset type — Asset type filtering is now configurable via the types operation option (comma-separated). Defaults to host for VM. Improvements - 17+ new asset attributes available — Additional asset fields are now synced, including network details (network name, BIOS UUID, SSH fingerprints, open ports, network device serial identifier), scan-authentication fields (last authentication attempt/success date, scan status, scan target), Tenable ratings (ACR score, AES score), and asset metadata (asset types, manufacturer TPM IDs, has plugin results, is licensed, is public, agent days since active, resource tags). - Custom properties support — You can now configure custom asset properties via the customProperties configuration field. Specified properties will be synced with a CUSTOM_ prefix. - Improved resilience to API changes — All asset model classes now ignore unknown fields from the Tenable API, so the connector will not break if Tenable adds new fields to their responses. - Improved handling of missing data — The connector now gracefully handles cases where the Tenable v2 export API omits optional fields, preventing sync errors on incomplete API responses. Note: MCAFEE_EPO_AGENT_GUID and MCAFEE_EPO_GUID may be empty when McAfee ePO integration is not active or configured.	• Breaking change: If you have downstream logic that depends on ACR_SCORE or AES_SCORE being decimal values, update it to expect whole numbers (integers).
3.1.41	Improvements - Finding records now capture the time each finding was last observed during a sync, improving the accuracy of "last seen" reporting for vulnerabilities and compliance violations.	N/A
3.1.40	No changes in this release.	N/A
3.1.39	Improvements - Improved resilience when Tenable returns transient service-unavailable or gateway-timeout responses, reducing failed syncs caused by temporary platform outages.	N/A
3.1.38	No changes in this release.	N/A
3.1.37	Improvements - Refined how vulnerability finding data is populated for more consistent results across syncs.	N/A
3.1.36	Improvements - Reworked the asset export model to share a common base across asset types, expanding the cloud-provider metadata captured for hosts (additional AWS, Azure, and GCP fields).	N/A
3.1.35	New Features - Resurfaced date — Vulnerability findings now include a "Resurfaced date" attribute indicating when a previously remediated finding was detected again.	N/A
3.1.34	Improvements - Internal refinements to plugin-based finding handling. No customer-visible behavior change.	N/A
3.1.33	Improvements - Host records now capture when the asset was last observed by Tenable, improving "last seen" accuracy.	N/A
3.1.32	Improvements - Hardened handling of transient service-unavailable responses from Tenable to reduce sync failures during temporary platform outages.	N/A
3.1.31	No changes in this release.	N/A
3.1.30	Bug Fixes - Corrected vulnerability finding population for more reliable results.	N/A
3.1.29	Bug Fixes - Vulnerability — Refined how the finding source status is populated so it reflects the resolved status value.	N/A
3.1.28	Improvements - Vulnerability — Finding status is now normalized into a standard status and status category, and the original Tenable status is preserved separately as the provider status. This produces more consistent open/closed reporting across connectors.	N/A
3.1.27	No changes in this release.	N/A
3.1.26	Bug Fixes - Vulnerability Definition / Violation Definition — "Vulnerability age" is now stored as a whole number again (was temporarily stored as text), so it can be used in numeric comparisons.	• The "Vulnerability age" attribute changed from text back to a number. Re-sync the connector so existing definition records are repopulated with the corrected type.
3.1.25	Improvements - Host — Added an "Installed software" attribute listing software packages reported for the asset.	N/A
3.1.24	Improvements - Restructured the asset and plugin-based finding models around shared base classes, improving consistency of attribute handling across Host, Vulnerability, Vulnerability Definition, Violation, and Violation Definition records.	N/A
3.1.23	Improvements - CVSS scoring — CVSS v2 and v3 sub-scores (including impact sub-score) are now derived directly from the parsed CVSS vector, producing more accurate and complete scoring details on vulnerability definitions.	N/A
3.1.22	Bug Fixes - Host — The original Tenable status is now preserved as the provider status while the normalized source status is populated separately, improving status reporting consistency.	N/A
3.1.21	Bug Fixes - Vulnerability Definition / Violation Definition — Corrected the data types of two attributes to match their actual values: "Exploit available" is now a true/false value (was text) and "Threat recency" is now a number (was text).	• The "Exploit available" attribute changed from text to a boolean and "Threat recency" changed from text to a number. Re-sync the connector so existing definition records are repopulated with the corrected types.
3.1.20	No changes in this release.	N/A
3.1.19	New Features - Compliance findings — The connector now syncs Tenable compliance audit results as two new models: Violation and Violation Definition, alongside the existing vulnerability data.	N/A
3.1.18	No changes in this release.	N/A
3.1.17	Improvements - Improved handling of additional asset fields returned by the Tenable export API.	N/A
3.1.16	Bug Fixes - Vulnerability Definition — CVSS scores (including CVSS v3 impact score and VPR score) are now parsed and stored as decimal values consistently, fixing cases where scores delivered as different numeric formats were mishandled.	• The "CVSS v3 impact score" and "VPR score" attributes changed from single-precision to double-precision decimals. Re-sync the connector so existing definition records are repopulated with the corrected type.
3.1.15	Bug Fixes - Vulnerability / Vulnerability Definition — Reworked severity handling so both the original (source) severity and its numeric score are recorded alongside the normalized Brinqa severity and score, fixing inconsistent severity values.	• Severity attributes were re-keyed and rescaled, and the "Product coverage" and "Vulnerability age" attribute types changed. Re-sync the connector so existing vulnerability records are repopulated with the corrected severity values and types.
3.1.14	No changes in this release.	N/A
3.1.13	No changes in this release.	N/A
3.1.12	Improvements - Sync tuning options (page size, parallelism, and max retries) now fall back to sensible connector defaults when not explicitly configured, improving out-of-the-box sync reliability.	N/A
3.1.11	Improvements - Standardized hostname and MAC address normalization across asset and finding records for more consistent matching with data from other connectors.	N/A
3.1.10	No changes in this release.	N/A
3.1.9	No changes in this release.	N/A
3.1.8	No changes in this release.	N/A
3.1.7	Improvements - Internal model framework refinements shared across the Tenable connectors. No customer-visible behavior change.	N/A
3.1.6	No changes in this release.	N/A
3.1.5	No changes in this release.	N/A
3.1.4	No changes in this release.	N/A
3.1.3	Bug Fixes - Assessment — Improved how scanned targets are collected for scan assessments.	N/A
3.1.2	No changes in this release.	N/A
3.1.1	Improvements - Assessment — Added scan schedule details (recurrence rules and schedule start time) and improved date/time parsing so creation and modification timestamps are stored as proper timestamps.	N/A
3.1.0	Improvements - Refinements to asset and scan assessment handling for more reliable syncs.	N/A
3.0.16	New Features - Scan assessments — The connector now syncs Tenable scans as a new Assessment model, capturing scan timing, schedule, type, owner, and the assets covered by each scan.	N/A
3.0.15	Improvements - Host — Reworked hostname, operating system, and identifier selection so multi-valued hostnames and operating systems are captured and the primary name/identifier is chosen more reliably.	N/A
3.0.14	Improvements - Host — Hostnames and DNS names are now de-duplicated and DNS names lower-cased for more consistent matching.	N/A
3.0.13	Improvements - Standardized sync operation option handling across the Tenable connectors. No customer-visible behavior change.	N/A
3.0.12	New Features - Full re-sync option — A new syncInterval option lets you force a sync from the beginning of time rather than only changes since the last run.	N/A
3.0.11	New Features - Vulnerability — Added a "Severity modification type" attribute indicating whether a finding's severity was recast by Tenable.	N/A
3.0.10	Bug Fixes - Vulnerability Definition — Score fields now return no value (rather than defaulting to zero) when Tenable does not provide them, avoiding misleading zero scores.	N/A
3.0.9	Bug Fixes - Vulnerability Definition — Vulnerability age bounds now return no value (rather than zero) when Tenable does not provide them.	N/A
3.0.8	New Features - Host — Added dedicated cloud instance identifiers for AWS (instance ID), Azure (VM ID and resource ID), and GCP (instance ID), so cloud assets are identified more precisely.	N/A
3.0.7	Improvements - Host — Expanded and reordered the default asset sources so more asset types (including SSM-discovered assets) are included by default.	N/A
3.0.6	Improvements - Reworked the asset and finding export pipeline (chunk handling and scan correlation) for more reliable large exports, and added a "Last scan name" attribute to host records.	N/A
3.0.5	Improvements - Vulnerability Definition — Added several new finding-definition attributes including agent, compliance, default account, threat intensity/recency/sources, and product coverage.	N/A
3.0.4	Bug Fixes - Vulnerability Definition — Corrected severity scoring so the normalized severity score is populated as a proper score value.	• The finding-definition severity score attribute was re-keyed (from "severity number" to "severity score"). Re-sync the connector so existing vulnerability definition records pick up the corrected attribute.
3.0.3	Bug Fixes - Vulnerability Definition — Fixed CVSS v3 vector parsing, which previously parsed the v2 vector by mistake, so CVSS v3 details are now derived correctly.	N/A
3.0.2	New Features - Vulnerability Definition — Added a numeric severity attribute derived from the normalized severity.	N/A
3.0.1	Bug Fixes - Host — Asset name and identifier selection now falls back to IPv4, IPv6, or MAC address when no hostname is available, so assets are no longer left without a usable name.	N/A
3.0.0	Overview The Tenable Vulnerability Management connector integrates with Tenable.io to synchronize host assets, vulnerability findings, and their underlying vulnerability definitions. Category: Vulnerability Management Models	N/A