Tenable.sc

Vulnerability Management

Overview

The Tenable.sc Connector integrates Brinqa with Tenable.sc (formerly SecurityCenter), Tenable's on-premises vulnerability management platform. It synchronizes scanned hosts, vulnerability findings, and the Nessus plugin definitions that back those findings. Vulnerability findings and host assets are sourced from the Tenable.sc Analysis API, while vulnerability definitions are sourced from the plugin catalog. The connector resolves CVSS v2/v3 vectors into discrete metrics and extracts Vulnerability Priority Rating (VPR) context for each definition.

Data retrieved from Tenable.sc

Connector Object	Required	Maps to Data Model
Host	Yes	Host
Vulnerability	Yes	Vulnerability
Vulnerability Definition	Yes	Vulnerability Definition

Model relationships

note

For detailed steps on how to view the data retrieved from Tenable.sc in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Tenable.sc from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Server URL	No	—	Tenable.sc server URL
Access key	No	—	Tenable.sc API access key
Secret key	No	—	Tenable.sc API secret key
Page size	No	—	Maximum number of records to get per API request
Parallel requests	No	—	Maximum number of parallel API requests
SSL / TLS	No	—	Skip certificate verification

Authentication

The connector authenticates with the Tenable.sc REST API using an API key pair (an access key and a secret key) issued in Tenable.sc for a user account. The keys are supplied as connector configuration and sent on every request in a single x-apikey request header.

Endpoint

The connection test calls the status endpoint to confirm reachability and credential validity.

Method	URL
GET	{Server URL}/rest/status

Request headers

Header	Value
x-apikey	accesskey={Access key}; secretkey={Secret key};
Accept	application/json
User-Agent	Integration/1.0 (Brinqa; Tenable.sc Connector; Build/{version})

Request body

No request body. The status check is a simple GET.

Sample response

{
  "type": "regular",
  "response": {
    "jobd": "true",
    "licenseStatus": "Valid",
    "PluginSubscriptionStatus": "Valid",
    "serverUUID": "00000000-1111-2222-3333-444444444444",
    "serverClassification": "None"
  },
  "error_code": 0,
  "error_msg": "",
  "timestamp": "1700000000"
}

Response fields

Field	Description
error_code	0 indicates a successful, authenticated request.
response.licenseStatus	Validity of the Tenable.sc license.
response.serverUUID	Unique identifier of the Tenable.sc server.

Credential usage

The access key and secret key are not exchanged for a session token. Instead, the connector attaches the x-apikey header — built from the configured access key and secret key — to every subsequent API request (analysis, hosts, plugins). There is no token refresh or expiry handling.

Sync Behavior

The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.

How to obtain Tenable.sc credentials

Obtain the required credentials (Server URL, Access key, Secret key) from your Tenable.sc administrator or the Tenable.sc admin console, then enter them in the connection settings above.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Host

Source Field Name	SDM Attribute
analysis last auth/unauth run	LAST_SCANNED
analysis lastAuthRun	LAST_AUTH_RUN
analysis lastUnauthRun	LAST_UNAUTH_RUN
analysis osCPE	OS_CPE
Constant	CATEGORIES
Constant	STATUS
Derived	UID
Host.createdTime	SOURCE_CREATED_DATE
Host.dns (or analysis dnsName)	PUBLIC_DNS_NAME
Host.dns (or analysis dnsName)	PRIVATE_DNS_NAME
Host.firstSeen	FIRST_SEEN
Host.ipAddress (or analysis ip)	IP_ADDRESSES
Host.ipAddress (or analysis ip)	PUBLIC_IP_ADDRESS
Host.ipAddress (or analysis ip)	PRIVATE_IP_ADDRESSES
Host.lastSeen / analysis last auth/unauth run	LAST_SEEN
Host.macAddress (or analysis macAddress)	MAC_ADDRESSES
Host.modifiedTime	SOURCE_LAST_MODIFIED
Host.name / Host.dns / Host.netBios (or analysis dnsName/netbiosName)	HOSTNAME
Host.name / Host.dns / Host.netBios / Host.ipAddress / Host.uuid (or analysis identifier/serial/dnsName/netbiosName/ip/uuid)	NAME
Host.os (or analysis osCPE)	DESCRIPTION
Host.os (or analysis osCPE)	OPERATING_SYSTEM
Host.repository.id	REPO_ID
Host.repository.name	REPO_NAME
Host.systemType	SYSTEM_TYPE
Host.tenableUUID	TENABLE_UUID
Host.uuid	UUID

Vulnerability

Source Field Name	SDM Attribute
analysis acceptRisk	RISK_ACCEPTED
analysis dnsName	PUBLIC_DNS_NAME
analysis dnsName	PRIVATE_DNS_NAME
analysis firstSeen	FIRST_FOUND
analysis ip	IP_ADDRESSES
analysis lastMitigated	LAST_FIXED
analysis lastSeen	LAST_FOUND
analysis macAddress	MAC_ADDRESSES
analysis netbiosName	HOSTNAME
analysis pluginText	RESULTS
analysis port	PORT
analysis protocol	PROTOCOL
analysis recastRisk	RISK_RECASTED
analysis repository.id	REPO_ID
analysis repository.name	REPO_NAME
analysis severity	SEVERITY
analysis severity	SOURCE_SEVERITY
analysis status (or fixed for patched source)	STATUS
Derived	UID
Derived	NAME
Derived asset id (identifier / serial / MD5 asset id)	TARGETS
Derived from pluginID	TYPE
Derived from status	STATUS_CATEGORY

Vulnerability Definition

Source Field Name	SDM Attribute
Parsed from CVSS v2 vector	CVSS_V2_AC
Parsed from CVSS v2 vector	CVSS_V2_AI
Parsed from CVSS v2 vector	CVSS_V2_AU
Parsed from CVSS v2 vector	CVSS_V2_AV
Parsed from CVSS v2 vector	CVSS_V2_CI
Parsed from CVSS v2 vector	CVSS_V2_E
Parsed from CVSS v2 vector	CVSS_V2_II
Parsed from CVSS v2 vector	CVSS_V2_RC
Parsed from CVSS v2 vector	CVSS_V2_RL
Parsed from CVSS v2 vector	CVSS_V2_SEVERITY
Parsed from CVSS v3 vector	CVSS_V3_AC
Parsed from CVSS v3 vector	CVSS_V3_AI
Parsed from CVSS v3 vector	CVSS_V3_AV
Parsed from CVSS v3 vector	CVSS_V3_CI
Parsed from CVSS v3 vector	CVSS_V3_E
Parsed from CVSS v3 vector	CVSS_V3_II
Parsed from CVSS v3 vector	CVSS_V3_PR
Parsed from CVSS v3 vector	CVSS_V3_RC
Parsed from CVSS v3 vector	CVSS_V3_RL
Parsed from CVSS v3 vector	CVSS_V3_SEVERITY
Parsed from CVSS v3 vector	CVSS_V3_UI
plugin.baseScore	CVSS_V2_BASE_SCORE
plugin.checkType	CHECK_TYPE
plugin.cpe	AFFECTED
plugin.cvssV3BaseScore	CVSS_V3_BASE_SCORE
plugin.cvssV3TemporalScore	CVSS_V3_TEMPORAL_SCORE
plugin.cvssV3Vector	CVSS_V3_VECTOR
plugin.cvssVector	CVSS_V2_VECTOR
plugin.description	DESCRIPTION
plugin.exploitAvailable	EXPLOIT_AVAILABLE
plugin.exploitEase	EXPLOIT_EASE
plugin.exploitFrameworks	EXPLOITS
plugin.family.name	CATEGORIES
plugin.id	UID
plugin.modifiedTime / plugin.pluginModDate	SOURCE_LAST_MODIFIED
plugin.name	NAME
plugin.patchPubDate	PATCH_AVAILABLE
plugin.patchPubDate / plugin.pluginPubDate	PUBLISHED_DATE
plugin.riskFactor	SOURCE_SEVERITY
plugin.riskFactor	SEVERITY
plugin.seeAlso	SEE_ALSO
plugin.solution	RECOMMENDATION
plugin.synopsis	SUMMARY
plugin.temporalScore	CVSS_V2_TEMPORAL_SCORE
plugin.type	PLUGIN_TYPE
plugin.vprScore	VPR_SCORE
plugin.xrefs (CVE entries)	CVE_IDS
plugin.xrefs (CVE entries)	CVE_RECORDS
plugin.xrefs (non-CVE entries)	REFERENCES
VPR context age_of_vuln	VULNERABILITY_AGE
VPR context cvssV3_impactScore	CVSS_V3_IMPACT_SCORE
VPR context exploit_code_maturity	EXPLOIT_CODE_MATURITY
VPR context predicted_impactScore	PREDICTED_IMPACT_SCORE
VPR context product_coverage	PRODUCT_COVERAGE
VPR context threat_intensity_last_28	THREAT_INTENSITY
VPR context threat_model_type	THREAT_MODEL_TYPE
VPR context threat_model_version	THREAT_MODEL_VERSION
VPR context threat_recency	THREAT_RECENCY
VPR context threat_sources_last_28	THREAT_SOURCES

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Host

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: POST /rest/analysis
• Default filters: analysis source types cumulative and patched; optional lastSeen/lastMitigated window applied when a since sync token is set

Vulnerability

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: POST /rest/analysis
• Default filters: source types cumulative and patched; pluginID <= 999999 always applied; optional lastSeen/lastMitigated window applied when a since sync token is set

Vulnerability Definition

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /rest/plugin
• Default filters: optional since parameter (epoch seconds) applied when a sync token is set, returning only plugins modified after that time

Changelog

Changelog

The Tenable.sc connector has undergone the following changes:

Version	Description	Migration Steps
3.0.4	Bug Fixes - Corrected the pagination logic used when retrieving vulnerability and vulnerability definition data from Tenable.sc. Previous offset handling could cause pages of records to be skipped or requested incorrectly on large data sets; results are now fetched reliably and completely.	N/A
3.0.3	Improvements - Vulnerability Definition CVE data is now exposed as both a list of CVE identifiers and as structured CVE records, making it easier to correlate definitions with CVE information. - The "last modified" timestamp on Vulnerability Definitions now clearly reflects the source system's last-updated date.	• Vulnerability Definition: The CVE attribute was split into separate CVE identifier and CVE record attributes, and the last-modified attribute was renamed to a source last-modified attribute. Because these attribute identifiers changed, the previously synced values will not carry over automatically — Action: re-sync the Vulnerability Definition data after upgrading.
3.0.2	Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.1	Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.0	Overview The Tenable.sc connector integrates with Tenable.sc (formerly SecurityCenter) to synchronize host and mobile device assets, vulnerability findings, vulnerability definitions, remediation solutions, and asset groups. Category: Vulnerability Management Models	N/A