Skip to main content

Tenable Security Center

Tenable Security Center, formerly Tenable.sc, is a vulnerability management and security configuration tool that scans, consolidates, and evaluates vulnerability data from your entire network. You can bring asset and security data from Tenable Security Center into Brinqa to calculate risk scores, construct a unified view of your attack surface, and strengthen your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Tenable Security Center and how to obtain that information from Tenable. See create a data integration for step-by-step instructions on setting up the integration.

info

The Tenable Security Center connector supports Tenable Security Center versions 5 and above, with testing currently ongoing for version 6.4. For additional information, see Tenable Security Center downloads and release notes.

Required connection settings

When setting up a data integration, select Tenable Security Center from the Connector dropdown. If you cannot find the connector in the dropdown, make sure that you have installed it first. You must provide the following information to authenticate Tenable Security Center with Brinqa:

  • Server URL: The Tenable Security Center Server URL.

  • Access key and Secret key: The access key and secret key associated with the Tenable Security Center account, which must have permissions to log in to the API server and return data.

Generate Tenable Security Center API keys

For the Tenable Security Center connector to use the Tenable Security Center API, you must provide the access key and secret key from Tenable Security Center.

Before you can generate a new access key and secret key, you must enable API key authentication. To do so, follow these steps:

  1. Log in to your organization's Tenable Security Center account as an administrator.

  2. Navigate to System > Configuration, and then click Security.

  3. In Authentication Settings, click Allow API Keys.

  4. Click Submit.

To generate new API keys for authentication, follow these steps:

  1. Log in to your organization's Tenable Security Center account as an administrator.

  2. Navigate to Users > Users.

  3. Right-click the user for which you want to generate new API keys.

  4. Click API Keys > Generate API Key.

  5. Review the confirmation and click Generate.

    Your new Tenable Security Center access key and secret key display in the window. Copy the access key and secret key to a safe and secure location.

note

If you do not have the permissions to create Tenable Security Center access and secret keys, contact your Tenable Security Center administrator. For additional information, see Tenable Security Center documentation.

Required ports

To ensure proper communication between your on-premise Brinqa Agent servers and the Tenable Security Center on-prem server, the following port must be opened:

  • Port 443 (HTTPS): This port is used for secure communication between the Brinqa Agent and Tenable Security Center. Ensure that this port is open for outbound and inbound traffic on any firewall protecting the Tenable Security Center server.

    The Tenable Security Center connector is set up using a URL provided by the Tenable administrator. The URL is typically in the format https://host..., where the https:// part indicates that the communication is over HTTPS, using port 443. However, the specific port can be configured differently based on your network and security setup. For instance, if the URL is in the format http://host:<PORT>, then the specified port will be used. The exact port and route that need to be open and accessible are determined by the Tenable Security Center administrator and network team. The Brinqa connector or Brinqa Agent does not have any specific port requirement; it depends on how Tenable Security Center is configured.

Additional settings

The Tenable Security Center connector contains additional options for specific configuration:

  • Page size: The maximum number of records to get per API request. The default setting is 1000. It is not recommended to go over 1000.

  • Parallel requests: The maximum number of parallel API requests. The default setting is 8.

  • Maximum retries: The maximum number of times that the integration attempts to connect to the Tenable Security Center API before giving up and reporting a failure. The default setting is 10.

  • Skip certificate verification: Select this option to allow for untrusted certificates.

Types of data to retrieve

The Tenable Security Center connector can retrieve the following types of data from the Tenable Security Center API:

Table 1: Data retrieved from Tenable Security Center

Connector ObjectRequiredMaps to Data Model
HostYesHost
VulnerabilityYesVulnerability
Vulnerability DefinitionYesVulnerability Definition
info

Tenable Security Center refers to Vulnerability Definitions as Plugins.

When the Sync data from setting is enabled, the connector filters patched vulnerabilities using the lastMitigated timestamp; for cumulative vulnerabilities (and other types), it uses the lastSeen timestamp.

For detailed steps on how to view the data retrieved from Tenable Security Center in the Brinqa Platform, see How to view your data.

Attribute mappings

Click the tabs below to view the mappings between the source and the Brinqa data model attributes.

Host

Table 2: Host attribute mappings

Source Field NameMaps to Attribute
host.createdTimesourceCreatedDate
host.dns, record.dnsNamepublicDnsName, privateDnsName
host.dnsname
host.firstSeenfirstSeen
host.ipAddressname
host.ipAddress, record.ipipAddresses, publicIpAddresses, privateIpAddresses
host.lastSeenlastSeen
host.macAddress, record.macAddressmacAddresses
host.modifiedTimesourceLastModified
host.namename
host.netBiosname
host.tenableUUIDLocal variable
record.dnsNamename
record.identifiername
record.ipname
record.netbiosNamename
record.serialname
repository.id (host)Local variable
repository.name (host)Local variable
STATUSstatus
uiduid
vuln.asset.fqdnprivateDnsName, publicDnsName
vuln.asset.hostnamehostnames
vuln.asset.ipv4ipAddresses
vuln.asset.mac_addressmacAddresses
vuln.asset.uuidtargets
vuln.first_foundfirstFound
vuln.last_fixedLocal variable
vuln.last_foundlastFound
vuln.plugin.idtype
vuln.port.portport
vuln.port.protocolprotocol
vuln.outputresults
vuln.severity_idseverity, sourceSeverity
vuln.statesourceStatus, statusCategory, status
Vulnerability

Table 3: Vulnerability attribute mappings

Source Field NameMaps to Attribute
repository.id (vuln)Local variable
repository.name (vuln)Local variable
record.sourceTypestatus, sourceStatus, statusCategory
uniqueAssetIduid, targets
vuln.acceptRiskLocal variable
vuln.dnsNamepublicDnsName, privateDnsName
vuln.firstSeenfirstFound
vuln.identifieruid, targets
vuln.ipipAddresses
vuln.lastSeenlastFound
vuln.macAddressmacAddresses
vuln.netbiosNamehostname
vuln.pluginIduid, type
vuln.pluginTextresults
vuln.portuid, port
vuln.protocoluid, protocol
vuln.recastRiskLocal variable
vuln.serialuid, targets
vuln.severityseverity, sourceSeverity
Vulnerability Definition

Table 4: Vulnerability Definition attribute mappings

Source Field NameMaps to Attribute
age_of_vulnLocal variable
cvssV3_impactScoreLocal variable
exploit_code_maturityLocal variable
PATCH_AVAILABLEpatchAvailable
plugin.baseScorecvssV2BaseScore
plugin.checkTypeLocal variable
plugin.cpeaffected
plugin.cvssVectorcvssV2Vector
plugin.cvssV3BaseScorecvssV3BaseScore
plugin.cvssV3TemporalScorecvssV3TemporalScore
plugin.cvssV3VectorcvssV3Vector
plugin.descriptiondescription
plugin.exploitAvailableLocal variable
plugin.exploitEaseLocal variable
plugin.exploitFrameworksexploits
plugin.familycategories
plugin.iduid
plugin.modifiedTimesourceLastModified
plugin.namename
plugin.patchPubDateLocal variable
plugin.pluginModDatesourceLastModified
plugin.pluginPubDatepublishedDate
plugin.riskFactorseverity, sourceSeverity, severityScore
plugin.solutionrecommendation
plugin.synopsissummary
plugin.temporalScorecvssV2TemporalScore
plugin.typeLocal variable
plugin.vprScoreLocal variable
plugin.xrefscveIds, cveRecords, references
plugin.seeAlsoLocal variable
predicted_impactScoreLocal variable
product_coverageLocal variable
threat_intensity_last_28Local variable
threat_model_typeLocal variable
threat_model_versionLocal variable
threat_recencyLocal variable
threat_sources_last_28Local variable
info

Local variable indicates that the field is processed within a specific context, such as a particular workflow or calculation. Unlike other attributes, local variables aren't mapped to the unified data models. They only exist on the source data model.

Operation options

The Tenable Security Center connector supports the following operation options. See connector operation options for information about how to apply them.

Expand the sections below to view the operation options per connector object:

Host operation options

Table 5: Host operation options

Connector ObjectOptionAll Possible ValuesDescriptionExample
HostassetAny number identifying the hosts in your network.Retrieves the host that is associated with the specified asset ID.Key: asset Value: 123456789. This key and value combination only retrieves the host with asset ID 123456789.
ipAny valid IP addresses or DNS names in your network.A comma-separated list of valid IP addresses or DNS names in your network.Key: ip Value: 192.168.1.1. This key and value combination only retrieves the host whose IP address is 192.168.1.1.
per_repo_distinct_asset_uuidtrue or falseIndicate whether to create a unique identifier when the same asset is found in multiple repositories.Key: per_repo_distinct_asset_uuid Value: true. This key and value combination creates a unique identifier when the same asset is found in multiple repositories.
Vulnerability operation options

Table 6: Vulnerability operation options

Connector ObjectOptionAll Possible ValuesDescriptionExample
VulnerabilityacceptRiskaccepted, all, notAcceptedLimit retrieved vulnerabilities by their acceptance status, as determined by Tenable Security Center. For additional information, see Tenable Security Center Accept Risk Rules documentation.Key: acceptRisk Value: accepted. This key and value combination only retrieves vulnerabilities marked as accepted risks.
assetAny number identifying the hosts in your network.Retrieves the vulnerabilities that are associated with the specified asset ID.Key: asset Value: 123456789. This key and value combination only retrieves the vulnerabilities that are associated with asset ID 123456789.
baseCVSSScore or cvssV2BaseScoreAny numeric value ranges from from 0.1-10.0.Retrieves all vulnerabilities with the specified Common Vulnerability Score System (CVSS) V2 score or range of CVSS V2 scores. Values are separated by a dash -.Key: baseCVSSScore Value: 8. This key and value combination only retrieves vulnerabilities with a CVSS V2 score of 8.
cvssV3BaseScoreAny numeric value ranges from 0.1-10.0Retrieves all vulnerabilities with the specified CVSS V3 score or range of CVSS V3 scores. Values are separated by a dash -.Key: cvssV3BaseScore Value: 3. This key and value combination only retrieves vulnerabilities with a CVSS V3 score of 3.
infoPluginsAny supported Tenable Security Center plugin ID number or range of plugin IDs from 0-8388607.A comma-separated list of plugin IDs. Retrieves additional information about each plugin associated with the vulnerabilities identified in your network, such as the plugin's name, description, severity, and other details.Key: infoPlugins Value: 123456,789012. This key and value combination only retrieves detailed information about the plugins with IDs 123456 and 789012.
ipAny valid IP addresses or DNS names in your network.A comma-separated list of valid IP addresses or DNS names in your network.Key: ip Value: 192.168.1.1. This key and value combination only retrieves the vulnerabilities associated with the IP address 192.168.1.1.
mitigatednever, previouslyRetrieves vulnerabilities based on their mitigation status. never returns unmitigated vulnerabilities. previously returns vulnerabilities no longer detected, which often, but not always, means they were patched. For more information, see Tenable Security Center Mitigated Vulnerabilities.Key: mitigated Value: previously. This key and value combination retrieves vulnerabilities that were mitigated, typically due to patching or removal.
per_repo_distinct_asset_uuidtrue or falseIndicate whether to create a unique identifier when the same asset is found in multiple repositories.Key: per_repo_distinct_asset_uuid Value: true. This key and value combination creates a unique identifier when the same asset is found in multiple repositories.
plugin or pluginIDAny supported Tenable Security Center plugin ID number or range of plugin IDs from 0-8388607.Retrieves vulnerabilities that are related to the specified plugin ID or range of plugin IDs. Plugin IDs are separated by a dash -.Key: pluginID Value: 123456. This key and value combination only retrieves vulnerabilities associated with plugin ID 123456.
pluginTypeactive, compliance, lce, or passiveRetrieves vulnerabilities that are related to the specified plugin types.Key: pluginType Value: active, compliance. This key and value combination only retrieves active and compliant plugins that are used to identify vulnerabilities.
repositoryAny vulnerability repository.Retrieves only vulnerabilities from the specified repository.Key: repository Value: repo2. This key and value combination only retrieves vulnerabilities from the repo2 repository.
severityAny number from 0-4.Retrieves vulnerabilities based on their specified severity level. 0 = Informational, 1 = Low, 2 = Medium, 3 = High, and 4 = Critical.Key: severity Value: 4: This key and value combination only retrieves vulnerabilities with a severity level of 4, or critical vulnerabilities.
vprScoreAny numeric value from 0.1-10.0.Retrieve all vulnerabilities with a Vulnerability Priority Rating (VPR) score of the specified value or higher.Key: vpr_score Value: 7. This key and value combination retrieves all vulnerabilities with a VPR score of 7 or higher.
note

The option keys and values are case-sensitive as they are shown in this documentation.

APIs

The Tenable Security Center connector uses the Tenable Security Center REST API. Specifically, it uses the following API endpoints:

Table 7: Tenable Security Center REST API Endpoints

Connector ObjectAPI Endpoint
HostPOST /rest/hosts/search
VulnerabilityPOST /rest/analysis
GET /rest/status
Vulnerability DefinitionGET /rest/plugin

Changelog

The Tenable Security Center connector has undergone the following changes:

note

This connector is part of a bundled release with other connectors from the same vendor. If a version shows "No change", it means that the connector version was updated for consistency as part of the bundle, but no functional changes were made to this specific connector. You can update to or skip this version without affecting your existing configuration.

Table 8: Tenable Security Center connector changelog

VersionDescriptionDate Published
3.1.48Tenable SC — Violation — Corrected the "First seen" and "Last seen" attributes to be stored as proper timestamps. The Violation model declared its own "First seen"/"Last seen" attributes as numbers while the SecurityCenter API returns timestamp values, so the values were being stored with the wrong type. These attributes now use the platform's standard timestamp attributes, consistent with the Host model.
Migration Required: Tenable SC — Violation: the date attributes listed above changed from numbers to timestamps. Re-sync the Tenable SC connector to repopulate these records with the corrected type.
June 8th, 2026
3.1.47No change.June 4th, 2026
3.1.46- Dependency Upgrades: Refreshed internal model and CVSS scoring libraries to the latest stable releases to pick up upstream fixes and stay aligned with the rest of the Brinqa connector platform.
- Cross-Connector Attribute Consolidation: Every connector-defined custom attribute across Tenable IO VM, Tenable IO WAS, Tenable Nessus, and Tenable SC models now participates in cross-connector consolidation by default. When the same asset or finding is observed by another connector, Brinqa will merge values for these attributes consistently rather than treating each connector's values as independent.
Tenable.sc Schema Alignment:
- Asset Group, Mobile Device, Control, Violation now use the standard platform UID attribute as the identifier in their schemas, replacing the previous redundant Sys ID attribute that mirrored the same value. The Asset Group and Mobile Device schemas now also publish UID as an explicit identifier alongside their existing display key. Control and Violation now declare proper schema metadata (target ViolationDefinition and Violation respectively) so that platform features that depend on schema metadata work consistently for these models.
- Tenable.sc attribute names are now standard. Previously, the Tenable.sc connector emitted attributes such as Name, Description, Status, Tags, Owner, Type, Severity, Port, Protocol, and File name with title-case names that did not match other Brinqa connectors. The same attributes are now emitted under the platform-standard names (NAME, DESCRIPTION, STATUS, TAGS, OWNER, TYPE, SEVERITY, PORT, PROTOCOL, FILE_NAME, etc.), matching Tenable IO VM, Tenable IO WAS, and Tenable Nessus.
- Tenable.sc Vulnerability now exposes both PROVIDER_STATUS and SOURCE_STATUS. Previously the connector stored the raw API status under SOURCE_STATUS and the normalized status under STATUS. After the upgrade, the raw API status is stored under the new PROVIDER_STATUS attribute, and SOURCE_STATUS holds the normalized status (matching Tenable IO VM behavior).
- Mobile Device "Last scanned" is now under the standard LAST_SCANNED attribute rather than the previous Last scanned custom attribute. The value (epoch milliseconds) is unchanged.
- Mobile Device "Device version" is now under DEVICE_VERSION (previously emitted as Device version).
- Control's distinct Tenable UUID field (previously emitted as Uuid) is now TENABLE_UUID, matching how other Tenable models expose the Tenable-specific UUID.
- A latent type mismatch on the Tenable.sc Violation Severity attribute has been corrected: the schema declared Integer but the connector wrote the severity name as a string. The attribute is now declared String, aligning the schema with the values actually stored.
- A copy/paste defect in Tenable.sc Control that overwrote the Audit file template ID with the template name (and never populated the template name) has been fixed; Audit file template ID and Audit file template name are now populated independently.
Migration Required:
- Re-sync each Tenable connector after upgrading so that previously synced records pick up the new consolidation mappings. Existing data remains intact; the re-sync ensures consolidated values for assets and findings shared with other connectors converge correctly.
- For Tenable.sc Asset Group, Mobile Device, Control, and Violation records, any UI views, reports, or rules that referenced the Sys ID attribute should be updated to use the standard UID instead. The values are identical to what was previously stored under Sys ID.
- Tenable.sc attribute renames. Update any UI views, queries, reports, or rules that reference the following old Tenable.sc attribute names; the values they hold are unchanged, only the attribute name changes:
• Asset Group: NameNAME, DescriptionDESCRIPTION, TypeTYPE, StatusSTATUS, OwnerOWNER, TagsTAGS, CreatorCREATOR, GroupGROUP, IP listIP_LIST, RepositoriesREPOSITORIES, Created timeCREATED_TIME, Modified timeMODIFIED_TIME
• Mobile Device: SerialSERIAL, ModelMODEL, Device versionDEVICE_VERSION, MDM typeMDM_TYPE, UserUSER, OS CPEOS_CPE, Last scannedLAST_SCANNED
• Control: NameNAME, File nameFILE_NAME, Audit file versionAUDIT_FILE_VERSION, UuidTENABLE_UUID, TypeTYPE, StatusSTATUS, DescriptionDESCRIPTION, OwnerOWNER, CreatorCREATOR, ContextCONTEXT, Original file nameORIGINAL_FILE_NAME, Last refreshed timeLAST_REFRESHED_TIME, Audit file template idAUDIT_FILE_TEMPLATE_ID, Audit file template nameAUDIT_FILE_TEMPLATE_NAME, Created timeCREATED_TIME, Modified timeMODIFIED_TIME, Owner groupOWNER_GROUP, Target groupTARGET_GROUP
• Violation: Plugin IDPLUGIN_ID, Asset IDASSET_ID, Repository IDREPO_ID, Repository nameREPO_NAME, SeveritySEVERITY, MitigatedMITIGATED, Risk acceptedRISK_ACCEPTED, Risk recastedRISK_RECASTED, IP addressIP_ADDRESS, DNS nameDNS_NAME, MAC addressMAC_ADDRESS, NetBIOSNET_BIOS, PortPORT, ProtocolPROTOCOL, Plugin outputPLUGIN_OUTPUT, Audit fileAUDIT_FILE, Policy valuePOLICY_VALUE, InformationINFORMATION, Actual valueACTUAL_VALUE, ResultRESULT, Compliance referenceCOMPLIANCE_REFERENCE, First seenFIRST_SEEN, Last seenLAST_SEEN, Audit file idAUDIT_FILE_ID
- Tenable.sc Vulnerability finding status semantics changed. If you have downstream logic that depends on SOURCE_STATUS containing the raw Tenable.sc status value, update it to read from the new PROVIDER_STATUS attribute instead. SOURCE_STATUS now contains the normalized Brinqa status (the same value previously stored under STATUS).
May 21st, 2026
3.1.45Withdrawn. This release shipped a regression and has been superseded by 3.1.46. Customers should skip 3.1.45 and upgrade directly from 3.1.44 to 3.1.46.May 20th, 2026
3.1.44Dependency Upgrades — Upgraded internal framework and storage libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.
Migration Required: Several attributes were removed in the underlying framework and replaced with renamed multi-valued (or boolean-equivalent) counterparts. Values previously stored under the old attribute names remain in place but will no longer be updated; new syncs populate the new attribute names. Action: Re-sync the connector after upgrade.
- Host: HOSTNAMEHOSTNAMES, PRIVATE_DNS_NAMEPRIVATE_DNS_NAMES, PUBLIC_DNS_NAMEPUBLIC_DNS_NAMES, PUBLIC_IP_ADDRESSPUBLIC_IP_ADDRESSES
- Vulnerability: HOSTNAMEHOSTNAMES, PRIVATE_DNS_NAMEPRIVATE_DNS_NAMES, PUBLIC_DNS_NAMEPUBLIC_DNS_NAMES
- Vulnerability Definition: PATCH_AVAILABLEPATCHABLE
May 1st, 2026
3.1.43No change.April 30th, 2026
3.1.42No change.April 29th, 2026
3.1.41No change.April 29th, 2026
3.1.40No change.February 25th, 2026
3.1.39No change.February 25th, 2026
3.1.38Removed the mapping of vuln.lastMitigated to lastFixed for the Vulnerability object, as the API does not return this value.February 3rd, 2026
3.1.37No change.January 22nd, 2026
3.1.36No change.January 2nd, 2026
3.1.35No change.August 26th, 2025
3.1.34No change.August 11th, 2025
3.1.33No change.July 10th, 2025
3.1.32No change.July 1st, 2025
3.1.31The Tenable.sc connector has been renamed to "Tenable Security Center" to reflect Tenable's product name changes. This change only affects the connector label and does not impact functionality. You can update without making any changes to your existing configurations.June 10th, 2025
3.1.30No change.May 22nd, 2025
3.1.29No change.May 7th, 2025
3.1.28No change.May 7th, 2025
3.1.27The HOST_UUID attribute on the Host object is now optional.December 30th, 2024
3.1.26No change.October 3rd, 2024
3.1.25No change.September 30th, 2024
3.1.24No change.September 5th, 2024
3.1.23No change.July 26th, 2024
3.1.22No change.July 16th, 2024
3.1.21No change.May 31st, 2024
3.1.20Changed the EXPLOIT_AVAILABILITY attribute type on the Vulnerability Definition object from string to boolean.April 10th, 2024
3.1.19No change.February 22nd, 2024
3.1.18Added the VULNERABILITY_PUBLISHED_DATE attribute to the Vulnerability Definition object.February 11th, 2024
3.1.17No change.January 25th, 2024
3.1.16Addressed precision issues by changing the data type for CVSS scores from Float to Double.January 18th, 2024
3.1.15- Changed the SOURCE_SEVERITY attribute type to string.
- Added the SOURCE_SEVERITY_SCORE attribute on the Vulnerability and Vulnerability Definition objects.
December 17th, 2023
3.1.14Normalized the HOSTNAME attribute in the Host object.October 2nd, 2023
3.1.13Added a new operation option to indicate whether to create a unique identifier when the same asset is found in multiple repositories: per_repo_distinct_asset_uuidSeptember 18th, 2023
3.1.12Added a new additional setting to help manage API throttling: Maximum retriesSeptember 12th, 2023
3.1.11- Added the SOURCE_STATUS attribute to the Vulnerability object to store the source finding statuses.
- Added a method to normalize the source finding statuses.
August 10th, 2023
3.1.10Added operation options to retrieve vulnerabilities based on both severity and plugins.August 5th, 2203
3.1.9Avoided retrieving nanoseconds by changing the data type of date attributes from Long to Instant.July 27th, 2023
3.1.8Code cleanup and general maintenance.July 27th, 2023
3.1.7No change.July 27th, 2023
3.1.6No change.July 27th, 2023
3.1.5Code cleanup and general maintenance.July 26th, 2023
3.1.4Set the vulnerability status to 'Risk accepted' if the acceptRisk attribute on the source data is marked as 'true'.July 21st, 2023
3.1.3The connector now retrieves scans of all statuses.July 19th, 2023
3.1.2Added a check for null or empty dates.June 29th, 2023
3.1.1No change.June 28th, 2023
3.1.0No change.June 15th, 2023
3.0.16Code cleanup and general maintenance.June 11th, 2023
3.0.15Code cleanup and general maintenance.May 24th, 2023
3.0.14No change.May 23rd, 2023
3.0.13Code cleanup and general maintenance.May 23rd, 2023
3.0.12Code cleanup and general maintenance.May 22nd, 2023
3.0.11No change.May 6th, 2023
3.0.10Code cleanup and general maintenance.April 21st, 2023
3.0.9No change.April 20th, 2023
3.0.8No change.April 11th, 2023
3.0.7No change.March 28th, 2023
3.0.6No change.March 27th, 2023
3.0.5Added the PATCH_PUBLICATION_DATE attribute to the Vulnerability Definition object.March 6th, 2023
3.0.4No change.March 3rd, 2023
3.0.3No change.February 21st, 2023
3.0.2No change.February 3rd, 2023
3.0.1No change.January 19th, 2023
3.0.0Initial Integration+ release.January 1st, 2023