Tenable Vulnerability Management

View as Markdown

Community Platform

runZero imports data from Tenable Vulnerability Management (previously Tenable.io) through the Tenable API.

Getting started with Tenable Vulnerability Management

To set up the Tenable Vulnerability Management integration:

  1. Create an Administrator API key in an access group with Can View permission to Manage Assets. To retrieve agent health data, the key also needs the Scan Manager role.
  2. Add the Tenable Vulnerability Management credential to runZero.
  3. Choose whether to run the integration as a scan probe or a connector task.
  4. Activate the integration to pull your data into runZero.

Requirements

  • Administrator access to the Tenable portal.

Step 1: Create an Administrator API key

  1. Sign in to Tenable Vulnerability Management with the Administrator account you’re using for the runZero integration.
  2. Go to My Profile > My Account > API Keys.
  3. Click Generate, then download or copy the API token.

Step 2: Add the Tenable credential to runZero

  1. Go to the Credentials page in runZero and name the credential, for example Tenable Vulnerability Management.
  2. Choose Tenable.io Access & Secret from the list of credential types.
  3. Generate your Tenable access and secret keys from your account page in the Tenable portal, then fill in the fields:
    • Enter your 64-character Tenable access key in Access key.
    • Enter your 64-character Tenable secret key in Secret key.
  4. To share this credential with other organizations, select Make this a global credential. Otherwise, you can grant access per organization.
  5. Save the credential.

Step 3: Choose how to configure the Tenable integration

You can run the Tenable Vulnerability Management integration as a scan probe or a connector task. A scan probe gathers integration data during a scan task. A connector task runs on its own, from the cloud or from one of your Explorers, and performs only the integration sync. A connector task works if you’re self-hosting runZero or integrating with Tenable Vulnerability Management.

Step 4: Set up and activate the integration to sync data

Step 4a: Configure the Tenable integration as a connector task

A connection needs a schedule and a site. The schedule sets when the sync runs, and the site is where runZero creates any new Tenable-only assets.

  1. Activate a connection to Tenable Vulnerability Management. You can also reach every third-party connection from the integrations page, your inventory, or the tasks page.
  2. Choose the credentials you added earlier. If they aren’t listed, check that they have access to your current organization.
  3. To leave out assets runZero hasn’t scanned, check Exclude assets that cannot be merged into an existing asset. The import includes them by default.
  4. To include assets that haven’t been assessed for vulnerabilities, check Include assets that have not been assessed for vulnerabilities.
  5. To skip asset agent health data, check Disable importing asset agent data.
  6. Check Disable importing software from the Tenable inventory to use software records for fingerprint analysis without storing them in your runZero software inventory (optional).
  7. Check Disable importing vulnerabilities from the Tenable inventory to use vulnerability records for fingerprint analysis without storing them in your runZero vulnerability inventory (optional).
  8. Set the severity and risk levels to import (optional). Much of the host information from Tenable comes from Info-level plugins, so if you import only higher severities, assets runZero hasn’t scanned may show little information.
  9. Optionally, enter a comma-separated list of tags to include, in the format category:value. runZero imports assets that match at least one of the tags.
  10. To filter by asset source, set Filter by asset source to All supported sources or to a combination of sources from the checklist.
  11. Enter a name for the task, like Tenable Vulnerability Management sync (optional).
  12. Choose the Explorer that runs this connector task (optional).
  13. Choose the site for your assets. runZero stores all newly discovered assets there.
  14. Enter a description for the task (optional).
  15. Schedule the sync to run once or on a recurring schedule, starting on the date and time you set.
  16. Activate the connection. The sync runs on your schedule, and the Scheduled tasks page shows when the next one will run.

Step 4b: Configure the Tenable integration as a scan probe

Run the Tenable Vulnerability Management integration as a scan probe to have the runZero Explorer pull your vulnerability data into the runZero Console.

In a new or existing scan configuration:

  • Set the TENABLE option to Yes in the Probes and SNMP tab and change any default options you need.
  • Optionally, set the severity and risk levels for ingested vulnerability scan results.
  • Set the correct Tenable credential to Yes in the Credentials tab.

Step 5: View Tenable assets and vulnerabilities

After a successful sync, your Tenable assets appear in your inventory with a Tenable icon in the Source column.

The integration also gathers the vulnerabilities Tenable detected. Go to Inventory > Vulnerabilities to view the vulnerability data from Tenable Vulnerability Management.

To filter by Tenable assets, run this query:

Open an asset to see the attributes runZero gathered from the Tenable scan data.

Troubleshooting

If you’re having trouble with the integration, start with these questions and answers.

Why is the Tenable Vulnerability Management integration unable to connect?

  1. Check whether the Tenable Vulnerability Management integration is returning any data.
    • Query the inventory rather than the task details to review all the data available from this integration.
    • In some cases, an integration’s configuration limits how much data reaches the runZero console.
  2. Some integrations require specific actions that are easy to overlook. If you miss a step during setup, the integration may not work correctly. Review this page and follow the steps exactly.
  3. If the Tenable Vulnerability Management integration can’t connect, check the task log for errors. Common errors include:
    • 500: server error, unable to connect to the endpoint
    • 404: hitting an unknown endpoint on the server
    • 403: not authorized, likely a credential issue
  4. If Tenable Vulnerability Management is on-premises, verify that the integration task runs from an Explorer with access to the Tenable host.

How do I solve the following error in Tenable Vulnerability Management:

"error-message":"no tenable assets match import criteria",
"level":"error","msg":"could not load scan result data to writer"

Enabling the Include Unscanned Assets toggle in the Tenable task configuration usually resolves this error, which Tenable returns intermittently. The toggle disables the filters runZero applies for live assets scanned in the last 30 days.

Updated