Tenable

Tenable Logo

Introduction

Tenable is a widely used vulnerability management platform. This guide provides instructions for integrating Tenable Vulnerability Management into the ThreatDefence SIEM platform, so that vulnerability findings and web application findings are imported into the ThreatDefence platform and converted into SIEM data.

The integration connects to Tenable's cloud service at https://cloud.tenable.com and uses Tenable's export API to retrieve findings on a schedule. The first run imports a configurable history window, and subsequent runs import only what has changed since the previous run.

:::tip This integration targets Tenable Vulnerability Management (cloud). Tenable Security Center (the on premises appliance) is a separate product with a different API and a different role model, and is not covered by this guide. :::

To access the API, the integration requires an API Access Key and Secret Key generated for a Tenable user account. For more information, see Generate API Keys.

What the integration collects

Dataset	Source
vulns	Vulnerability findings
webapps	Web application findings, from Tenable Web App Scanning
scanners	Scanner state snapshot, including each scanner's online status

Tenable webapps scanning and scanner status check are an optional set up with separate license requirement.

If you don't have this set up, integration will skip this lookup and only follow the vulnerability scanning.

Integration Steps

To activate the integration, supply the following information to your ThreatDefence representative:

• Your Tenable Vulnerability Management access key and secret key. For more information, see Generate API Keys.

• If your Tenable tenant restricts API access by source IP, the address the integration will connect from, so it can be added to your allow list.

:::tip All findings the API user's permissions allow will be imported. The scope of the import is controlled entirely by the Tenable role and permissions assigned to that user, described below. :::

Required Permissions and Roles

The API user needs two separate things. Both are required — a role on its own is not enough.

1. A role of at least Basic [16], or a custom role carrying the relevant export privilege.

2. A Can View access control permission covering the assets to be exported, most simply scoped to the All Assets object.

Tenable's role hierarchy:

Read-Only [0] → Basic [16] → Scan Operator [24] → Standard [32] → Scan Manager [40] → Administrator [64]

Note that Read-Only [0] sits below Basic [16] and is not sufficient.

Vulnerabilities (vulns dataset)

Requirement	Value
Role	At least Basic [16]
Custom role alternative	The VM.VM_EXPLORE.VM_EXPLORE.EXPORT privilege
Access control	Can View on the asset objects to be exported

Web Apps (webapps dataset)

Requirement	Value
Role	At least Basic [16]
Custom role alternative	The WAS.SCAN_WAS.READ privilege
Access control	Can View on the asset objects to be exported
Licensing	The tenant must be licensed for Tenable Web App Scanning

Scanners (scanners dataset)

Requirement	Value
Role	At least Scan Manager [40]
Custom role alternative	The VM.VM_SENSOR.VM_SCANNER.READ privilege, with the Sensors permission
Access control	Not applicable; scanner visibility follows the role

The scanner endpoints require a higher role than the findings exports.

At Basic [16] the scanner endpoints reject the request with 403 Insufficient scope, even though VM.VM_SENSOR.VM_SCANNER.READ appears in the user's own permission list at that role.

Do not take the presence of that privilege as evidence the role is sufficient — raise the user to Scan Manager [40].

Minimum recommended configuration

• Role: Basic [16] or higher for findings; Scan Manager [40] if scanner status monitoring is wanted.

• Access control: a permission configuration granting Can View on the All Assets object.

Reference

• Roles

• Access control permissions

• Tenable-provided roles and privileges

• Generate API Keys