> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/vulnerability-scanners/tenable.md).

# Tenable

![Tenable Logo](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-7ededed2f425c2e8fdaaffdac00528607dac4d02%2Ftenable.png?alt=media)

**Introduction**

Tenable is a widely used vulnerability management platform. This guide provides instructions for integrating **Tenable Vulnerability Management** into the ThreatDefence SIEM platform, so that vulnerability findings and web application findings are imported into the ThreatDefence platform and converted into SIEM data.

The integration connects to Tenable's cloud service at `https://cloud.tenable.com` and uses Tenable's export API to retrieve findings on a schedule. The first run imports a configurable history window, and subsequent runs import only what has changed since the previous run.

:::tip This integration targets Tenable Vulnerability Management (cloud). Tenable Security Center (the on premises appliance) is a separate product with a different API and a different role model, and is not covered by this guide. :::

To access the API, the integration requires an **API Access Key** and **Secret Key** generated for a Tenable user account. For more information, see [Generate API Keys](https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm).

**What the integration collects**

| Dataset    | Source                                                         |
| ---------- | -------------------------------------------------------------- |
| `vulns`    | Vulnerability findings                                         |
| `webapps`  | Web application findings, from Tenable Web App Scanning        |
| `scanners` | Scanner state snapshot, including each scanner's online status |

{% hint style="info" %}
Tenable webapps scanning and scanner status check are an optional set up with separate license requirement.

If you don't have this set up, integration will skip this lookup and only follow the vulnerability scanning.
{% endhint %}

**Integration Steps**

To activate the integration, supply the following information to your ThreatDefence representative:

* Your Tenable Vulnerability Management **access key** and **secret key**. For more information, see [Generate API Keys](https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm).
* If your Tenable tenant restricts API access by source IP, the address the integration will connect from, so it can be added to your allow list.

:::tip All findings the API user's permissions allow will be imported. The scope of the import is controlled entirely by the Tenable role and permissions assigned to that user, described below. :::

**Required Permissions and Roles**

The API user needs **two separate things**. Both are required — a role on its own is not enough.

1. A **role** of at least `Basic [16]`, or a custom role carrying the relevant export privilege.
2. A **Can View** access control permission covering the assets to be exported, most simply scoped to the **All Assets** object.

Tenable's role hierarchy:

`Read-Only [0]` → `Basic [16]` → `Scan Operator [24]` → `Standard [32]` → `Scan Manager [40]` → `Administrator [64]`

Note that `Read-Only [0]` sits **below** `Basic [16]` and is not sufficient.

**Vulnerabilities (`vulns` dataset)**

| Requirement             | Value                                           |
| ----------------------- | ----------------------------------------------- |
| Role                    | At least `Basic [16]`                           |
| Custom role alternative | The `VM.VM_EXPLORE.VM_EXPLORE.EXPORT` privilege |
| Access control          | `Can View` on the asset objects to be exported  |

**Web Apps (`webapps` dataset)**

| Requirement             | Value                                                    |
| ----------------------- | -------------------------------------------------------- |
| Role                    | At least `Basic [16]`                                    |
| Custom role alternative | The `WAS.SCAN_WAS.READ` privilege                        |
| Access control          | `Can View` on the asset objects to be exported           |
| Licensing               | The tenant must be licensed for Tenable Web App Scanning |

**Scanners (`scanners` dataset)**

| Requirement             | Value                                                                     |
| ----------------------- | ------------------------------------------------------------------------- |
| Role                    | At least `Scan Manager [40]`                                              |
| Custom role alternative | The `VM.VM_SENSOR.VM_SCANNER.READ` privilege, with the Sensors permission |
| Access control          | Not applicable; scanner visibility follows the role                       |

{% hint style="info" %}
The scanner endpoints require a **higher role than the findings exports**.

At `Basic [16]` the scanner endpoints reject the request with `403 Insufficient scope`, even though `VM.VM_SENSOR.VM_SCANNER.READ` appears in the user's own permission list at that role.

Do not take the presence of that privilege as evidence the role is sufficient — raise the user to `Scan Manager [40]`.
{% endhint %}

**Minimum recommended configuration**

* Role: `Basic [16]` or higher for findings; `Scan Manager [40]` if scanner status monitoring is wanted.
* Access control: a permission configuration granting `Can View` on the **All Assets** object.

**Reference**

* [Roles](https://developer.tenable.com/docs/roles)
* [Access control permissions](https://docs.tenable.com/vulnerability-management/Content/Settings/access-control/Permissions.htm)
* [Tenable-provided roles and privileges](https://docs.tenable.com/vulnerability-management/Content/Settings/access-control/TenableRolePrivileges.htm)
* [Generate API Keys](https://docs.tenable.com/vulnerability-management/Content/Settings/my-account/GenerateAPIKey.htm)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.threatdefence.com/siem-integrations/vulnerability-scanners/tenable.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.