Managed in the cloud and powered by Nessus technology, Tenable.io provides the industry's most comprehensive vulnerability coverage with the ability to predict which security issues to remediate first. It’s your complete end-to-end vulnerability management solution.
Why integrate Tenable.io into the Vulcan platform?
The Tenable.io Connector by Vulcan integrates with the Tenable.io platform to pull and ingest host-type assets and vulnerability data into your Vulcan Platform. Once the integration is complete, the Vulcan Platform scans the report's findings to correlate, consolidate, and contextualize the ingested data to impact risk and remediation priority based on your business context.
Tenable.io Connector details
The Vulcan Platform ingests Tenable.io hosts and vulnerabilities through API.
Ingested asset type(s)
UNI directional (data is transferred from Tenable.io to the Vulcan Platform in one direction)
Supported version and type
Prerequisites and user permissions
Before you begin configuring the connector, make sure to perform the following:
Create a Tenable.io user with permissions
Generate API Key and Secret Key
Create Tenable.io User and Permissions
Go to Tenable.io > Settings > Access Control > Permissions > +Create Permission
Set the permissions as shown below:
Create additional permission for tags fetching. make sure to select “Can Use” and “All Tags”
Go to Tenable.io > Settings > Access Control > Create User
Fill in the primary user details.
For ROLE, select "Basic User".
Then, enable the API Key option.
For PERMISSIONS, select both of the permission you created earlier for the integration purpose.
Generate Tenable.io Client API and Secret Key
Login to Tenable.io using the User you created above.
Go to Settings > My Account > API Keys
Save the API Access Key and Secret Key somewhere safe.
Configuring the Tenable.io Connector
Log in to your Vulcan Cyber dashboard and go to Connectors.
Click on Add a Connector.
Click on the Tenable.io icon.
Set up the connector as follows:
First, insert the Servel URL of your Tenable.io instance.
Next, insert the API Access and Secret Keys you generated earlier.
Optional: Check the "Send unsannced assets to Tenable" if relevant.
Optional: Check the "Pull informational vulnerabilities from Tenable" if relevant. Check this option if you want the Vulcan Platform to retrieve informational vulnerabilities on top of Critical/High/Med/Low vulnerabilities.
Click the Test Connectivity button to verify that Vulcan Cyber can connect to your Tenable.io instance, then click Create (or Save Changes).
Inactive Assets: You can configure a Vulcan rule to consider inactive assets, and Vulcan will remove assets that do not appear in scans within the configured time range.
Allow some time for the sync to complete. Then, you can review the sync status under Log.
To confirm the sync is complete, navigate to the Connectors tab to check the sync status. Once the Tenable.io icon shows Connected, the connection is complete.
Tenable.io in the Vulcan Platform
Locating Tenable.io vulnerabilities in the Vulcan Platform
As Tenable.io discovers vulnerabilities, the Vulcan Platform Connector imports those vulnerabilities for reporting and action. You can view vulnerabilities via Connector by using the relevant filter:
Open the Vulcan Platform dashboard and navigate to the Vulnerabilities.
Click on the Search or filter vulnerabilities search box, start typing "Connector" or "Vulnerability source" or scroll to find these options and select one.
Locate Tenable.io on the vulnerability source/Connector list and click to filter results.
Click on any vulnerability to view further information.
Locating Tenable.io Host assets in the Vulcan Platform
To find all retrieved host assets from Tenable.io:
Open the Vulcan Cyber dashboard and navigate to Assets.
Click on the Hosts tab.
Click on the Search or filter websites input box and select Connector from the drop-down selection.
Locate the Tenable.io option to view all synced assets.
Automating actions on vulnerabilities detected by Tenable.io
Large environments quickly become unmanageable if constant manual attention and effort are necessary to remediate vulnerabilities. You can take advantage of the automation capabilities of Vulcan Cyber and the Tenable.io Connector.
Click here to learn how to create automation in the Vulcan Cyber Platform.
From Tenable.io to the Vulcan Platform - Data Mapping
The Vulcan Platform integrates with Tenable.io through API to pull relevant vulnerabilities and assets data and map it into the Vulcan Platform.
Asset Uniqueness criteria
hostnames / netbios_names / fqdns/ ipv4s
Asset OS Version
Asset Created date
Asset Last seen date
Asset Multiple mac addresses
Asset Tags - Vendor’s tags
Asset Tags - Additional
asset id + port.port + port.protocol + unique vulnerability id
Vulnerability instance uniqueness criteria
Vulnerability instance first seen
Vulnerability instance Last seen
Vulnerability instance status
Vulnerability instance port
Vulnerability instance protocol
Vulnerability instance packages
Unique vulnerability uniqueness criteria
Unique vulnerability title
cvss3_base_score / cvss_base_score
Unique vulnerability score
Unique vulnerability description
first_found, plugin.family, plugin.solution, plugin.id, plugin.vpr.score, plugin.cpe, plugin.cvss3_temporal_vector, plugin.publication_date, plugin.modification_date , plugin.cvss3_temporal_score
Unique vulnerability details
Unique vulnerability affected packages
plugin.cvss3_base_score / plugin.cvss_base_score
Unique vulnerability CVSS
Unique vulnerability CVE/S
Unique vulnerability CVSS attack vector
Solution uniqueness criteria
Tenable fix for plugin.name
Vulnerability status mapping
Vulnerability score mapping
Status update mechanisms
Every day, the Vulcan Platform syncs with the vendor's platform to receive updates on existing vulnerabilities and assets and to retrieve new ones (if any were added).
The table below describes how the status update mechanism works in the Tenable.io connector for the Tenable.io vulnerabilities and assets ingested into the Vulcan Platform.
Assets are ”terminated” / “deleted” if the connector indicates the asset is no longer relevant and can be archived.
Change of vulnerability instances status from "Vulnerable" to "Fixed"
Vulnerability status changes to "fixed" in Vulcan upon the status change to "fixed" on the vendor's side.
Note: Asset or vulnerability updates on the vendor side are reflected on the Vulcan Platform only when the next scheduled connector sync time is complete.
API Endpoints in use
API version: 1.0
Use in Vulcan
Generate assets report
Check assets report status
Get assets chunk
Generate vulnerabilities report
Check vulnerability report status
Get vulnerability chunk
This document provides a step-by-step guide on validating and comparing data between Vulcan and Tenable.
Goal: Validate the assets count between Tenable and Vulcan. Tenable’s hosts' count should match the Vulcan hosts' count.
On the left menu under "Explore," click on "Assets."
Click on the "Hosts" tab and ensure no filter is applied.
Got to Assets and filter by connector Tenable.io
Matching Unique Vulnerabilities
Goal: Compare the count of unique vulnerabilities between Tenable and Vulcan. The UNique Vulnerability count in tenable should match the one in Vulcan.
On the left menu under "Explore," click on "Findings."
Filter only by State: Active, Resurfaced, New.
Group by Plugin (unique vulnerability name in Vulcan).
Go to Vulnerabilities and filter by Tenbale connector.
Matching Vulnerability Instances
Goal: Match the vulnerability instances count between Tenable and Vulcan.
On Tenable's vulnerabilities view, vulnerability instances are counted under the column “Vuln count.”
This count should match the assets count under Vulcan’s unique vulnerabilities.
From the Assets view, click on a specific asset. In the vulnerability details, you should see the count of vulnerability instances (findings).
This count should match the vulnerability instances count under the single asset view in Tenable.