Tenable Schema
graph LR
TenableAsset -- HAS_AWS_INFO --> TenableAssetAWS
TenableAsset -- HAS_AZURE_INFO --> TenableAssetAzure
TenableAsset -- HAS_GCP_INFO --> TenableAssetGCP
TenableAsset -- HAS_SOURCE --> TenableAssetSource
TenableAsset -- HAS_TAG --> TenableAssetTag
TenableAsset -- MEMBER_OF_NETWORK --> TenableNetwork
TenableAsset -- TAGGED --> TenableAssetTag
TenableFinding -- AFFECTS --> TenableAsset
TenableFinding -- DETECTED_BY --> TenablePlugin
TenableFinding -- PART_OF_SCAN --> TenableScan
TenablePlugin -- HAS_CVE --> TenableCve
TenableTenant -- RESOURCE --> TenableAsset
TenableTenant -- RESOURCE --> TenableAssetAWS
TenableTenant -- RESOURCE --> TenableAssetAzure
TenableTenant -- RESOURCE --> TenableAssetGCP
TenableTenant -- RESOURCE --> TenableAssetSource
TenableTenant -- RESOURCE --> TenableAssetTag
TenableTenant -- RESOURCE --> TenableCve
TenableTenant -- RESOURCE --> TenableFinding
TenableTenant -- RESOURCE --> TenableNetwork
TenableTenant -- RESOURCE --> TenablePlugin
TenableTenant -- RESOURCE --> TenableScanTenableAsset
An asset discovered and tracked by Tenable.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Tenable asset UUID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| acr_score | Asset Criticality Rating score. | |
| aes_score | Asset Exposure Score. | |
| aws_ec2_instance_id | Yes | AWS EC2 instance ID. |
| azure_vm_id | Yes | Azure virtual machine ID. |
| created_at_timestamps | Asset creation timestamps. | |
| first_scan_time | Timestamp of the first scan. | |
| first_seen_timestamps | Asset first-seen timestamps. | |
| fqdn | Yes | Primary fully qualified domain name. |
| fqdns | Fully qualified domain names for the asset. | |
| gcp_instance_id | Yes | GCP instance ID. |
| has_agent | Whether a Tenable agent is installed. | |
| has_plugin_results | Whether plugin scan results exist. | |
| hostnames | Hostnames for the asset. | |
| ipv4s | IPv4 addresses assigned to the asset. | |
| ipv6s | IPv6 addresses assigned to the asset. | |
| is_licensed | Whether the asset is licensed. | |
| is_public | Whether the asset has a public IP address. | |
| last_authenticated_scan_date | Timestamp of the most recent authenticated scan. | |
| last_licensed_scan_date | Timestamp of the most recent licensed scan. | |
| last_scan_id | ID of the most recent scan. | |
| last_scan_time | Timestamp of the most recent scan. | |
| last_seen_timestamps | Asset last-seen timestamps. | |
| mac_addresses | MAC addresses assigned to the asset. | |
| network_id | Tenable network UUID. | |
| operating_systems | Operating systems reported for the asset. | |
| serial_number | Yes | Hardware serial number. |
| system_types | Asset system type names. | |
| tenable_agent_days_since_active | Days since the Tenable agent was last active. | |
| types | Asset type names. | |
| updated_at_timestamps | Asset update timestamps. |
Relationships
(:TenableFinding)-[:AFFECTS]->(:TenableAsset): Links a Tenable finding to the affected asset.(:TenableAsset)-[:HAS_AWS_INFO]->(:TenableAssetAWS): Links a Tenable asset to its AWS details.(:TenableAsset)-[:HAS_AZURE_INFO]->(:TenableAssetAzure): Links a Tenable asset to its Azure details.(:TenableAsset)-[:HAS_GCP_INFO]->(:TenableAssetGCP): Links a Tenable asset to its GCP details.(:TenableAsset)-[:HAS_SOURCE]->(:TenableAssetSource): Links a Tenable asset to a source that observed it.(:TenableAsset)-[:HAS_TAG]->(:TenableAssetTag): Deprecated compatibility edge linking an asset to a tag until v1.0.0.(:TenableAsset)-[:MEMBER_OF_NETWORK]->(:TenableNetwork): Links a Tenable asset to its logical network.(:TenableTenant)-[:RESOURCE]->(:TenableAsset): Links a Tenable tenant to one of its assets.(:TenableAsset)-[:TAGGED]->(:TenableAssetTag): Links a Tenable asset to a tag applied to it.
TenableAssetAWS
AWS cloud details associated with a Tenable asset.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | AWS EC2 instance ID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| availability_zone | AWS availability zone. | |
| ec2_instance_ami_id | AMI ID used to launch the instance. | |
| ec2_instance_group_name | EC2 security group name. | |
| ec2_instance_state_name | EC2 instance state. | |
| ec2_instance_type | EC2 instance type. | |
| ec2_name | Value of the EC2 Name tag. | |
| owner_id | AWS account ID. | |
| region | AWS region. | |
| subnet_id | AWS subnet ID. | |
| vpc_id | AWS VPC ID. |
Relationships
(:TenableAsset)-[:HAS_AWS_INFO]->(:TenableAssetAWS): Links a Tenable asset to its AWS details.(:TenableAssetAWS)-[:IS_INSTANCE]->(:AWSEC2Instance): Links Tenable's AWS details to the EC2 instance they describe.(:TenableTenant)-[:RESOURCE]->(:TenableAssetAWS): Links a Tenable tenant to AWS details for an asset.
TenableAssetAzure
Azure cloud details associated with a Tenable asset.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Azure virtual machine ID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| resource_id | Yes | Azure Resource Manager resource ID. |
Relationships
(:TenableAsset)-[:HAS_AZURE_INFO]->(:TenableAssetAzure): Links a Tenable asset to its Azure details.(:TenableAssetAzure)-[:IS_INSTANCE]->(:AzureVirtualMachine): Links Tenable's Azure details to the virtual machine they describe.(:TenableTenant)-[:RESOURCE]->(:TenableAssetAzure): Links a Tenable tenant to Azure details for an asset.
TenableAssetGCP
GCP cloud details associated with a Tenable asset.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | GCP instance ID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| project_id | GCP project ID. | |
| zone | GCP zone. |
Relationships
(:TenableAsset)-[:HAS_GCP_INFO]->(:TenableAssetGCP): Links a Tenable asset to its GCP details.(:TenableAssetGCP)-[:IS_INSTANCE]->(:GCPInstance): Links Tenable's GCP details to the Compute Engine instance they describe.(:TenableTenant)-[:RESOURCE]->(:TenableAssetGCP): Links a Tenable tenant to GCP details for an asset.
TenableAssetSource
A data source that observed a Tenable asset.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Asset-scoped Tenable source identifier. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| name | Tenable source name. | |
| source_first_seen | Timestamp when the source first observed the asset. | |
| source_last_seen | Timestamp when the source most recently observed the asset. |
Relationships
(:TenableAsset)-[:HAS_SOURCE]->(:TenableAssetSource): Links a Tenable asset to a source that observed it.(:TenableTenant)-[:RESOURCE]->(:TenableAssetSource): Links a Tenable tenant to an asset observation source.
TenableAssetTag
A key-value tag applied to a Tenable asset.
Ontology Mapping: This node uses the ontology label
Tag.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Tenable tag UUID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| added_at | Timestamp when the tag was applied. | |
| added_by | User who applied the tag. | |
| key | Yes | Tag category or key. |
| tag_key | Deprecated mirror of key; removed in v1.0.0. | |
| tag_value | Deprecated mirror of value; removed in v1.0.0. | |
| value | Tag value. | |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:TenableAsset)-[:HAS_TAG]->(:TenableAssetTag): Deprecated compatibility edge linking an asset to a tag until v1.0.0.(:TenableTenant)-[:RESOURCE]->(:TenableAssetTag): Links a Tenable tenant to one of its asset tags.(:TenableAsset)-[:TAGGED]->(:TenableAssetTag): Links a Tenable asset to a tag applied to it.
TenableCve
A CVE named by a Tenable plugin. Tenable supplies no per-CVE data, so this node holds identity only; findings reach it through the plugin that detected them.
id is TNB|<tenant id>|<CVE ID>. The prefix stops the cve module, which
MERGEs on (:CVE {id}), from adopting these nodes. The tenant gives each
tenant its own nodes, so one tenant's cleanup cannot delete another's.
Ontology Mapping: This node uses the ontology label
CVE.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | TNB|<tenant id>|<CVE ID>, for example TNB|cloud.tenable.com|CVE-2024-1234. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cve_id | Yes | CVE identifier, for example CVE-2024-1234. |
| _ont_cve_id | Yes | Normalized field sourced from cve_id. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:TenablePlugin)-[:HAS_CVE]->(:TenableCve): Links a Tenable plugin to a CVE it checks for.(:TenableTenant)-[:RESOURCE]->(:TenableCve): Links a Tenable tenant to a CVE named by one of its plugins.
TenableFinding
A vulnerability finding detected by Tenable on an asset.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Tenable finding UUID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| asset_uuid | Yes | UUID of the affected Tenable asset. |
| cve_id | Yes | Deprecated. First CVE ID named by the finding's plugin. Every CVE is reachable over DETECTED_BY and then HAS_CVE. |
| first_found | Timestamp when the finding was first detected. | |
| has_cve | Deprecated. Whether the plugin names a CVE, as "true" or "false". | |
| indexed | Timestamp when Tenable indexed the finding. | |
| last_found | Timestamp when the finding was most recently detected. | |
| output | Raw scanner output. | |
| port | Network port associated with the finding. | |
| protocol | Network protocol associated with the finding. | |
| resurfaced_date | Timestamp when the finding resurfaced. | |
| service | Network service associated with the finding. | |
| severity | Finding severity name. | |
| severity_default_id | Default numeric finding severity. | |
| severity_id | Numeric finding severity. | |
| severity_modification_type | Type of severity adjustment applied. | |
| source | Scanner source that reported the finding. | |
| state | Finding state. | |
| time_taken_to_fix | Time taken to remediate the finding. |
Relationships
(:TenableFinding)-[:AFFECTS]->(:TenableAsset): Links a Tenable finding to the affected asset.(:TenableFinding)-[:DETECTED_BY]->(:TenablePlugin): Links a Tenable finding to the plugin that detected it.(:TenableFinding)-[:PART_OF_SCAN]->(:TenableScan): Links a Tenable finding to the scan that produced it.(:TenableTenant)-[:RESOURCE]->(:TenableFinding): Links a Tenable tenant to one of its findings.
TenableNetwork
A logical network that groups Tenable assets.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Tenable network UUID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| name | Tenable network name. |
Relationships
(:TenableAsset)-[:MEMBER_OF_NETWORK]->(:TenableNetwork): Links a Tenable asset to its logical network.(:TenableTenant)-[:RESOURCE]->(:TenableNetwork): Links a Tenable tenant to one of its logical networks.
TenablePlugin
A Tenable plugin that detected one or more findings.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Tenable plugin ID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| cve_list | CVE IDs the plugin checks for. To look up by CVE, use HAS_CVE. |
|
| cvss3_base_score | CVSS v3 base score. | |
| cvss3_temporal_score | CVSS v3 temporal score. | |
| cvss4_base_score | CVSS v4 base score. | |
| cvss_base_score | CVSS v2 base score. | |
| cvss_temporal_score | CVSS v2 temporal score. | |
| description | Detailed plugin description. | |
| epss_score | Exploit Prediction Scoring System score. | |
| exploit_available | Whether a known exploit is available. | |
| exploit_framework_metasploit | Whether a Metasploit module is available. | |
| exploitability_ease | Ease of exploitation. | |
| family | Plugin family name. | |
| family_id | Plugin family ID. | |
| has_patch | Whether a vendor patch is available. | |
| has_workaround | Whether a workaround is available. | |
| modification_date | Date the plugin was last modified. | |
| name | Plugin name. | |
| patch_publication_date | Date the patch was published. | |
| publication_date | Date the plugin was published. | |
| risk_factor | Qualitative plugin risk factor. | |
| solution | Recommended remediation. | |
| synopsis | Short summary of the plugin check. | |
| type | Plugin scan type. | |
| vendor_severity | Vendor-assigned severity. | |
| vendor_unpatched | Whether the vendor has not issued a patch. | |
| vpr_score | Tenable Vulnerability Priority Rating score. | |
| vuln_publication_date | Date the vulnerability was published. |
Relationships
(:TenableFinding)-[:DETECTED_BY]->(:TenablePlugin): Links a Tenable finding to the plugin that detected it.(:TenablePlugin)-[:HAS_CVE]->(:TenableCve): Links a Tenable plugin to a CVE it checks for.(:TenableTenant)-[:RESOURCE]->(:TenablePlugin): Links a Tenable tenant to one of its vulnerability plugins.
TenableScan
A Tenable scan that produced vulnerability findings.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Tenable scan UUID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| last_scan_target | Most recently scanned target. | |
| schedule_uuid | UUID of the scan schedule. | |
| started_at | Timestamp when the scan started. |
Relationships
(:TenableFinding)-[:PART_OF_SCAN]->(:TenableScan): Links a Tenable finding to the scan that produced it.(:TenableTenant)-[:RESOURCE]->(:TenableScan): Links a Tenable tenant to one of its scans.
TenableTenant
A Tenable tenant that scopes imported resources.
Ontology Mapping: This node uses the ontology label
Tenant.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Configured Tenable tenant ID or normalized base URL. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:TenableTenant)-[:RESOURCE]->(:TenableAsset): Links a Tenable tenant to one of its assets.(:TenableTenant)-[:RESOURCE]->(:TenableAssetAWS): Links a Tenable tenant to AWS details for an asset.(:TenableTenant)-[:RESOURCE]->(:TenableAssetAzure): Links a Tenable tenant to Azure details for an asset.(:TenableTenant)-[:RESOURCE]->(:TenableAssetGCP): Links a Tenable tenant to GCP details for an asset.(:TenableTenant)-[:RESOURCE]->(:TenableAssetSource): Links a Tenable tenant to an asset observation source.(:TenableTenant)-[:RESOURCE]->(:TenableAssetTag): Links a Tenable tenant to one of its asset tags.(:TenableTenant)-[:RESOURCE]->(:TenableCve): Links a Tenable tenant to a CVE named by one of its plugins.(:TenableTenant)-[:RESOURCE]->(:TenableFinding): Links a Tenable tenant to one of its findings.(:TenableTenant)-[:RESOURCE]->(:TenableNetwork): Links a Tenable tenant to one of its logical networks.(:TenableTenant)-[:RESOURCE]->(:TenablePlugin): Links a Tenable tenant to one of its vulnerability plugins.(:TenableTenant)-[:RESOURCE]->(:TenableScan): Links a Tenable tenant to one of its scans.