Tenable
Purpose
Ingests Tenable Vulnerability Management assets, vulnerability findings, plugins, scans, and CVEs into SubImage. Tenable CVEs are enriched with NVD, EPSS, and CISA KEV metadata after each sync.
tip
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
Required Fields
| Field | Secret? | Description |
|---|---|---|
tenable_access_key |
Yes | Tenable Vulnerability Management access key |
tenable_secret_key |
Yes | Tenable Vulnerability Management secret key |
Optional Fields
| Field | Secret? | Description |
|---|---|---|
tenable_url |
No | Tenable API base URL; defaults to https://cloud.tenable.com |
tenable_tenant_id |
No | Stable identifier for the Tenable tenant in the graph; defaults to the API host |
tenable_findings_lookback_days |
No | Days of findings, by last seen time, that each sync exports; defaults to 180 |
Setup Steps
- In Tenable Vulnerability Management, create or pick a user for SubImage. Give it the Basic role, or a custom role with the
VM.VM_EXPLORE.VM_EXPLORE.EXPORTprivilege. - Grant that user Can View access to the assets SubImage should import. Administrators can export every asset without it.
- Sign in as that user and open Settings → My Account → API Keys, then select Generate. Tenable only shows the secret key once. Generating new keys invalidates the old pair.
- In SubImage, fill in
tenable_access_keyandtenable_secret_key, then save the module.
Notes
- The sync is read-only. It uses the Tenable asset and vulnerability export APIs.
- Each sync requests open, reopened, and fixed findings last seen within the lookback window. Findings that fall outside the window are removed from the graph.
- A large tenant can take several minutes for Tenable to prepare an export. SubImage waits up to 30 minutes per export.
Troubleshooting
- 401 Unauthorized: the API keys are wrong or were regenerated. Generate new keys and update the module.
- 403 Forbidden: the user lacks the export privilege. Grant the Basic role or
VM.VM_EXPLORE.VM_EXPLORE.EXPORT. - Missing assets or findings: the user lacks Can View access to those assets.