Tenable Security Center

The Tenable Security Center connector retrieves into OverView the hosts scanned by your on-premises Tenable Security Center (formerly Tenable.sc): their network interfaces, operating system, hardware (manufacturer, model, serial number) and last logged-on user, their installed software and open ports, the vulnerabilities detected on them (plugin, severity, CVE, CVSS, EPSS and VPR scores, CISA KEV, status, first and last seen dates) and the results of compliance audits (CIS, DISA STIG and similar benchmarks, with passed and failed rules).

Installed software, hardware and the last logged-on user are reported by credentialed scans and Nessus Agents: hosts covered only by unauthenticated scans provide their network information and remotely detected vulnerabilities.

API access is the recommended method for this connector. Where it is not available (a segregated network, a version without API keys), OverView accepts CSV exports from Security Center, described in Alternative: import CSV exports.

Prerequisites

• Tenable Security Center 5.13 or later, the first version with API key authentication. The menu paths below are those of Security Center 6.x.
• An Administrator account to enable API key authentication, and the Security Manager account of the organization whose data you want to import, to create the dedicated user
• Network access from OverView to the Security Center web interface (HTTPS, port 443 by default)

Information to provide in OverView

Parameters

These parameters are optional. Leave them at their default value unless you have a specific reason to change them.

Procedure

Enable API key authentication

API keys are disabled until an administrator enables them. Without this step, the API Keys option does not appear in the user actions menu.

1. Sign in with an Administrator account and click System > Configuration.
2. Click the Security tile.
3. In Authentication Settings, enable Allow API Keys, then click Submit.

Create a dedicated user

Vulnerability data belongs to an organization. Administrator accounts do not belong to any organization and have no access to it, so the connector uses an organizational user.

1. Sign in with the Security Manager account of the organization and click Users > Users.
2. Click Add and fill in:
   • Username and Password (e.g., overview-connector)
   • Role: Security Analyst
   • Group: a group with access to every repository you want to import
   • User Must Change Password and Password Expiration: leave disabled, a blocked account cannot use its API keys
3. Click Submit.

The group, not the role, defines which data the user sees. In Users > Groups, right-click the group and click View: the Access section must list every repository to import in Repositories, with Viewable Hosts set to All Defined Ranges. A repository missing from the group is missing from the import.

Generate the API keys

1. In Users > Users, right-click the row of the dedicated user, then click API Keys > Generate API Key.
2. Confirm the generation.
3. In the Your API Key window, copy the Access Key and the Secret Key immediately.

The secret key cannot be displayed again once the window is closed. If you lose it, generate a new key pair: the previous keys are replaced and immediately stop working.

Configure the Connector in OverView

1. In OverView, go to Data Sources Settings > Sources.
2. Select Tenable Security Center and click Configure.
3. Fill in the API URL, Access Key and Secret Key, then click Save Configuration.

Required Permissions

The API keys inherit the role, organization and group of their user. The Security Analyst role is the one Tenable requires for its own API integrations (Splunk, IBM QRadar). The connector only reads data; it never creates, modifies or launches anything in Security Center.

Verify the access

From a machine that can reach Security Center, run:

curl -k -H "x-apikey: accesskey=ACCESS_KEY; secretkey=SECRET_KEY" \
     "https://securitycenter.example.com/rest/currentUser?fields=username,role,organization,group"

The response must show the dedicated user, a role other than Administrator, and the expected organization and group.

Security Best Practices

• Use a dedicated user for the OverView integration rather than a personal account
• Keep the user in a group limited to the repositories you want to import
• Rotate the API keys regularly according to your organization's security policy: generating a new pair immediately revokes the previous one

Alternative: import CSV exports

Where API access is not available, OverView imports the CSV files exported from the Vulnerabilities and Host Assets pages of Security Center. Produce them with an organizational user, whose group scopes the exported data exactly like the API, and repeat the export after each scan cycle.

Export vulnerabilities from Tenable Security Center

1. Click Analysis > Vulnerabilities and select the Vulnerability Detail List tool, so that each row is one vulnerability on one host.
2. Click Export > Export as CSV.
3. Select the columns to include, then click Submit.
4. Above 1,000 rows, Security Center asks for a report name and generates the file in the background: download it from Reporting > Report Results.

Export hosts from Tenable Security Center

1. Click Assets > Host Assets.
2. Click Export at the top of the table to download the CSV file.

Import into OverView

1. In OverView, go to Data Sources Settings > Sources.
2. Select Tenable Security Center and click Configure.
3. Choose the File Import mode, import your export files, then click Save Configuration.

Official Documentation

• Enable API Key Authentication
• Generate API Keys
• User Roles
• Export Vulnerability Data
• Tenable Security Center API Reference