Tenable Vulnerability Management

The Tenable Vulnerability Management connector retrieves into OverView the assets of your Tenable Vulnerability Management cloud platform (formerly Tenable.io, hosted on cloud.tenable.com): their names (hostname, FQDN, NetBIOS), IP and MAC addresses, operating system, first and last seen dates and installed software, the vulnerabilities detected on them (plugin, severity, CVE, CVSS, EPSS and VPR scores, CISA KEV, status, first and last seen dates) and the Nessus Agents linked to them (name, status, version, platform, last connection).

This page covers the cloud platform. Tenable Security Center, installed on your own infrastructure, has its own connector and its own page.

Prerequisites

• A Tenable Vulnerability Management subscription
• An Administrator account to create the role, the dedicated user and its permission, and to generate its API keys

Procedure

Create a read-only role

A custom role grants the connector the two privileges it uses, and nothing that creates, launches or modifies anything.

1. Sign in with an Administrator account, go to Settings > Access Control, then open the Roles tab.
2. Click Add Role and enter a Name (e.g., OverView Connector).
3. In the left panel, click Vulnerability Management and enable the application with its toggle.
4. Select these privileges:
   • Explore: Read and Export (export data from the Assets and Findings tabs)
   • Sensors > Nessus Agent: Read (view the Nessus Agent data)
5. Keep the Read privilege on General Settings, License and My Account: Tenable requires it for every role.
6. Save the role.

Where custom roles are not used, the built-in Scan Manager role is the lowest one that covers both exports and Nessus Agents, but it also allows creating and launching scans and managing agents.

Create a dedicated user

A user has a single API key pair: generating a new pair replaces the previous one and stops the integrations that used it. A user dedicated to OverView keeps the connector independent from personal accounts and other integrations.

1. In Settings > Access Control, open the Users tab and click Create User.
2. Fill in:
   • Full Name (e.g., OverView Connector)
   • Username, in the name@domain format with a domain approved for your instance (e.g., overview-connector@example.com)
   • Password and Verify Password
   • Role: the role created above, or Scan Manager
3. In the Authentication section, select API Key (allows the user to generate API keys).
4. Save the user.

Grant access to all assets

The role defines what the user can do; the permissions define which assets it sees. Assets the user cannot view are left out of the import, without any error.

1. In Settings > Access Control, open the Permissions tab and click Create Permission.
2. Fill in:
   • Permission Name (e.g., OverView Connector)
   • Users: the dedicated user
   • Permissions: Can View
   • Objects: All Assets
3. Save the permission.

Give access to the agent groups

With a custom role, the user sees a Nessus Agent only if the agent belongs to at least one agent group the user has access to. Agents that belong to no group are visible to Administrators only.

1. In the left navigation, click Sensors, open the Nessus Agents tab, then select Agent Groups in the drop-down box.
2. For each agent group, click Edit and add the dedicated user in the user permissions of the group.
3. Save each group.

Generate the API keys

1. In Settings > Access Control > Users, click the name of the dedicated user.
2. In the API Keys section, click Generate API Keys, then Replace & Generate.
3. Copy the Access Key and the Secret Key before leaving the page.

The keys cannot be displayed again once the page is closed. If you lose them, generate a new pair: the previous keys are replaced and immediately stop working.

Required Permissions

The API keys inherit the role and the permissions of their user. The connector only reads data; it never creates, modifies or launches anything in Tenable Vulnerability Management.

Both exports also require Can View on the exported assets.

Without the Nessus Agent privilege (for instance with the Basic role), or for an agent outside the agent groups the user can access, the import still retrieves assets, software and vulnerabilities, and identifies the assets running a Nessus Agent, but without the status, version and last connection of the agents.

Verify the access

Run:

curl -H "X-ApiKeys: accessKey=ACCESS_KEY;secretKey=SECRET_KEY" \
     "https://cloud.tenable.com/scanners/null/agents?limit=1"

A 200 response with an agents list confirms the keys and the access to Nessus Agents. A 401 means the keys are invalid; a 403 means the role of the user does not allow reading agents.

Security Best Practices

• Use a dedicated user for the OverView integration rather than a personal account
• Grant the user the lowest role that covers the data to import
• Rotate the API keys regularly according to your organization's security policy: generating a new pair immediately revokes the previous one

Official Documentation

• Generate API Keys for Another User
• Roles and Privileges
• Manage Custom Roles
• Manage User Accounts
• Manage Permissions
• Tenable Vulnerability Management API Reference