[{"data":1,"prerenderedAt":642},["ShallowReactive",2],{"connector-en-tenable-vm":3},{"id":4,"title":5,"body":6,"category":632,"description":633,"extension":634,"meta":635,"navigation":636,"path":637,"seo":638,"sidebar":639,"stem":640,"updatedAt":632,"__hash__":641},"connectorsEn\u002Fen\u002Fconnectors\u002Ftenable-vm.md","Tenable Vulnerability Management",{"type":7,"value":8,"toc":616},"minimark",[9,18,21,26,44,48,53,56,149,156,160,163,237,241,244,292,296,299,324,328,363,366,370,373,464,470,476,480,483,518,536,540,562,566,612],[10,11,12,13,17],"p",{},"The Tenable Vulnerability Management connector retrieves into OverView the assets of your Tenable Vulnerability Management cloud platform (formerly Tenable.io, hosted on ",[14,15,16],"code",{},"cloud.tenable.com","): their names (hostname, FQDN, NetBIOS), IP and MAC addresses, operating system, first and last seen dates and installed software, the vulnerabilities detected on them (plugin, severity, CVE, CVSS, EPSS and VPR scores, CISA KEV, status, first and last seen dates) and the Nessus Agents linked to them (name, status, version, platform, last connection).",[10,19,20],{},"This page covers the cloud platform. Tenable Security Center, installed on your own infrastructure, has its own connector and its own page.",[22,23,25],"h2",{"id":24},"prerequisites","Prerequisites",[27,28,29,37],"ul",{},[30,31,32,33,36],"li",{},"A ",[34,35,5],"strong",{}," subscription",[30,38,39,40,43],{},"An ",[34,41,42],{},"Administrator"," account to create the role, the dedicated user and its permission, and to generate its API keys",[22,45,47],{"id":46},"procedure","Procedure",[49,50,52],"h3",{"id":51},"create-a-read-only-role","Create a read-only role",[10,54,55],{},"A custom role grants the connector the two privileges it uses, and nothing that creates, launches or modifies anything.",[57,58,59,77,92,99,129,146],"ol",{},[30,60,61,62,64,65,68,69,72,73,76],{},"Sign in with an ",[34,63,42],{}," account, go to ",[34,66,67],{},"Settings"," > ",[34,70,71],{},"Access Control",", then open the ",[34,74,75],{},"Roles"," tab.",[30,78,79,80,83,84,87,88,91],{},"Click ",[34,81,82],{},"Add Role"," and enter a ",[34,85,86],{},"Name"," (e.g., ",[14,89,90],{},"OverView Connector",").",[30,93,94,95,98],{},"In the left panel, click ",[34,96,97],{},"Vulnerability Management"," and enable the application with its toggle.",[30,100,101,102],{},"Select these privileges:\n",[27,103,104,118],{},[30,105,106,109,110,113,114,117],{},[34,107,108],{},"Explore",": ",[34,111,112],{},"Read"," and ",[34,115,116],{},"Export"," (export data from the Assets and Findings tabs)",[30,119,120,68,123,109,126,128],{},[34,121,122],{},"Sensors",[34,124,125],{},"Nessus Agent",[34,127,112],{}," (view the Nessus Agent data)",[30,130,131,132,134,135,138,139,113,142,145],{},"Keep the ",[34,133,112],{}," privilege on ",[34,136,137],{},"General Settings",", ",[34,140,141],{},"License",[34,143,144],{},"My Account",": Tenable requires it for every role.",[30,147,148],{},"Save the role.",[10,150,151,152,155],{},"Where custom roles are not used, the built-in ",[34,153,154],{},"Scan Manager"," role is the lowest one that covers both exports and Nessus Agents, but it also allows creating and launching scans and managing agents.",[49,157,159],{"id":158},"create-a-dedicated-user","Create a dedicated user",[10,161,162],{},"A user has a single API key pair: generating a new pair replaces the previous one and stops the integrations that used it. A user dedicated to OverView keeps the connector independent from personal accounts and other integrations.",[57,164,165,181,223,234],{},[30,166,167,168,68,170,172,173,176,177,180],{},"In ",[34,169,67],{},[34,171,71],{},", open the ",[34,174,175],{},"Users"," tab and click ",[34,178,179],{},"Create User",".",[30,182,183,184],{},"Fill in:\n",[27,185,186,194,207,215],{},[30,187,188,87,191,193],{},[34,189,190],{},"Full Name",[14,192,90],{},")",[30,195,196,199,200,203,204,193],{},[34,197,198],{},"Username",", in the ",[14,201,202],{},"name@domain"," format with a domain approved for your instance (e.g., ",[14,205,206],{},"overview-connector@example.com",[30,208,209,113,212],{},[34,210,211],{},"Password",[34,213,214],{},"Verify Password",[30,216,217,220,221],{},[34,218,219],{},"Role",": the role created above, or ",[34,222,154],{},[30,224,225,226,229,230,233],{},"In the ",[34,227,228],{},"Authentication"," section, select ",[34,231,232],{},"API Key"," (allows the user to generate API keys).",[30,235,236],{},"Save the user.",[49,238,240],{"id":239},"grant-access-to-all-assets","Grant access to all assets",[10,242,243],{},"The role defines what the user can do; the permissions define which assets it sees. Assets the user cannot view are left out of the import, without any error.",[57,245,246,258,289],{},[30,247,167,248,68,250,172,252,176,255,180],{},[34,249,67],{},[34,251,71],{},[34,253,254],{},"Permissions",[34,256,257],{},"Create Permission",[30,259,183,260],{},[27,261,262,269,274,281],{},[30,263,264,87,267,193],{},[34,265,266],{},"Permission Name",[14,268,90],{},[30,270,271,273],{},[34,272,175],{},": the dedicated user",[30,275,276,109,278],{},[34,277,254],{},[34,279,280],{},"Can View",[30,282,283,109,286],{},[34,284,285],{},"Objects",[34,287,288],{},"All Assets",[30,290,291],{},"Save the permission.",[49,293,295],{"id":294},"give-access-to-the-agent-groups","Give access to the agent groups",[10,297,298],{},"With a custom role, the user sees a Nessus Agent only if the agent belongs to at least one agent group the user has access to. Agents that belong to no group are visible to Administrators only.",[57,300,301,314,321],{},[30,302,303,304,172,306,309,310,313],{},"In the left navigation, click ",[34,305,122],{},[34,307,308],{},"Nessus Agents"," tab, then select ",[34,311,312],{},"Agent Groups"," in the drop-down box.",[30,315,316,317,320],{},"For each agent group, click ",[34,318,319],{},"Edit"," and add the dedicated user in the user permissions of the group.",[30,322,323],{},"Save each group.",[49,325,327],{"id":326},"generate-the-api-keys","Generate the API keys",[57,329,330,339,352],{},[30,331,167,332,68,334,68,336,338],{},[34,333,67],{},[34,335,71],{},[34,337,175],{},", click the name of the dedicated user.",[30,340,225,341,344,345,348,349,180],{},[34,342,343],{},"API Keys"," section, click ",[34,346,347],{},"Generate API Keys",", then ",[34,350,351],{},"Replace & Generate",[30,353,354,355,358,359,362],{},"Copy the ",[34,356,357],{},"Access Key"," and the ",[34,360,361],{},"Secret Key"," before leaving the page.",[10,364,365],{},"The keys cannot be displayed again once the page is closed. If you lose them, generate a new pair: the previous keys are replaced and immediately stop working.",[22,367,369],{"id":368},"required-permissions","Required Permissions",[10,371,372],{},"The API keys inherit the role and the permissions of their user. The connector only reads data; it never creates, modifies or launches anything in Tenable Vulnerability Management.",[374,375,376,395],"table",{},[377,378,379],"thead",{},[380,381,382,386,389,392],"tr",{},[383,384,385],"th",{},"Data retrieved",[383,387,388],{},"Endpoint",[383,390,391],{},"Custom role privilege",[383,393,394],{},"Built-in role",[396,397,398,422,442],"tbody",{},[380,399,400,404,409,419],{},[401,402,403],"td",{},"Assets and installed software",[401,405,406],{},[14,407,408],{},"POST \u002Fassets\u002Fv2\u002Fexport",[401,410,411,68,413,415,416,193],{},[34,412,108],{},[34,414,116],{}," (",[14,417,418],{},"VM.VM_EXPLORE.VM_EXPLORE.EXPORT",[401,420,421],{},"Basic",[380,423,424,427,432,440],{},[401,425,426],{},"Vulnerabilities",[401,428,429],{},[14,430,431],{},"POST \u002Fvulns\u002Fexport",[401,433,434,68,436,415,438,193],{},[34,435,108],{},[34,437,116],{},[14,439,418],{},[401,441,421],{},[380,443,444,446,451,462],{},[401,445,308],{},[401,447,448],{},[14,449,450],{},"GET \u002Fscanners\u002Fnull\u002Fagents",[401,452,453,68,455,68,457,415,459,193],{},[34,454,122],{},[34,456,125],{},[34,458,112],{},[14,460,461],{},"VM.VM_SENSOR.VM_AGENT.READ",[401,463,154],{},[10,465,466,467,469],{},"Both exports also require ",[34,468,280],{}," on the exported assets.",[10,471,472,473,475],{},"Without the Nessus Agent privilege (for instance with the ",[34,474,421],{}," role), or for an agent outside the agent groups the user can access, the import still retrieves assets, software and vulnerabilities, and identifies the assets running a Nessus Agent, but without the status, version and last connection of the agents.",[49,477,479],{"id":478},"verify-the-access","Verify the access",[10,481,482],{},"Run:",[484,485,490],"pre",{"className":486,"code":487,"language":488,"meta":489,"style":489},"language-bash shiki shiki-themes github-light github-dark","curl -H \"X-ApiKeys: accessKey=ACCESS_KEY;secretKey=SECRET_KEY\" \\\n     \"https:\u002F\u002Fcloud.tenable.com\u002Fscanners\u002Fnull\u002Fagents?limit=1\"\n","bash","",[14,491,492,512],{"__ignoreMap":489},[493,494,497,501,505,509],"span",{"class":495,"line":496},"line",1,[493,498,500],{"class":499},"sScJk","curl",[493,502,504],{"class":503},"sj4cs"," -H",[493,506,508],{"class":507},"sZZnC"," \"X-ApiKeys: accessKey=ACCESS_KEY;secretKey=SECRET_KEY\"",[493,510,511],{"class":503}," \\\n",[493,513,515],{"class":495,"line":514},2,[493,516,517],{"class":507},"     \"https:\u002F\u002Fcloud.tenable.com\u002Fscanners\u002Fnull\u002Fagents?limit=1\"\n",[10,519,32,520,523,524,527,528,531,532,535],{},[14,521,522],{},"200"," response with an ",[14,525,526],{},"agents"," list confirms the keys and the access to Nessus Agents. A ",[14,529,530],{},"401"," means the keys are invalid; a ",[14,533,534],{},"403"," means the role of the user does not allow reading agents.",[22,537,539],{"id":538},"security-best-practices","Security Best Practices",[27,541,542,549,556],{},[30,543,544,545,548],{},"Use a ",[34,546,547],{},"dedicated user"," for the OverView integration rather than a personal account",[30,550,551,552,555],{},"Grant the user the ",[34,553,554],{},"lowest role"," that covers the data to import",[30,557,558,561],{},[34,559,560],{},"Rotate the API keys"," regularly according to your organization's security policy: generating a new pair immediately revokes the previous one",[22,563,565],{"id":564},"official-documentation","Official Documentation",[27,567,568,577,584,591,598,605],{},[30,569,570],{},[571,572,576],"a",{"href":573,"rel":574},"https:\u002F\u002Fdocs.tenable.com\u002Fvulnerability-management\u002FContent\u002FSettings\u002Faccess-control\u002FGenerateUserAPIKey.htm",[575],"nofollow","Generate API Keys for Another User",[30,578,579],{},[571,580,583],{"href":581,"rel":582},"https:\u002F\u002Fdocs.tenable.com\u002Fvulnerability-management\u002FContent\u002FSettings\u002Faccess-control\u002FTenableRolePrivileges.htm",[575],"Roles and Privileges",[30,585,586],{},[571,587,590],{"href":588,"rel":589},"https:\u002F\u002Fdocs.tenable.com\u002Fvulnerability-management\u002FContent\u002FSettings\u002Faccess-control\u002Fmanage-custom-roles.htm",[575],"Manage Custom Roles",[30,592,593],{},[571,594,597],{"href":595,"rel":596},"https:\u002F\u002Fdocs.tenable.com\u002Fvulnerability-management\u002FContent\u002FSettings\u002Faccess-control\u002Fmanage-users.htm",[575],"Manage User Accounts",[30,599,600],{},[571,601,604],{"href":602,"rel":603},"https:\u002F\u002Fdocs.tenable.com\u002Fvulnerability-management\u002FContent\u002FSettings\u002Faccess-control\u002Fmanage-permissions.htm",[575],"Manage Permissions",[30,606,607],{},[571,608,611],{"href":609,"rel":610},"https:\u002F\u002Fdeveloper.tenable.com\u002Freference\u002Fnavigate",[575],"Tenable Vulnerability Management API Reference",[613,614,615],"style",{},"html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":489,"searchDepth":514,"depth":514,"links":617},[618,619,627,630,631],{"id":24,"depth":514,"text":25},{"id":46,"depth":514,"text":47,"children":620},[621,623,624,625,626],{"id":51,"depth":622,"text":52},3,{"id":158,"depth":622,"text":159},{"id":239,"depth":622,"text":240},{"id":294,"depth":622,"text":295},{"id":326,"depth":622,"text":327},{"id":368,"depth":514,"text":369,"children":628},[629],{"id":478,"depth":622,"text":479},{"id":538,"depth":514,"text":539},{"id":564,"depth":514,"text":565},null,"Integrate Tenable Vulnerability Management to retrieve your assets, their software, vulnerabilities and Nessus Agents","md",{},true,"\u002Fen\u002Fconnectors\u002Ftenable-vm",{"title":5,"description":633},{"label":5},"en\u002Fconnectors\u002Ftenable-vm","YbuLxJLMzoXFVYygJkzK5AT3hEo9BJ7PbONJOVYYs0A",1791561314832]