Managing Tenable Scanner Imports

Anomali Security Analytics has tested asset report imports from the following Tenable scanners:

• Tenable.io

• Tenable.sc 5.9

About Tenable.io API Requests

Security Analytics uses the pytenable python library and uses the following methods to fetch the assets and the vulnerability information:

• tio.exports.assets(updated_at=ts)

• tio.exports.vulns(since=ts)

Security Analytics sends requests to the following Tenable endpoints to start the download, check the status if the request is ready, and to download in chunks:

• https://cloud.tenable.com/assets/export

• https://cloud.tenable.com/assets/export/{export_uuid}/status

• https://cloud.tenable.com/assets/export/{export_uuid}/chunks/{chunk_id}

• https://cloud.tenable.com/vulns/export

• https://cloud.tenable.com/vulns/export/{export_uuid}/status

• https://cloud.tenable.com/vulns/export/{export_uuid}/chunks/{chunk_id}

In addition, if you enable the option to share new asset information with Tenable.io, Security Analytics sends requests to the following endpoint:

• https://cloud.tenable.com/import/assets

In Security Analytics, when you configure the connection to Tenable.io, the Access Key you specify must be associated with a Tenable Administrator account. Per Tenable documentation, Administrator permissions are required to manage asset data exports and vulnerability data exports.

Create a Tenable.io Configuration

When you configure integration with the scanner from Security Analytics, you must specify scanner connection information, including authentication and authorization credentials.

To configure import from a Tenable.io scanner:

1. Click the Settings icon in the left navigation panel and select Security Analytics.

2. Click Assets.

3. Click the Scanner tab.

4. Click Create New Scanner.

5. Complete the configuration as described in the following table.

   Setting	Description
   Scanner	Select Tenable.io.
   Name	A meaningful configuration name.
   Access Key	Specify the Tenable instance access key. The Access Key you specify must be associated with a Tenable Administrator account. Per Tenable documentation, Administrator permissions are required to manage asset data exports and vulnerability data exports.
   Secret Key	Specify the Tenable instance secret key.
   Share new asset information with Tenable IO	Select this option to enable Security Analytics to be a source of asset data to Tenable IO. If selected, Security Analytics sends Tenable IO asset records that are from sources other than Tenable IO.

6. Click Next.

7. Specify the schedule as described in the following table.

   Setting	Description
   Sync Data	Specify the schedule for the sync job to run: Interval: Select every 1 day, 2 days, 7 days, 14 days, or 28 days. Start time: Type the hour (0-23) and minute (0-59). Notes: Security Analytics initiates API requests based on the schedule you set up here. It does not depend on the time scans are completed on the Tenable server. The time you specify for asset scanner sync jobs is UTC time with no time zone offset. For example, if you specify the start time for the sync job to be 12:00, it runs at 12:00 UTC, which is 05:00 in Los Angeles and 13:00 in Belfast.
   Scan events for the last	Specify the time range for returning asset information from the scans in the following format: n [Days | Hours | Minutes]

8. Click Save.

Create a Tenable.sc Configuration

When you configure integration with the scanner from Security Analytics, you must specify scanner connection information, including authentication and authorization credentials. For Tenable.sc, you must specify the fully-qualified domain name (FQDN) or IP address for the scanner.

To configure import from a Tenable.sc scanner:

1. Click the Settings icon in the left navigation panel and select Security Analytics.

2. Click Assets.

3. Click the Scanner tab.

4. Click Create New Scanner.

5. Complete the configuration as described in the following table.

   Setting	Description
   Scanner	Select Tenable.sc.
   Name	A meaningful configuration name.
   Host	Host name or FQDN of the scanner service.
   Access Key	Specify the Tenable instance access key.
   Secret Key	Specify the Tenable instance secret key.

6. Click Next.

7. Specify the schedule and the type of search as described in the following table.

   Setting	Description
   Sync Data	Specify the schedule for the sync job to run: Interval: Select every 1 day, 2 days, 7 days, 14 days, or 28 days. Start time: Type the hour (0-23) and minute (0-59). Note: The time you specify for asset scanner sync jobs is UTC time with no time zone offset. For example, if you specify the start time for the sync job to be 12:00, it runs at 12:00 UTC, which is 05:00 in Los Angeles and 13:00 in Belfast.
   Scan events for the last	Specify the time range for returning asset information from the scans in the following format: n [Days | Hours | Minutes]
   Search Type	Click in the Specify Queries search field to get a list of available queries defined in Tenable.sc. Select the queries you want to add. The selected queries are displayed in the field below. When new queries are created in the scanner service, click the Refresh icon () to get an updated list, and then add them to Security Analytics as needed. Note: The Severity = Minor setting from tenable.sc is mapped to Criticality = Low in Security Analytics.

8. Click Save.

Toggle Activation for a Scanner Configuration

In the Active column, click the checkbox to make the scanner configuration active or inactive.

Modify a Scanner Configuration

In the Actions column, click the Edit icon to modify a scanner configuration.

Clone a Scanner Configuration

In the Actions column, click the Clone icon to create an editable copy of a configuration.

Delete a Scanner Configuration

In the Actions column, click the Delete icon to delete a scanner configuration.

Preview a Scanner Configuration

In the Actions column, click the Preview icon to view the scanner configuration details and to see a detailed history of updates from the scanner. The history is a chronology of successful jobs and jobs that may have terminated due to an error.