Tenable.io

• Integration points
• Tenable.io API Integration

Integration points

Protocol	Information collected	Used for
Tenable.io API	Vulnerability scan data	Security and Compliance

Tenable.io API Integration

FortiSIEM can pull vulnerability scan data from Tenable.io Cloud Service via Tenable.io API.

Tenable.io scan data contains vulnerabilities found on a host. Each host vulnerability is converted into a separate FortiSIEM event with event type TenableIO-Vuln-Detected.

Configuring Tenable.io Cloud Service

Create an API Key to be used for FortiSIEM communication.

1. Login to your Tenable.io portal using your account.
2. Create API Key for use in FortiSIEM:
   1. For administrative user.
   2. Click Settings > User.
   3. In User table, click the name of the User you want to edit.
   4. Click the API Keys tab in the generate and click Generate.
   5. Click Save.
3. For regular user:
   1. Click My Account.
   2. Click the API Keys tab in the generate and click Generate.
   3. Click Save.

Configuring FortiSIEM

Use the API Key and Secret in previous step to enable FortiSIEM access.

1. Login to FortiSIEM.
2. Go to ADMIN > Setup > Credential.
3. Click New to create a Tenable.io credential:
   1. Choose Device Type = Tenable.io Tenable (Vendor = Tenable, Model = Tenable.io).
   2. Choose Access Protocol = TenableIO API.
   3. Choose Pull Interval = 5 minutes.
   4. Choose Account, Access Key and Secret Key obtained from Tenable.io portal (see Configuring Tenable.io Cloud Service)
   5. Choose the Organization if it is an MSP deployment and the same credential is to be used for multiple customers
   6. Click Save.
4. Enter an IP range to Credential Association:
   1. Set Hostname = cloud.tenable.com
   2. Select the credential created in step 3.
   3. Click Save.
5. Select the entry in step 4 and click Test Connectivity.
6. After Test Connectivity succeeds, an entry will be created in ADMIN > Setup > Pull Events corresponding to this event pulling job. FortiSIEM will start to pull events from Tenable.io portal using the API.

To test for received Tenable.io events:

1. Go to ADMIN > Setup > Pull Events.
2. Select the Tenable.io entry and click Report.

The system will take you to the Analytics tab and run a query to display the events received from Tenable.io in the last 15 minutes. You can modify the time interval to get more events.