Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

External Systems Configuration Guide

Tenable.io

Integration Points

Protocol Logs Collected Used For
Tenable.io API Vulnerability scan data Security and Compliance

Tenable.io API Integration

FortiSIEM can pull vulnerability scan data from Tenable.io Cloud Service via Tenable.io API.

Tenable.io scan data contains vulnerabilities found on a host. Each host vulnerability is converted into a separate FortiSIEM event with event type TenableIO-Vuln-Detected.

Configuration

Configuring Tenable.io Cloud Service

Create an API Key to be used for FortiSIEM communication.

  1. Login to your Tenable.io portal using your account.
  2. Create API Key for use in FortiSIEM:
    1. For administrative user.
    2. Click Settings > User.
    3. In User table, click the name of the User you want to edit.
    4. Click the API Keys tab in the generate and click Generate.
    5. Click Save.
  3. For regular user:
    1. Click My Account.
    2. Click the API Keys tab in the generate and click Generate.
    3. Click Save.
Configuring FortiSIEM
Define Tenable.io Credential in FortiSIEM

Complete these steps in the FortiSIEM UI by first logging in to the FortiSIEM Supervisor node.

  1. Go to the ADMIN > Setup > Credentials tab.
  2. In Step 1: Enter Credentials, click New to create a new credential:
    1. Follow the instructions in "Setting Credentials" in the User's Guide to create a new credential.
    2. Enter these settings in the Access Method Definition dialog box and click Save:
    1. Settings Description
      Name Enter a name for the credential
      Device Type Tenable Tenable.io
      Access Protocol TenableIO API
      Pull Interval Choose the Pull Interval (Default 60 minutes). Fortinet recommends 5 minutes for general cases.
      Account Enter the Account obtained from Tenable.io portal (see Configuring Tenable.io Cloud Service).
      Access Key Enter the Access Key obtained from Tenable.io portal (see Configuring Tenable.io Cloud Service).
      Secret Key Enter the Secret Key obtained from Tenable.io portal (see Configuring Tenable.io Cloud Service).
      Organization Choose the Organization if it is an MSP deployment and the same credential is to be used for multiple customers.
      Description Description of the device.
  • Create IP Range to Credential Association and Test Connectivity

    From the FortiSIEM Supervisor node, take the following steps (In ADMIN > Setup > Credentials).

    1. In Step 2: Enter IP Range to Credential Associations, click New to create a mapping.
      1. Enter "cloud.tenable.com" in the IP/Host Name field.
      2. Select the name of the credential created in Define Tenable.io Credential in FortiSIEM from the Credentials drop-down list.
      3. Click Save.
    2. Select the entry just created and click the Test drop-down list and select Test Connectivity without Ping. A pop up will appear and show the Test Connectivity results. After Test Connectivity succeeds, an entry will be created in ADMIN > Setup > Pull Events corresponding to this event pulling job. FortiSIEM will start to pull events from Tenable.io portal using the API.

    To test for received Tenable.io events:

    1. Go to ADMIN > Setup > Pull Events.
    2. Select the Tenable.io entry and click Report.
    3. The system will take you to the ANALYTICS tab and run a query to display the events received from Tenable.io in the last 15 minutes. You can modify the time interval to get more events.

    Tenable.io

    Integration Points

    Protocol Logs Collected Used For
    Tenable.io API Vulnerability scan data Security and Compliance

    Tenable.io API Integration

    FortiSIEM can pull vulnerability scan data from Tenable.io Cloud Service via Tenable.io API.

    Tenable.io scan data contains vulnerabilities found on a host. Each host vulnerability is converted into a separate FortiSIEM event with event type TenableIO-Vuln-Detected.

    Configuration

    Configuring Tenable.io Cloud Service

    Create an API Key to be used for FortiSIEM communication.

    1. Login to your Tenable.io portal using your account.
    2. Create API Key for use in FortiSIEM:
      1. For administrative user.
      2. Click Settings > User.
      3. In User table, click the name of the User you want to edit.
      4. Click the API Keys tab in the generate and click Generate.
      5. Click Save.
    3. For regular user:
      1. Click My Account.
      2. Click the API Keys tab in the generate and click Generate.
      3. Click Save.
    Configuring FortiSIEM
    Define Tenable.io Credential in FortiSIEM

    Complete these steps in the FortiSIEM UI by first logging in to the FortiSIEM Supervisor node.

    1. Go to the ADMIN > Setup > Credentials tab.
    2. In Step 1: Enter Credentials, click New to create a new credential:
      1. Follow the instructions in "Setting Credentials" in the User's Guide to create a new credential.
      2. Enter these settings in the Access Method Definition dialog box and click Save:
    1. Settings Description
      Name Enter a name for the credential
      Device Type Tenable Tenable.io
      Access Protocol TenableIO API
      Pull Interval Choose the Pull Interval (Default 60 minutes). Fortinet recommends 5 minutes for general cases.
      Account Enter the Account obtained from Tenable.io portal (see Configuring Tenable.io Cloud Service).
      Access Key Enter the Access Key obtained from Tenable.io portal (see Configuring Tenable.io Cloud Service).
      Secret Key Enter the Secret Key obtained from Tenable.io portal (see Configuring Tenable.io Cloud Service).
      Organization Choose the Organization if it is an MSP deployment and the same credential is to be used for multiple customers.
      Description Description of the device.
  • Create IP Range to Credential Association and Test Connectivity

    From the FortiSIEM Supervisor node, take the following steps (In ADMIN > Setup > Credentials).

    1. In Step 2: Enter IP Range to Credential Associations, click New to create a mapping.
      1. Enter "cloud.tenable.com" in the IP/Host Name field.
      2. Select the name of the credential created in Define Tenable.io Credential in FortiSIEM from the Credentials drop-down list.
      3. Click Save.
    2. Select the entry just created and click the Test drop-down list and select Test Connectivity without Ping. A pop up will appear and show the Test Connectivity results. After Test Connectivity succeeds, an entry will be created in ADMIN > Setup > Pull Events corresponding to this event pulling job. FortiSIEM will start to pull events from Tenable.io portal using the API.

    To test for received Tenable.io events:

    1. Go to ADMIN > Setup > Pull Events.
    2. Select the Tenable.io entry and click Report.
    3. The system will take you to the ANALYTICS tab and run a query to display the events received from Tenable.io in the last 15 minutes. You can modify the time interval to get more events.