Tenable.io

• Integration Points
• Tenable.io API Integration
• Configuration

Integration Points

Protocol	Logs Collected	Used For
Tenable.io API	Vulnerability scan data	Security and Compliance

Tenable.io API Integration

FortiSIEM can pull vulnerability scan data from Tenable.io Cloud Service via Tenable.io API.

Tenable.io scan data contains vulnerabilities found on a host. Each host vulnerability is converted into a separate FortiSIEM event with event type TenableIO-Vuln-Detected.

Configuration

• Configuring Tenable.io Cloud Service
• Configuring FortiSIEM

Configuring Tenable.io Cloud Service

Create an API Key to be used for FortiSIEM communication.

1. Login to your Tenable.io portal using your account.
2. Create API Key for use in FortiSIEM:
   1. For administrative user.
   2. Click Settings > User.
   3. In User table, click the name of the User you want to edit.
   4. Click the API Keys tab in the generate and click Generate.
   5. Click Save.
3. For regular user:
   1. Click My Account.
   2. Click the API Keys tab in the generate and click Generate.
   3. Click Save.

Configuring FortiSIEM

Define Tenable.io Credential in FortiSIEM

Complete these steps in the FortiSIEM UI by first logging in to the FortiSIEM Supervisor node.

1. Go to the ADMIN > Setup > Credentials tab.
2. In Step 1: Enter Credentials, click New to create a new credential:
   1. Follow the instructions in "Setting Credentials" in the User's Guide to create a new credential.
   2. Enter these settings in the Access Method Definition dialog box and click Save:

1. Settings	Description
   Name	Enter a name for the credential
   Device Type	Tenable Tenable.io
   Access Protocol	TenableIO API
   Pull Interval	Choose the Pull Interval (Default 60 minutes). Fortinet recommends 5 minutes for general cases.
   Account	Enter the Account obtained from Tenable.io portal (see Configuring Tenable.io Cloud Service).
   Access Key	Enter the Access Key obtained from Tenable.io portal (see Configuring Tenable.io Cloud Service).
   Secret Key	Enter the Secret Key obtained from Tenable.io portal (see Configuring Tenable.io Cloud Service).
   Organization	Choose the Organization if it is an MSP deployment and the same credential is to be used for multiple customers.
   Description	Description of the device.

Create IP Range to Credential Association and Test Connectivity

From the FortiSIEM Supervisor node, take the following steps (In ADMIN > Setup > Credentials).

1. In Step 2: Enter IP Range to Credential Associations, click New to create a mapping.
   1. Enter "cloud.tenable.com" in the IP/Host Name field.
   2. Select the name of the credential created in Define Tenable.io Credential in FortiSIEM from the Credentials drop-down list.
   3. Click Save.
2. Select the entry just created and click the Test drop-down list and select Test Connectivity without Ping. A pop up will appear and show the Test Connectivity results. After Test Connectivity succeeds, an entry will be created in ADMIN > Setup > Pull Events corresponding to this event pulling job. FortiSIEM will start to pull events from Tenable.io portal using the API.

To test for received Tenable.io events:

1. Go to ADMIN > Setup > Pull Events.
2. Select the Tenable.io entry and click Report.
3. The system will take you to the ANALYTICS tab and run a query to display the events received from Tenable.io in the last 15 minutes. You can modify the time interval to get more events.