Tenable-io v1.3.0

About the connector

Tenable.io Vulnerability Management provides the most accurate information about dynamic assets and vulnerabilities in ever-changing environments.

This document provides information about the Tenable.io connector, which facilitates automated interactions, with a Tenable.io server using FortiSOAR™ playbooks. Add the Tenable.io connector as a step in FortiSOAR™ playbooks and perform automated operations, such as retrieving a list along with details of all the completed scans for a specified time duration, retrieving information about assets that are associated with a specified scan, and retrieving information about the vulnerabilities associated with a particular asset.

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling scan data from Tenable.io. Currently, scan data ingested from Tenable.io is mapped to "scans" in FortiSOAR™. For more information, see the Data Ingestion Support section.

Version information

Connector Version: 1.3.0

Authored By: Fortinet

Certified: No

Release Notes for version 1.3.0

The following enhancements have been made to the Tenable.io connector in version 1.3.0:

• Added Data Ingestion Support.
• Added the following new actions and playbooks:
  • Submit Vulnerability Export Job
  • Get Vulnerability Export Status
  • Download Vulnerability Export Chunk
  • List Vulnerability Export Jobs
  • Cancel Vulnerability Export Job
  • Submit Asset Export Job
  • Get Asset Export Status
  • Download Asset Export Chunk
  • List Asset Export Jobs
  • Cancel Asset Export Job
• Removed the following actions:
  • Export Vulnerabilities
  • Export Assets
• Modified the 'Get Vulnerability Information' action to add the 'plugin id' to the output schema.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the following yum command as a root user to install connectors from an SSH session:
yum install cyops-connector-tenable-io

Prerequisites to configuring the connector

• You must have the URL of the Tenable.io server to which you will connect and perform the automated operations and credentials to access that server.
• You must have the access key and secret key that is configured for your account to access the Tenable.io server to which you will connect and perform the automated operations.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Tenable.io server.

Minimum Permissions Required

• Not Applicable

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the Tenable.io connector card. On the connector popup, click the Configurations tab to enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations from FortiSOAR™:

operation: List Scans

Input parameters

Output

The JSON output contains a list along with the details of all the completed scans retrieved from Tenable.io, based on the time duration you have specified.

The output contains the following populated JSON schema:
{
"starttime": "",
"uuid": "",
"enabled": "",
"legacy": "",
"read": "",
"owner": "",
"control": "",
"schedule_uuid": "",
"permissions": "",
"id": "",
"status": "",
"user_permissions": "",
"name": "",
"rrules": "",
"type": "",
"creation_date": "",
"last_modification_date": "",
"timezone": "",
"shared": ""
}

operation: Trigger Scan

Input parameters

Output

The JSON output contains the status of the trigger scan operation. The JSON output returns a Success message if the scan is triggered successfully or an Error message containing the reason for failure. The JSON output also contains the UUID of the triggered scan.

The output contains the following populated JSON schema:
{
"scan_uuid": ""
}

operation: List Scan's Assets

Input parameters

Output

The JSON output contains information about the asset(s) associated with a specific scan retrieved from Tenable.io, based on the scan ID you have specified.

The output contains the following populated JSON schema:
{
"uuid": "",
"mac": [],
"ip": [],
"time_start": "",
"fqdn": [],
"os": [],
"time_end": ""
}

operation: List Asset's Vulnerabilities

Input parameters

Output

The JSON output contains information about the vulnerabilities associated with a specific asset retrieved from Tenable.io, based on the asset UUID you have specified.

The output contains the following populated JSON schema:
{
"plugin_id": "",
"plugin_family": "",
"counts_by_severity": [
{
"value": "",
"count": ""
}
],
"count": "",
"severity": "",
"vulnerability_state": "",
"plugin_name": "",
"accepted_count": "",
"recasted_count": ""
}

operation: Get Vulnerability Information

Input parameters

Output

The JSON output contains information about the vulnerabilities associated with a specific plugin retrieved from Tenable.io, based on the plugin ID you have specified.

Output

The output contains the following populated JSON schema:
{
"info": {
"count": "",
"vuln_count": "",
"description": "",
"synopsis": "",
"solution": "",
"discovery": {
"seen_first": "",
"seen_last": ""
},
"severity": "",
"plugin_details": {
"name": "",
"type": "",
"family": "",
"version": "",
"severity": "",
"plugin_id": "",
"publication_date": "",
"modification_date": ""
},
"reference_information": [
{
"name": "",
"url": "",
"values": []
}
],
"risk_information": {
"risk_factor": "",
"cvss_vector": "",
"cvss_base_score": "",
"cvss_temporal_vector": "",
"cvss_temporal_score": "",
"cvss3_vector": "",
"cvss3_base_score": "",
"cvss3_temporal_vector": "",
"cvss3_temporal_score": "",
"stig_severity": ""
},
"see_also": [],
"vulnerability_information": {
"vulnerability_publication_date": "",
"exploited_by_malware": "",
"patch_publication_date": "",
"exploit_available": "",
"exploitability_ease": "",
"asset_inventory": "",
"default_account": "",
"exploited_by_nessus": "",
"in_the_news": "",
"malware": "",
"unsupported_by_vendor": "",
"cpe": "",
"exploit_frameworks": [
{
"name": ""
},
{
"name": "",
"exploits": [
{
"name": "",
"url": ""
}
]
}
]
},
"vpr": {
"score": "",
"drivers": {
"age_of_vuln": {
"lower_bound": "",
"upper_bound": ""
},
"exploit_code_maturity": "",
"cvss3_impact_score": "",
"cvss_impact_score_predicted": "",
"threat_intensity_last28": "",
"threat_recency": {
"lower_bound": "",
"upper_bound": ""
},
"threat_sources_last28": [],
"product_coverage": ""
},
"updated": ""
}
}
}

operation: Get Plugin Information

Input parameters

Output

The JSON output contains information about the specific plugin retrieved from Tenable.io, based on the plugin ID you have specified.

The output contains the following populated JSON schema:
{
"id": "",
"family_name": "",
"name": "",
"attributes": [
{
"attribute_name": "",
"attribute_value": ""
}
]
}

operation: Submit Vulnerability Export Job

Input parameters

Output

The output contains the following populated JSON schema:
{
"export_uuid": ""
}

operation: Get Vulnerability Export Status

Input parameters

Output

The output contains the following populated JSON schema:
{
"uuid": "",
"status": "",
"chunks_available": [],
"chunks_failed": [],
"chunks_cancelled": [],
"total_chunks": "",
"chunks_available_count": "",
"empty_chunks_count": "",
"finished_chunks": "",
"filters": {
"state": [],
"tags": {},
"since": "",
"first_found": "",
"last_found": "",
"last_fixed": "",
"first_seen": "",
"last_seen": "",
"indexed_at": ""
},
"num_assets_per_chunk": "",
"created": ""
}

operation: Download Vulnerability Export Chunk

Input parameters

Output

The output contains the following populated JSON schema:
{
"asset": {
"fqdn": "",
"hostname": "",
"uuid": "",
"ipv4": "",
"operating_system": [],
"network_id": "",
"tracked": ""
},
"output": "",
"plugin": {
"cve": [],
"cvss_base_score": "",
"cvss_temporal_score": "",
"cvss_temporal_vector": {
"exploitability": "",
"remediation_level": "",
"report_confidence": "",
"raw": ""
},
"cvss_vector": {
"access_complexity": "",
"access_vector": "",
"authentication": "",
"confidentiality_impact": "",
"integrity_impact": "",
"availability_impact": "",
"raw": ""
},
"description": "",
"family": "",
"family_id": "",
"has_patch": "",
"id": "",
"name": "",
"risk_factor": "",
"see_also": [],
"solution": "",
"synopsis": "",
"vpr": {
"score": "",
"drivers": {
"age_of_vuln": {
"lower_bound": "",
"upper_bound": ""
},
"exploit_code_maturity": "",
"cvss_impact_score_predicted": "",
"cvss3_impact_score": "",
"threat_intensity_last28": "",
"threat_sources_last28": [],
"product_coverage": ""
},
"updated": ""
}
},
"port": {
"port": "",
"protocol": ""
},
"scan": {
"completed_at": "",
"schedule_uuid": "",
"started_at": "",
"uuid": ""
},
"severity": "",
"severity_id": "",
"severity_default_id": "",
"severity_modification_type": "",
"first_found": "",
"last_found": "",
"indexed_at": "",
"state": ""
}

operation: List Vulnerability Export Jobs

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"exports": [
{
"uuid": "",
"status": "",
"total_chunks": "",
"chunks_available_count": "",
"empty_chunks_count": "",
"finished_chunks": "",
"filters": {
"state": [],
"tags": {
"tag.": []
},
"since": "",
"first_found": "",
"last_found": "",
"last_fixed": "",
"first_seen": "",
"last_seen": "",
"indexed_at": ""
},
"num_assets_per_chunk": "",
"created": ""
}
]
}

operation: Cancel Vulnerability Export Job

Input parameters

Output

The output contains the following populated JSON schema:
{
"status": ""
}

operation: Submit Asset Export Job

Input parameters

Output

The output contains the following populated JSON schema:
{
"export_uuid": ""
}

operation: Get Asset Export Status

Input parameters

Output

The output contains the following populated JSON schema:
{
"status": "",
"chunks_available": []
}

operation: Download Asset Export Chunk

Input parameters

Output

The output contains the following populated JSON schema:
{
"id": "",
"has_agent": "",
"has_plugin_results": "",
"created_at": "",
"terminated_at": "",
"terminated_by": "",
"updated_at": "",
"deleted_at": "",
"deleted_by": "",
"first_seen": "",
"last_seen": "",
"first_scan_time": "",
"last_scan_time": "",
"last_authenticated_scan_date": "",
"last_licensed_scan_date": "",
"last_scan_id": "",
"last_schedule_id": "",
"azure_vm_id": "",
"azure_resource_id": "",
"gcp_project_id": "",
"gcp_zone": "",
"gcp_instance_id": "",
"aws_ec2_instance_ami_id": "",
"aws_ec2_instance_id": "",
"agent_uuid": "",
"bios_uuid": "",
"aws_owner_id": "",
"aws_availability_zone": "",
"aws_region": "",
"aws_vpc_id": "",
"aws_ec2_instance_group_name": "",
"aws_ec2_instance_state_name": "",
"aws_ec2_instance_type": "",
"aws_subnet_id": "",
"aws_ec2_product_code": "",
"aws_ec2_name": "",
"mcafee_epo_guid": "",
"mcafee_epo_agent_guid": "",
"servicenow_sysid": "",
"bigfix_asset_id": "",
"agent_names": [],
"installed_software": [],
"ipv4s": [],
"ipv6s": [],
"fqdns": [],
"mac_addresses": [],
"netbios_names": [],
"operating_systems": [],
"system_types": [],
"hostnames": [],
"ssh_fingerprints": [],
"qualys_asset_ids": [],
"qualys_host_ids": [],
"manufacturer_tpm_ids": [],
"symantec_ep_hardware_keys": [],
"sources": [
{
"name": "",
"first_seen": "",
"last_seen": ""
}
],
"tags": [
{
"uuid": "",
"key": "",
"value": "",
"added_by": "",
"added_at": ""
}
],
"network_interfaces": [
{
"name": "",
"mac_address": [],
"ipv4": [],
"ipv6": [],
"fqdn": []
}
],
"acr_score": "",
"exposure_score": ""
}

operation: List Asset Export Jobs

Input parameters

None.

Output

The output contains the following populated JSON schema:
{
"exports": [
{
"uuid": "",
"status": "",
"total_chunks": "",
"filters": "",
"finished_chunks": "",
"num_assets_per_chunk": "",
"created": ""
}
]
}

operation: Cancel Asset Export Job

Input parameters

Output

The output contains the following populated JSON schema:
{
"status": ""
}

Included playbooks

The Sample - Tenable.io - 1.3.0 playbook collection comes bundled with the Tenable.io connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Tenable.io connector.

• Cancel Asset Export Job
• Cancel Vulnerability Export Job
• Download Asset Export Chunk
• Download Vulnerability Export Chunk
• Export Assets
• Export Vulnerabilities
• Get Asset Export Status
• Get Plugin Information
• Get Vulnerability Export Status
• Get Vulnerability Information
• List Asset Export Jobs
• List Asset's Vulnerabilities
• List Scan's Assets
• List Scans
• List Vulnerability Export Jobs
• Submit Asset Export Job
• Submit Vulnerability Export Job
• > Tenable.io > Create or Update Asset Records for Scan
• > Tenable.io > Create or Update Vulnerabilities Records for Asset
• > Tenable.io > Fetch Scans Details
• Tenable.io > Ingest
• Trigger Scan

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Data Ingestion Support

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling scan data from Tenable.io. Currently, scan data ingested from Tenable.io is mapped to "Scans" in FortiSOAR™. For more information on the Data Ingestion Wizard, see the "Connectors Guide" in the FortiSOAR™ product documentation.

Configure Data Ingestion

You can configure data ingestion using the “Data Ingestion Wizard” to seamlessly map the incoming Tenable.io "Scan data" to FortiSOAR™ "Scans".

The Data Ingestion Wizard enables you to configure the scheduled pulling of data from Tenable.io into FortiSOAR™. It also lets you pull some sample data from Tenable.io using which you can define the mapping of data between Tenable.io and FortiSOAR™. The mapping of common fields is generally already done by the Data Ingestion Wizard; users are mostly required to only map any custom fields that are added to the Tenable.io scan data.

Note: For the ingestion playbooks to work you must install and configure the 'SOAR Framework' and 'Vulnerability Management' Solution Packs on your FortiSOAR instance. For more information on solution packs see the respective solution pack document on the Content Hub Portal.

1. To begin configuring data ingestion, click Configure Data Ingestion on the Tenable.io connector’s "Configurations" page.
   Click Let’s Start by fetching some data, to open the “Fetch Sample Data” screen:
   
   Sample data is required to create a field mapping between Tenable.io data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.
2. On the Fetch Data screen, provide the configurations required to fetch scan data from Tenable.io.
   Users can pull scan data from Tenable.io by selecting the time duration for which they want to retrieve a list and the details of all the completed scans from Tenable.io from the Completion Time drop-down list. For example, if you choose Last 24 Hours, then the details of all the scans that were completed in the last 24 hours will be retrieved from the Tenable.io server.
   Select the Enable Bulk Ingest checkbox, if you want to create ingested records using the 'Ingest Bulk Feed' step instead of the 'Create Record' step in the ingestion playbooks. The advantage of using 'Enable Bulk Ingest' is a significant reduction in the execution time of the ingestion playbook. Therefore, it is recommended to select the 'Enable Bulk Ingest' checkbox for high-volume data ingestion. It is also recommended to schedule data ingestion to run during non-working hours.
   Known Issue: One known disadvantage of using the bulk ingest method is that it completely replaces all the fields of existing records; however, it keeps record correlations intact, i.e., the related records are not changed.
   The fetched data is used to create a mapping between the scan data from Tenable.io and FortiSOAR 'Scans'. Once you have completed specifying the configurations, click Fetch Data.
   
3. On the Field Mapping screen, map the fields of the ingested scans Tenable.io to the fields of a scan present in FortiSOAR™.
   To map a field, click the key in the sample data to add the “jinja” value of the field. For example, to map the uuid parameter of an ingested scan from Tenable.io to the Scan Reference ID parameter of a FortiSOAR™ scan, click the Scan Reference ID field and then click the uuid field to populate its keys:
   
   For more information on field mapping, see the Data Ingestion chapter in the "Connectors Guide" in the FortiSOAR™ product documentation. Once you have completed the mapping of fields, click Save Mapping & Continue.
4. (Optional) Use the Scheduling screen to configure schedule-based ingestion, i.e., specify the polling frequency to Tenable.io, so that the content gets pulled from the Tenable.io integration into FortiSOAR™.
   On the Scheduling screen, from the Do you want to schedule the ingestion? drop-down list, select Yes.
   In the “Configure Schedule Settings” section, specify the Cron expression for the schedule. For example, if you want to pull data from Tenable.io every month, click Monthly, and in the minute, hour, and day of month boxes enter 1, 0, and 1 respectively. This means that the scan data will be pulled from Tenable.io on the first day of every month at 12:01 AM:
   
   Once you have completed scheduling, click Save Settings & Continue.
5. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.