Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application

  • Release version: Xanadu
  • Updated January 30, 2025
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Tenable.cs integrations with the Vulnerability Response and Container Vulnerability Response application

    The Tenable.cs integrations enhance vulnerability management within ServiceNow's Vulnerability Response and Container Vulnerability Response applications. These integrations facilitate automated ingestion and processing of container and host vulnerability data from Tenable.cs, a cloud-based enterprise product, directly into your ServiceNow instance.

    Show full answer Show less

    Starting from version 20.0 of Vulnerability Response, the system indicates authentic agent-scanned assets with an "Agent exists" column marked as "true" in the Discovered Items list, improving scan verification.

    Key Features

    • Multi-source support: Allows multiple Tenable.io, Tenable.sc, and Tenable.cs integrations to be deployed and managed simultaneously via the Vulnerability Response Setup Assistant.
    • Integration types for Tenable.cs:
      • Cloud Container Assets Integration: Retrieves container asset data, creates or updates configuration items (CIs) like container images and repositories, coordinating REST API calls to the Asset API.
      • Open Cloud Container Vulnerabilities Integration: Runs after the container assets integration, fetching container vulnerabilities filtered by severity, creating or updating CIs for vulnerabilities and related items such as CVEs and image findings in an open state.
      • Fixed Cloud Container Vulnerabilities Integration: Triggered after the open container vulnerabilities integration, it processes fixed vulnerabilities similarly but creates image findings in a closed state.
      • Open Cloud Host Vulnerabilities Integration: Retrieves host vulnerability data, creates or updates CIs and vulnerability detections in an open state, including CVEs and third-party entries.
      • Fixed Cloud Host Vulnerabilities Integration: Executes after the open host vulnerabilities integration, handling fixed vulnerabilities and creating detections in a closed state.
    • User authentication: Supported on ServiceNow AI Platform and Tenable.sc version 5.13 and above. For Tenable.sc versions 5.12 or earlier, user authentication is required. Token expiration during integrations is automatically handled without affecting process continuity, with token refreshes logged in Vulnerability Integration Run records.

    Practical Benefits for ServiceNow Customers

    • Automates the import and synchronization of vulnerability and asset data from Tenable.cs to ServiceNow, improving accuracy and timeliness of vulnerability tracking.
    • Enables detailed visibility into container and host vulnerabilities with state management (open/closed) for vulnerability detections.
    • Supports multi-instance and multi-source deployments, allowing flexible integration across diverse environments.
    • Simplifies authentication management with automatic token refreshes, reducing manual intervention.

    The Tenable.cs integrations in the Vulnerability Response Integration with Tenable application are available in the Vulnerability Response and Container Vulnerability Response applications.

    Starting with v20.0 Vulnerability Response, if an asset is scanned by an agent, the "Agent exists" column in the Discovered Items list displays "true," indicating that the scan is authentic.

    List of Tenable.cs integrations

    Multi-source is supported for all the Tenable.io, Tenable.sc, and Tenable.cs integrations. You can add and deploy multiple instances of the following integrations across your environment from Setup Assistant in Vulnerability Response. You can also install and configure the Vulnerability Response Integration with Tenable application from Setup Assistant.

    Tenable.cs is a cloud-based enterprise integration. See the following table for the names and descriptions of the supported integrations for the Tenable.cs product.

    Table 1. Tenable.cs integrations
    Integration Description
    Tenable.cs Cloud Container Assets Integration
    • Retrieves all container asset data from the Tenable.cs product and processes it in your instance.
    • Creates unique CIs for unmatched assets, or updates existing CIs. Coordinates the REST message calls to the Asset API.

    The output of this integration is Discovered Container Images, Docker Images, and Container Repositories.
    Tenable.cs Open Cloud Container Vulnerabilities Integration When activated, this integration runs automatically after the container assets integration is successfully completed as part of a chained integration run.
    • Retrieves container vulnerability data based on the severity filters from the Tenable.cs product and processes it in your instance.
    • Creates unique CIs for unmatched assets, or updates existing CIs.
    • Coordinates the REST message calls to the Vulnerabilities API.

    The output of this integration is New/Reopenedcontainer vulnerable items (CVIs). If they don't exist, it also creates discovered container images, docker images, container repositories, image findings, third-party entries, and Common Vulnerabilities and Exposures (CVE).
    Tenable.cs Fixed Cloud Container Vulnerabilities Integration This integration is triggered on successful completion of the Tenable.cs Open Cloud Container Vulnerabilities Integration.
    • Retrieves container vulnerability data based on the severity filters from the Tenable.cs product and processes it in your instance.
    • Creates unique CIs for unmatched assets, or updates existing CIs
    • Coordinates the REST message calls to the Vulnerabilities API.

    The output of this integration is New/Reopened container vulnerable items (CVIs). If they don't exist, it also creates discover container images, docker images, container repositories, image findings, third-party entries, and CVEs. Image findings are created in closed state.
    Tenable.cs Open Cloud Host Vulnerabilities Integration
    • Retrieves vulnerability data based on the severity filters from the Tenable.cs product and processes it in your instance.
    • Creates unique CIs for unmatched assets, or updates existing CIs.
    • Coordinates the REST message calls to the Vulnerabilities API.

    The output of this integration is New/Reopened vulnerable items (VIs). If they don't exist, it also creates configuration items, third-party entries, and CVEs. Vulnerability Detections are created in open state.
    Tenable.cs Fixed Cloud Host Vulnerabilities Integration This integration is triggered on successful completion of the Tenable.cs Open Cloud Host Vulnerabilities Integration.
    • Retrieves vulnerability data based on the severity filters from the Tenable.cs product and processes it in your instance.
    • Creates unique CIs for unmatched assets, or updates existing CIs.
    • Coordinates the REST message calls to the Vulnerabilities API.

    The output of this integration is close vulnerable items (VIs). If they don't exist, it also creates configuration items, third-party entries, and CVEs. Vulnerability Detections are created in closed state.

    User authentication and Tenable.sc

    User authentication is supported by your ServiceNow AI Platform® instance and version 5.13 of the Tenable.sc product. User authentication is required if you’re using version 5.12 and earlier of the Tenable.sc product.

    When you select user authentication for the Tenable.sc integrations, tokens might expire and be replaced during integration runs. In the Notes column on the Vulnerability Integration Run record (VIN), the following message is displayed for a process when a token expires, Error: Token validation is failed. If this message is displayed, no action is required. Expired tokens are automatically refreshed in the background and the message doesn’t indicate a pause or error with the integration process.