Tenable.sc integrations with the Vulnerability Response application

To avoid creating duplicate discovered items with imported asset data, the Asset Integration of the Tenable.sc product is comprised of two integrations.

• The Tenable.sc Open Assets Integration

This integration imports vulnerability data about your assets that Tenable considers Cumulative (current), or Open. The vulnerable items (VIs) that are created in your instance with this imported asset data are considered open, that is, in the Open state. These vulnerable items require investigation and might need remediation.

• The Tenable.sc Fixed Assets Integration

This integration imports vulnerability data about your assets that Tenable considers Mitigated (no longer vulnerable) or Fixed. The vulnerable items for these assets transition from the Open state to the Closed/Fixed state in your instance, because the results of scans show they’re no longer vulnerable.

• Retrieves all asset data from the Tenable.sc product and processes it in your instance.
• Creates unique CIs for unmatched assets, or updates existing CIs with the network partition identifier attribute for assets across your environment that share IP address.
• Coordinates the REST message calls to the Assets API.
• The output of this integration is discovered items.
• The Tenable query filter that you select in the Setup Assistant also applies to the Tenable.sc Assets Integration. Only the assets with the vulnerabilities that match the conditions of the query filter are imported.

• Retrieves vulnerability data based on severity filters from the Tenable.sc product and processes it in your instance. Vulnerable items are created for detection records which are in the Open and Reopened states, because these records require remediation. Existing vulnerable items are updated by Vulnerability Response if detections are Fixed, but vulnerable items aren’t created for Fixed detections by default, because Tenable considers Fixed vulnerabilities Mitigated.
• When the flag Create vulnerable times for Fixed Vulnerability detections is activated in Setup Assistant, it creates VIs in the Fixed state so you have visibility into the detections that created them. As VIs are created for Fixed detections that don’t exist in your instance, this might negatively impact your import performance. You may prefer to leave this feature deactivated so that Fixed detections only update the states of existing vulnerable items.
• Creates unique CIs for unmatched assets, or updates existing CIs with the network partition identifier attribute for assets across your environment that share IP address.
• Coordinates the REST message calls to the Vulnerabilities API.

The output of this integration is Closed/Fixed vulnerable items (VIs). It also creates assets and third-party entries if they don't exist.

This integration run is a scheduled run. It’s a chained integration which means after a run is successfully completed, the Tenable.sc Open Vulnerabilities Integration described next is triggered.

Note: By default, the family IDs 0 and 39 are excluded from this integration.

• This integration is triggered on successful completion of the Tenable.sc Fixed Vulnerabilities Integration.
• Retrieves vulnerability data based on the query filters selected from the Tenable.sc product and processes it in your instance.
• Creates corresponding vulnerable items for active vulnerabilities.
• Creates unique CIs for unmatched assets, or updates existing CIs with the network partition identifier attribute for assets across your environment that share IP address.
• Coordinates the REST message calls to the Vulnerabilities API.
• The output of this integration is Update/Create new vulnerable items (VIs) if they don’t exist. It also creates configuration items and third-party entries if they don't exist.

Note: By default, the family IDs 0 and 39 are excluded from this integration.

• This backfill integration imports any open and fixed vulnerabilities that might have been missed during an import.
• This integration imports both open and fixed vulnerabilities from the last seven days to update your detections and vulnerable items.
• This integration might impact your performance.
• This integration is inactive by default.
• To update your vulnerability data and avoid potential performance problems, you might prefer to schedule the Tenable.sc Fixed Vulnerabilities and Open Vulnerabilities Integrations to run when no other scans are running.
• The output of this integration is:
• Closed/Fixed vulnerable items (VIs). It also creates assets and third-party entries if they don't exist.
• to Update/Create new vulnerable items (VIs) if they don’t exist. It also creates configuration items and third-party entries if they don't exist.