Has anyone integrated Vulnerability with Tenable Professional instead of Tenable Security Center?

[cbester]

The application on Store seems to only be available for Security Center, not for Professional

[Dave Smith1]

Not me.. but is there a "Contact Vendor" link in Store at all?

[jarodm]

I've done a custom integration to the Tenable Nessus (non-Security Center) REST API in the past. The API isn't difficult, but there are a lot of moving parts to contend with.

I know that Tom at http://www.secopspartners.com/ has done a few of them, and presumably other partners have solutions ready to go as well.

Jarod

[cbester]

Thanks, I've got most of it working now, glad to hear I'm not alone in this. 

[dan_tembe]

Hello, 

Hope this helps. 

I don't have Tenable Nessus but to extend to what Jarod mentioned. REST API to SNOW is fairly straightforward.

I just finished WAZUH/OSSEC integration using OSSEC's inbuilt "webhook" slack integration to route OSSEC/WAZUH alerts to ServiceNow Event Management then to Security Operations. I had to go this route since I wanted the inbuilt handling capabilities for this integration. 

Also, am working (about 75% done but is 100% operational now) on a python script to tail "alerts.json" file on the same server (OSSEC/WAZUH). 

The reason I am responding to your Nessus integration post, is if you have a log file or if Nessus Professional has a Slack or Webhook integration or has a alerts log file you can tail, you can use my code and edit it to fit your needs. At least you have the authentication (POST) and JSON map built. 

Here is the link - https://github.com/dtembe/OSSEC_WAZ_2SNOWEM

the file called "slack" is actually edited to route events to ServiceNOW EM & the other file is called ossec2snowem.py. Hopefully this gets you well on your way.

Hopefully you can share your edits and work too for rest of the community. 

Good Luck. 

Dan