Two things to separate here.
The CSAF and CVRF channels in Vulnerability Solution Management are for vendor advisory feeds. Red Hat, SUSE, Microsoft (via MSRC), Cisco, Oracle, and others publish structured remediation data in those formats. Tenable is a scanner, not a vendor publisher, so it does not ship in CSAF or CVRF.
For scanner-sourced solutions from Tenable.sc, you do not need a separate "Import Solutions" job. Starting with Vulnerability Response v24.0.6, the Tenable.sc Plugin Integration ingests solutions at the Vulnerability / Third Party Entry (TPE) level as part of the regular vulnerability import. The lever is the system property sn_vul.populate_scanner_solutions. It defaults to false. Set it to true and Tenable solutions populate as Preferred when no vendor solution is available.
Precedence order for Preferred Solution, in order: Manual, then Vendor (MSRC, Red Hat, CSAF, CVRF), then Latest (controlled by sn_vul.latest_solutions), then Scanner Bulletin (Tenable, Qualys, MS TVM). Scanner solutions fill the gap for product families where you do not have a vendor advisory feed.
See the Vulnerability Solution Management documentation on docs.servicenow.com and the VR v24.0.6 release notes for the full mechanism. Confirm your VR version is >= v24.0.6 and validate the property values on your instance before flipping anything in production.
If this helped, mark it helpful or accept as solution so others hitting the same question can find it.
