Search directly for CVE’s with Tenable.sc plugin-based integration

[JamesNicol_1]

Our VR integration is with tenable sc. The data comes in as tenable plugins (third party entries) We would like a way to search for CVEs without having to go through Tenable plugins (Third party Entries). This is really for reporting/ Performance Analytics purposes as our management understand CVEs, not third-party entries. They would like to see our exposure based on CVEs not third-party entries.

We have tried to use database views, but it always lists the TPE entries first and then the VITs for reach Third party entry. We are looking for a method to search for a CVE and it directly shows the VITs.

1. Which way is the best way to go about this?

[joe_harvey · Accepted solution]

Hi Jay,

Tenable doesn’t provide the direct link between a device and a specific CVE, only the Tenable ID. There is a table named Vulnerability CVE [sn_vul_m2m_entry_cve] that is used to link Tenable IDs to CVEs. You could join it to the VI table to filter by CVE but, it would provide bogus results.  As an example, Tenable ID TEN-193964 is linked to 15 different CVEs. A VI with that Tenable ID will be linked to all 15 of those CVEs even though only one of them may actually exist on the Configuration Item.

I hope that this helps,

--Joe

[JamesNicol_1]

Good morning, Joe

Thanks for the answer. Yes, your response answers my questions and reiterates my current understanding of this process.

[baydin]

Hi James,
can you shortly explain step by step how did you solve this Problem?
i can also not work with CVEs.
Thank you