Tenable Integration - scheduled job

kris29 · ‎03-03-2022

Hi folks,

I have two questions about VR Tenable integration. The screenshot is from PDI.

1. Can someone explain me the difference between Tenable.io and Tenable.sc?
2. Which scheduled job should I keep active to import daily data from Tenable to SN?

Chris McDevitt · ‎11-04-2022

Hi,

There is a "hierarchy" to vulnerabilities.

At the top of the hierarchy is the CWE. The authoritative source for CWE is mitre.org, so we grab it from the source.

Then comes the CVE (which points to a CWE) and the authoritative source again is mitre.org, so we grab it from the source.

Then comes the Tenable Plugins (Points to the CVE). Tenable custom vulnerability definitions. So we grab that next.

Tenable Asset is a way to pull what Tenable knows about your environment. More about this in a minute.

For whatever reason, this is the way the Tenable API works: Pull the Fix vulnerabilities, then pull the open vulnerabilities. More about this in a minute.

The backfill job is complicated to explain, but the way Tenable works makes this necessary.

Tenable scan credentials are necessary if you wish to conduct rescans via ServiceNow.

A Vulnerable Item is made up of a Vulnerability + a Configuration Item (i.e. an Asset).

Pulling in the Assets matches or creates a Configuration Item

The incoming vulnerabilities are combined with the CI's to creat the VIT.

The Vulnerability part of the VIT points to 1 or more CVE, which points to one or more CWE.

View solution in original post

Saurav Bhardwa2 · ‎05-01-2024

Thanks for replying @Chris McDevitt . I just checked the status of "NIST National Vulnerability Database Integration - API (CVE only)" Integration. Those all are failing from the recent upgrade that we did Tenable plugin to "Vulnerability Response Integration with Tenable" plugin which is configured by SNOW.

I am receiving the token error but I am not able to find where we are storing the API key info in SNOW, Please check the snip below

Martin Dewit · ‎05-02-2024

Sounds similar to this issue where you might be using the deprecated v1 API: https://www.servicenow.com/community/secops-forum/nist-national-vulnerability-database-integration-a...

Chris McDevitt · ‎05-02-2024

Hi, as @Martin Dewit pointed out you will need to ensure that you are using the latest version of the NVD integration from the store.
Now here is the crazy part, for whatever reason, sometime the API key created by NVD does not work! IDK... you just need to creat a new API key.

Hemaxiben Mistr · ‎05-07-2024

Hi Chris,

When I followed ur steps , it created so many knowledge articles and emails for CWE data.

Do u know this is a default behavior?

Chris McDevitt · ‎05-07-2024

Hi,

Yes. The integration will populate the Vulnerabilities Knowledge Base: