Find your people. Pick a challenge. Ship something real. The CreatorCon Hackathon is coming to the Community Pavilion for one epic night. Every skill level, every role welcome. Join us on May 5th and learn more here.

Tenable.io - rescan VIs

Patrik Z
Giga Guru

I'm trying to set up and test the manual rescan for a single VI using the Tenable.io integration with SNow. I have updated the SN w/ Tenable plugin to version 3.0.5 and activated the scheduled integration.

When I open the setup assistant for VR I see that there are 6 active jobs and 'Scan Credentials' is one of them: find_real_file.png

 

However when I open the Tenable.io setup I can see only the original 4 jobs that I can actually configure using the setup assistant:

find_real_file.png

So I tried to manually initiate the scan using the UI button on the VI form I can see multiple CIs in the list:

find_real_file.png

But when I search for the particular CI, I don't get any results:

find_real_file.png

 

I've read the product documentation for the rescan but I guess I am missing something. Can anybody help me understand this functionality at least a little so that I can properly test it, please?

Thanks for your help.

1 ACCEPTED SOLUTION

What happens when you go to Discovered Items.  Select a Discovered Item that you know is active in your network.  and Select the "Rescan" UI action on the top right.  The select a Credential to use for the Scan(these are not CIs - they are credentials to use for the scan) - Then your "Rescan UI action will be selectable).

 

find_real_file.png

View solution in original post

10 REPLIES 10

john_gibbons
ServiceNow Employee

When you initiate a rescan from a VI/Remediation Task, the system already knows the CI(s).  What you need to provide are the credentials to use for the CIs that are associated to the VI/Remediation Task.  Select a credential and submit - Then click on the "Scan Request" Link:

find_real_file.png

I see but what I forgot to mention is that I can see a list of CIs but the one I try to initiate the rescan on is not found in the list.

I try to initiate the rescan on a VI but the CI is not available in the rescan form and I get a list of CIs that feel pretty random instead. I thought the rescan initiated on a VI would give me one specific CI.

I would understand a list of CIs if I tried to rescan on a VG.

Sorry if that's too confusing, I'm trying to wrap my head around it.

Does the CI have a IP associated with it?

Yes, it does.

And when I run the Rescan I get an error message saying: "Error: Template UUID not found while creating request body for scan endpoint. Trigger Tenable.io Template Integration to populate the UUID"

But I have triggered it already although neither the Template integration nor the Scan Credentials integration have imported anything. I have also tried to set up some scan templates directly in Tenable an run the integration job again but still no result.