Tenable.io - rescan VIs

Patrik Z
Giga Guru

I'm trying to set up and test the manual rescan for a single VI using the Tenable.io integration with SNow. I have updated the SN w/ Tenable plugin to version 3.0.5 and activated the scheduled integration.

When I open the setup assistant for VR I see that there are 6 active jobs and 'Scan Credentials' is one of them: find_real_file.png

 

However when I open the Tenable.io setup I can see only the original 4 jobs that I can actually configure using the setup assistant:

find_real_file.png

So I tried to manually initiate the scan using the UI button on the VI form I can see multiple CIs in the list:

find_real_file.png

But when I search for the particular CI, I don't get any results:

find_real_file.png

 

I've read the product documentation for the rescan but I guess I am missing something. Can anybody help me understand this functionality at least a little so that I can properly test it, please?

Thanks for your help.

1 ACCEPTED SOLUTION

What happens when you go to Discovered Items.  Select a Discovered Item that you know is active in your network.  and Select the "Rescan" UI action on the top right.  The select a Credential to use for the Scan(these are not CIs - they are credentials to use for the scan) - Then your "Rescan UI action will be selectable).

 

find_real_file.png

View solution in original post

10 REPLIES 10

john_gibbons
ServiceNow Employee
ServiceNow Employee

When you initiate a rescan from a VI/Remediation Task, the system already knows the CI(s).  What you need to provide are the credentials to use for the CIs that are associated to the VI/Remediation Task.  Select a credential and submit - Then click on the "Scan Request" Link:

find_real_file.png

I see but what I forgot to mention is that I can see a list of CIs but the one I try to initiate the rescan on is not found in the list.

I try to initiate the rescan on a VI but the CI is not available in the rescan form and I get a list of CIs that feel pretty random instead. I thought the rescan initiated on a VI would give me one specific CI.

I would understand a list of CIs if I tried to rescan on a VG.

Sorry if that's too confusing, I'm trying to wrap my head around it.

Does the CI have a IP associated with it?

Yes, it does.

And when I run the Rescan I get an error message saying: "Error: Template UUID not found while creating request body for scan endpoint. Trigger Tenable.io Template Integration to populate the UUID"

But I have triggered it already although neither the Template integration nor the Scan Credentials integration have imported anything. I have also tried to set up some scan templates directly in Tenable an run the integration job again but still no result.