Tenable.sc integration - reference data updates

AliceS · ‎07-04-2025

Hi All,

We have Tenable.sc integrated with ServiceNow using the ServiceNow integration application. I'm having trouble when the reference data in Tenable is updated but those updates are not received by ServiceNow.

I'll illustrate with an example:

By viewing Tenable I can see that Tenable plugin 156057 was first published on 12 Dec 2021 and the Changelog shows it was updated on 1st May 2023 as follows:

CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C")
Exploit attributes ("Exploit available" set to "True". "Exploit available" set to "True". "Exploit available" set to "True". "Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available")

In ServiceNow I have TEN-156057, first created on 25 Sept 2022 (that tallies with our go live date), but the fields listed in the changelog have different values, ones that would be appropriate if the vulnerability had not been exploited.

My deduction is that updates to this reference data is either not being fed through from Tenable or not being picked up by ServiceNow.

Can anyone help me understand how to fix please?

Shivam Sarawagi · ‎07-08-2025

Hi,

I recommend turning on the integration instance parameter, as mentioned below. This would pull all the plugins from Tenable weekly to ensure everything is up to date.

vuln_comp	Vulnerability Comprehensive	When enabled, pulls all vulnerabilities weekly (every Sunday).

AliceS · ‎07-11-2025

Great call. That parameter is disabled at the moment. As soon as I've a suitable instance free I'll give it at test. Thank you @Shivam Sarawagi !

AliceS · ‎09-12-2025

It's taken me a while but we've tested now. Seems to have worked for many third party records including 156057, the example above. But some haven't updated, example is 241959 which had an update on 28th August.

Which job picks this flag up? @Shivam Sarawagi ..or anyone else!

Shivam Sarawagi · ‎09-17-2025

This flag is being utilized by the Tenable.io plugin integration/Tenable.sc plugin integration. If you see the condition here, based on the flag, we will reset the start date on the integration record once a week to pull everything.