TenableSCPluginIntegration:

[Lyzet Garrido]

Hi,

I am getting error below when running Vulnerability Response Integration with Tenable. My instance is on australia version

Error: Invalid response code received from TenableSCPluginIntegration: 403. Access denied. You do not have permission to access this resource. Verify your credentials or contact Tenable.sc support for assistance.

Thank you

[Tanushree Maiti]

Hi @Lyzet Garrido 

Validate it:

• If the Tenable.sc product and your ServiceNow AI Platform instance aren’t in the same environment, you’re required to use a MID Server. If you are using Mid server, ensure Mid server is up.

  Refer: Understanding the Tenable Vulnerability Integration 

• Obtain Tenable credentials.

  Verify you have any account names, passwords, and other service information required by your Tenable products so that you have access to them.

  Tenable.io requires Administrator access with a permission attribute greater than or equal to 64. Tenable.sc requires Security Analyst or Manager access.

  Note:

  Starting with v3.8 of Vulnerability Response Integration with Tenable, accessing Tenable.io no longer needs administrator privileges. A basic user with a permission attribute equal to 16 can also access the product.  Refer: Preparing for the Tenable Vulnerability Integration 
• Validate Data retrieval settings for the Tenable Vulnerability Integration 

[wosiek · Accepted solution]

Good morning, Lyzet.

Having just gone through this, I believe I can help you resolve.

Tenable recently introduced VPR 2.0 scoring, this update was pushed down at the beginning of July. If you review the log for the Tenable Plugins job, I'm sure you'll see that the integration runs began failing at or around July 4.

Please have your Tenable team review the appliance logs for database/disk full errors. If that's the case, they'll need to allocate more storage to these two directories -- /tmp and /var/tmp. Tenable recommends at least 4GB per each directory, we upped ours to 5GB.

The database/disk full errors should clear within the appliance shortly after those directories are resized.

You can try running a test after they've been resized, but chances are instead of the 403 error you'll now receive this: "Invalid response code received received from TenableSCPluginIntegration: 0"

Since the scoring changes resulted in a lot of plugins being updated there will be a lot of records ingested. On top of this, the job not running successfully for a period of time will add to the amount of data being imported. For reference, I finally got the job to run successfully yesterday and 270K records were ingested, of which 267K were updated. Bear in mind the job had not actually completed properly since July 4.

Because of this, you may need to add additional data sources and adjust MID Server ECC payload size settings to ensure the data load successfully completes.

The MID Server ECC payload size adjustment may only be required temporarily for that initial large import to get caught up.

Please let me know if you have any questions.

[Phil A]

We have had exactly the same in our organisation from the day we upgraded to Australia. Tenable jobs falling with the error ' Invalid response code received from TenableSCPluginIntegration: 403. Access denied' The credentials have been in use for 3 years without issue. The MID server did fail to upgrade to AUs initially (lack of disk space on E:) but that was resolved an its now up and validated. We even got a new api key from tenable and tried that, but get the same error. Have raised a NOW support case