--- sourceDocument: Australia Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Tenable.sc integrations with the Vulnerability Response application # Tenable.sc integrations with the Vulnerability Response application {#ariaid-title1} Release version: Australia Updated January 30, 2025 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Tenable.sc integrations with the Vulnerability Response application The Tenable.sc integrations within the Vulnerability Response application in ServiceNow enable customers to import, manage, and respond to vulnerability data from Tenable.sc, an on-premises vulnerability management solution. Starting with Vulnerability Response version 20.0, the system indicates authentic agent-based scans with a true/false flag in the Discovered Items list, enhancing data reliability. Show full answer Show less These integrations support multi-source configurations, allowing multiple Tenable.io and Tenable.sc instances to be added and deployed across an environment. The integrations can be installed and configured via the Vulnerability Response Setup Assistant. A MID Server is required when Tenable.sc and the ServiceNow AI Platform instance are in different environments; if they are co-located, its use is optional. ## Key Integrations and Their Functions * **Tenable.sc Assets Integration:** Divided into Open Assets and Fixed Assets integrations, this avoids duplicate discovered items by importing vulnerability data categorized as either open (requiring remediation) or fixed (no longer vulnerable). It retrieves asset data, creates or updates Configuration Items (CIs), and applies query filters to selectively import relevant vulnerabilities. * **Tenable.sc Plugin Integration:** Retrieves and updates plugin data to ensure vulnerability identifiers are current, importing only active vulnerabilities. * **Tenable.sc Fixed Vulnerabilities Integration:** Retrieves fixed vulnerability data to update existing vulnerable items and optionally create new ones for fixed detections when enabled. This integration initiates the chained Open Vulnerabilities Integration upon successful completion. It excludes certain family IDs by default and runs on a schedule. * **Tenable.sc Open Vulnerabilities Integration:** Triggered by the Fixed Vulnerabilities Integration, it imports active vulnerabilities and updates or creates corresponding vulnerable items and CIs. It also excludes some family IDs by default. * **Tenable.sc Scan Credential Integration:** Imports scan credentials configured in Tenable.sc, populating them in ServiceNow to facilitate authenticated scan requests. This is scheduled weekly. * **Tenable.sc Backfill Vulnerabilities Integration:** Optionally imports open and fixed vulnerabilities from the past seven days to fill gaps missed during regular imports. It is inactive by default due to potential performance impacts. ## User Authentication User authentication for Tenable.sc integrations is supported via the ServiceNow AI Platform and requires Tenable.sc version 5.13 or higher. For earlier versions (5.12 and below), user authentication is mandatory. Token expiration during integration runs is handled automatically, with no required customer action. ## Practical Considerations * To optimize performance, schedule Fixed and Open Vulnerabilities Integrations during periods without active scans. * Use the Setup Assistant for installation and configuration of integrations. * Monitor integration run logs for token expiration messages, which are informational and do not indicate errors. The Tenable.sc integrations in the Vulnerability Response Integration with Tenable application. Starting with Vulnerability Response v20.0, if an asset is scanned by an agent, the "Agent exists" column in the Discovered Items list displays the value as "true." This indicates that the scan is authentic. ## List of Tenable.sc integrations {#tenable-sc-integrations-list__id_nvg_2ff_4qb} Multi-source is supported for all the Tenable.io and Tenable.sc integrations. You can add and deploy multiple instances of the following integrations across your environment from Setup Assistant in Vulnerability Response. You can also install and configure the Vulnerability Response Integration with Tenable application from Setup Assistant. * Tenable.sc is an on-premises integration that gives you the option to use a MID Server if the Tenable.sc product and your ServiceNow AI Platform instance are in the same environment. * If the Tenable.sc product and your ServiceNow AI Platform instance aren't in the same environment, you're required to use a MID Server. {#tenable-sc-integrations-list__ul_gbd_kff_4qb} {#tenable-sc-integrations-list__table_mcv_nyy_2mb__entry__2} | Integration | Description | |-|-| | Tenable.sc Assets Integration | To avoid creating duplicate discovered items with imported asset data, the Asset Integration of the Tenable.sc product is comprised of two integrations. The Tenable.sc Open Assets Integration : This integration imports vulnerability data about your assets that Tenable considers Cumulative (current), or Open. The vulnerable items (VIs) that are created in your instance with this imported asset data are considered open, that is, in the Open state. These vulnerable items require investigation and might need remediation. The Tenable.sc Fixed Assets Integration : This integration imports vulnerability data about your assets that Tenable considers Mitigated (no longer vulnerable) or Fixed. The vulnerable items for these assets transition from the Open state to the Closed/Fixed state in your instance, because the results of scans show they're no longer vulnerable. * Retrieves all asset data from the Tenable.sc product and processes it in your instance. * Creates unique CIs for unmatched assets, or updates existing CIs with the network partition identifier attribute for assets across your environment that share IP address. * Coordinates the REST message calls to the Assets API. * The output of this integration is discovered items. * The Tenable query filter that you select in the Setup Assistant also applies to the Tenable.sc Assets Integration. Only the assets with the vulnerabilities that match the conditions of the query filter are imported. {#tenable-sc-integrations-list__ul_nsd_jzy_2mb} | | Tenable.sc Plugin Integration | * Retrieves the plugin data from the Tenable.sc product. Retrieved data are based on the date that the plugins were last updated by a Tenable.sc integration run. * This import ensures that the Tenable.sc Identifiers (Ten IDs) are current and only active vulnerabilities are imported. * Coordinates the REST message calls to the Plugins API. * The output of this integration is third-party vulnerabilities. {#tenable-sc-integrations-list__ul_onk_233_3mb} | | Tenable.sc Fixed Vulnerabilities Integration | * Retrieves vulnerability data based on severity filters from the Tenable.sc product and processes it in your instance. Vulnerable items are created for detection records which are in the Open and Reopened states, because these records require remediation. Existing vulnerable items are updated by Vulnerability Response if detections are Fixed, but vulnerable items aren't created for Fixed detections by default, because Tenable considers Fixed vulnerabilities Mitigated. * When the flag Create vulnerable items for 'Fixed' vulnerability detections is activated in Setup Assistant, it creates VIs in the Fixed state so you have visibility into the detections that created them. As VIs are created for Fixed detections that don't exist in your instance, this might negatively impact your import performance. You may prefer to leave this feature deactivated so that Fixed detections only update the states of existing vulnerable items. * Creates unique CIs for unmatched assets, or updates existing CIs with the network partition identifier attribute for assets across your environment that share IP address. * Coordinates the REST message calls to the Vulnerabilities API. {#tenable-sc-integrations-list__ul_ekt_sbz_2mb} The output of this integration is Closed/Fixed vulnerable items (VIs). It also creates assets and third-party entries if they don't exist. This integration run is a scheduled run. It's a chained integration which means after a run is successfully completed, the Tenable.sc Open Vulnerabilities Integration described next is triggered. Note: By default, the family IDs 0 and 39 are excluded from this integration. | | Tenable.sc Open Vulnerabilities Integration | * This integration is triggered on successful completion of the Tenable.sc Fixed Vulnerabilities Integration. * Retrieves vulnerability data based on the query filters selected from the Tenable.sc product and processes it in your instance. * Creates corresponding vulnerable items for active vulnerabilities. * Creates unique CIs for unmatched assets, or updates existing CIs with the network partition identifier attribute for assets across your environment that share IP address. * Coordinates the REST message calls to the Vulnerabilities API. * The output of this integration is Update/Create new vulnerable items (VIs) if they don't exist. It also creates configuration items and third-party entries if they don't exist. {#tenable-sc-integrations-list__ul_qv3_k33_3mb} Note: By default, the family IDs 0 and 39 are excluded from this integration. | | Tenable.sc Scan Credential Integration | * This integration retrieves the scan credentials configured in Tenable.sc. * Coordinates the REST message calls to the Credentials API. * The output of this integration is scan credentials populated in table, \[sn_vul_tenable_scan_credential\]. * The imported credentials are used to access the scanner when scan requests are initiated from the ServiceNow AI Platform. * This integration is scheduled to run weekly. {#tenable-sc-integrations-list__ul_yvb_kv3_3nb} | | Tenable.sc Backfill Vulnerabilities Integration | * This backfill integration imports any open and fixed vulnerabilities that might have been missed during an import. * This integration imports both open and fixed vulnerabilities from the last seven days to update your detections and vulnerable items. * This integration might impact your performance. * This integration is inactive by default. * To update your vulnerability data and avoid potential performance problems, you might prefer to schedule the Tenable.sc Fixed Vulnerabilities and Open Vulnerabilities Integrations to run when no other scans are running. * The output of this integration is: * Closed/Fixed vulnerable items (VIs). It also creates assets and third-party entries if they don't exist. * to Update/Create new vulnerable items (VIs) if they don't exist. It also creates configuration items and third-party entries if they don't exist. {#tenable-sc-integrations-list__ul_ozd_n33_ppb} {#tenable-sc-integrations-list__ul_lyt_3g3_ppb} | [Table 1. Tenable.sc integrations] {#tenable-sc-integrations-list__table_mcv_nyy_2mb} ## User authentication and Tenable.sc {#tenable-sc-integrations-list__section_bqt_rff_4qb} User authentication is supported by your ServiceNow AI Platform® instance and version 5.13 of the Tenable.sc product. User authentication is required if you're using version 5.12 and earlier of the Tenable.sc product. When you select user authentication for the Tenable.sc integrations, tokens might expire and be replaced during integration runs. In the Notes column on the Vulnerability Integration Run record (VIN), the following message is displayed for a process when a token expires, Error: Token validation is failed. No action is required if this message is displayed. Expired tokens are automatically refreshed in the background and the message doesn't indicate a pause or error with the integration process. **Related concepts** * [Preparing for the Tenable Vulnerability Integration](https://www.servicenow.com/docs/0wI2yq2bwyrTWi731enjYw "Prepare for the ServiceNow Tenable Vulnerability integration by performing the following setup tasks.") **Related tasks** * [Install the Vulnerability Response Integration with Tenable application using Setup Assistant](https://www.servicenow.com/docs/i4DAYefeiEY69A5x9LnSpg "Before you run the ServiceNow Tenable Vulnerability Integration, you need to download the Vulnerability Response Integration with Tenable application from the ServiceNow Store and install and configure it using the Setup Assistant in the Vulnerability Response application.")