---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management
Release :
- australia
ft:locale :
- en-US
ft:publication_title :
- Australia Security Management
ft:clusterId :
- security
bundleId :
- security
workflow :
- Technology
---
# Understanding the Tenable Vulnerability Integration
# Understanding the Tenable Vulnerability Integration {#ariaid-title1}
Release version: Australia
Updated March 12, 2026
 11 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Understanding the Tenable Vulnerability Integration
The Vulnerability Response Integration with Tenable application, developed by ServiceNow, enables customers to import vulnerability and asset data from Tenable.io, Tenable.sc, and Tenable.cs products into their ServiceNow AI Platform instance.
This integration helps prioritize and remediate vulnerabilities effectively by correlating third-party scanner data with your existing Configuration Management Database (CMDB) assets.
The application requires a separate subscription and is available via the ServiceNow Store.
It supports cloud-based (Tenable.io and Tenable.cs) and on-premises (Tenable.sc) deployments, with MID Server requirements when the Tenable.sc instance is external to your ServiceNow environment.
Show full answer Show less
## Key Features
* **Data Import and Mapping:** Vulnerabilities detected by Tenable scanners are imported and matched to configuration items (CIs) in your CMDB. If no match exists, unmatched CIs and vulnerable items are created and can be reconciled with the Identification and Reconciliation Engine (IRE).
* **Third-Party Vulnerability Entries:** Known as Plugins in Tenable, these entries are imported and linked to assets, with Common Platform Enumerations (CPEs) populated for easier identification.
* **CI Lookup Rules:** Automated rules leverage host data such as MAC address, FQDN, NetBIOS, and IP addresses to identify and associate assets to vulnerabilities. These rules are configurable and differ slightly among Tenable products.
* **Rescan and Remediation:** Customers can initiate rescans (remediation scans) on specific vulnerable items, remediation tasks, or third-party entries directly from ServiceNow to verify remediation status.
* **Auto-Close Stale Vulnerable Items:** A module is available to automatically close older vulnerable items no longer detected, reducing noise and improving asset reconciliation.
* **Asset Tagging:** Asset tags imported from Tenable.io enable organization and filtering of assets within ServiceNow, enhancing assignment and remediation task rules.
* **Data Retrieval Filters:** Settings enable control over the types and scope of imported data to tailor vulnerability management to your needs.
* **Vulnerability Priority Rating (VPR):** Tenable's VPR is imported and can be used as part of a default risk calculator in Vulnerability Response to prioritize vulnerabilities based on risk, asset importance, and business criticality.
* **Configuration Compliance Integration:** Tenable.io findings such as test results and policies can be imported into the Configuration Compliance application for enhanced configuration assessment.
## Roles and Permissions
Proper configuration and operation require specific roles:
* **admin:** Installs the integration and assigns roles.
* **snvul.vulnerabilityadmin:** Configures and manages the integration and Vulnerability Response application.
* **snvultenable.configureintegration:** Allows configuration of the Tenable integration.
* **snvultenable.readintegration:** Read-only access to Tenable integration data.
* **Vulnerability Response Group:** Provides read and remediation ownership roles for managing vulnerabilities.
## Practical Considerations for Customers
* Ensure the CMDB is properly maintained for effective matching of vulnerabilities to assets.
* Use CI lookup rules carefully; disable rather than delete rules to avoid loss of configuration.
* Enable and leverage asset tags to improve vulnerability assignment and remediation workflows.
* Schedule and monitor import jobs to keep vulnerability data current and actionable.
* Consider enabling the Tenable risk calculator to incorporate VPR into your risk scoring, noting potential impacts on data ingestion performance.
* Use the Auto-Close Stale Vulnerable Items feature to maintain a cleaner, more manageable vulnerability landscape.
* Before creating assignment or remediation task rules based on asset tags, run the Tenable.io Asset Integration to ensure all tags are imported.
## Installation and Configuration
The integration is installed from the ServiceNow Store and configured through the Vulnerability Response Setup Assistant, which guides the setup of the Tenable integrations and associated rules.
The Vulnerability Response Integration with Tenable application developed by ServiceNow engineering for the Tenable Vulnerability Integration uses data imported from the Tenable.io, Tenable.sc, and Tenable.cs products. This data helps you prioritize and remediate vulnerabilities for your assets. The application is available with a separate subscription from the ServiceNow® Store.
Note:
Starting with v14.9 of Configuration Compliance, the following terms have been renamed:{#tenableIntegration__entry__2}
| Terminology prior to v14.9 | Terminology v14.9 onwards |
|-|-|
| Test Result Group | Remediation Task |
| Group Rules | Remediation Task Rules |
| Policy | Test group |
[Table 1. Changes in terminology]
The Tenable Vulnerability Integration employs three Tenable integrations, Tenable.io, Tenable.sc and Tenable.cs, to import third-party scanner data about your assets and vulnerabilities. The Vulnerability Response Integration with Tenable application supports the Tenable.sc product starting with version 5.13 and Tenable.cs product starting with version 5.0.1.
* Tenable.io is a cloud-based enterprise integration.
* Tenable.sc is an on-premises integration that gives you the option to use a MID Server if the Tenable.sc product and your ServiceNow AI Platform instance are in the same environment.
* If the Tenable.sc product and your ServiceNow AI Platform instance aren't in the same environment, you're required to use a MID Server.
* Tenable.cs is a cloud-based enterprise integration.
{#tenableIntegration__ul_zxz_l1f_qnb}
The Vulnerability Response Integration with Tenable application is available on the ServiceNow Store
with a separate subscription.
For lists and descriptions of the integrations in the Tenable Vulnerability Integration, see [Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications](https://www.servicenow.com/docs/pFgitSRAaGtU0yWhnw9NbQ "The Tenable.io integrations in the Vulnerability Response Integration with Tenable with Tenable application are available for use with both the Vulnerability Response and Configuration Compliance applications.") and [Tenable.sc integrations with the Vulnerability Response application](https://www.servicenow.com/docs/8IwKcqHYfIgzv1s_Bf61Ew "The Tenable.sc integrations in the Vulnerability Response Integration with Tenable application.").
Figure 1. Tenable Vulnerability Integration
## Available versions for Australia {#tenableIntegration__section_fkf_kcx_gnb}
{#tenableIntegration__table_k3h_mcx_gnb__entry__2}
| Release version | Release notes |
|-|-|
| Vulnerability Response Integration with Tenable v3.13.1, v4.1, v5.0.1 | For compatibility information, see [KB0856498 Vulnerability Response Compatibility Matrix and Release Schema Changes](https://support.servicenow.com/kb_view.do?sysparm_article=KB0856498) |
[ ]
{#tenableIntegration__table_k3h_mcx_gnb}
## Terms and Key features of the integrations {#tenableIntegration__section_gt5_xfv_wmb}
Vulnerable items and vulnerabilities
: A vulnerable item is created in your ServiceNow AI Platform instance when:
* An imported vulnerability from a third-party scanner is matched to an existing asset (a configuration item in your CMDB). The Tenable product refers to these matches as vulnerabilities.
* An imported vulnerability from a third-party scanner isn't matched to an existing asset in your CMDB. In this case, an unmatched CI is also created along with a vulnerable item.
For unmatched CIs, you can also use the Identification and Reconciliation Engine (IRE)
to create CIs in two new classes. Use IRE when an existing CI can't be matched with a host. Otherwise, unmatched CIs are created in the Unmatched CI classes. For more information, see [Creating CIs using the Identification and Reconciliation engine](https://www.servicenow.com/docs/DbogQZg9imYEow6lfHeXHQ "You can create configuration items (CIs) in the Configuration Management Database (CMDB) using the Identification and Reconciliation engine (IRE) API. By using the IRE API to create CIs, you can prevent duplicate CIs from being created and you can reconcile CI attributes by allowing only authoritative data sources to write to CMDB.").
{#tenableIntegration__ul_nh4_kr3_3nb}
Third-party vulnerability entries and plugins
: Third-party vulnerability entries are imported from third-party scanners and listed in the Third-Party
VulnerabientryEntries table in your ServiceNow AI Platform instance. Starting with v24.0 of Vulnerability Response, the Softwares column in the Third-Party Vulnerability Entries table populates the Common Platform Enumerations (CPEs) associated with a third-party
entry. Third-party vulnerability entries from Tenable are ingested into Vulnerability Response and matched to existing assets listed in your CMDB. Tenable refers to third-party vulnerability entries as Plugins.
Configuration item (CI)
: Configuration items are the existing assets listed in your CMDB.
Discovered item
: Assets ingested from the Tenable asset import are matched to existing configuration items in your CMDB. Imported assets are updated.
If a match isn't found, a CI is created in the Unmatched CI class of the CMDB. If the CMDB CI Class Models plugin is enabled, the Identification and Reconciliation Engine (IRE) creates CIs using new classes. For more information, see [Creating CIs using the Identification and Reconciliation engine](https://www.servicenow.com/docs/DbogQZg9imYEow6lfHeXHQ "You can create configuration items (CIs) in the Configuration Management Database (CMDB) using the Identification and Reconciliation engine (IRE) API. By using the IRE API to create CIs, you can prevent duplicate CIs from being created and you can reconcile CI attributes by allowing only authoritative data sources to write to CMDB."). If the original, unmatched CI is reclassified, discovered item records are updated to reflect the state. Discovered items give you visibility into how assets are identified and
mapped to CIs in the CMDB.
CI lookup rules
: When data is imported from a third-party integration, Vulnerability Response automatically uses host (asset) data to search for matches in the Configuration Management Database (CMDB). CI lookup rules are used to identify CIs and add them to VI records when VITs are created to aid you with remediation.
Rescan and remediation scan
: You can initiate a targeted rescan command on a specific configuration item, remediation task, or third-party entry. Initiate the rescan directly from vulnerable item, remediation task, and third-party vulnerability entry records in your ServiceNow AI Platform instance. Tenable refers to this rescan as a remediation scan.
Automatically close older VIs
: With the Auto-Close Stale Vulnerable Items module in your ServiceNow AI Platform, you can clean up older, stale vulnerable items (VI)s not recently found by your third-party integrations. Moving these VIs to Closed helps you reduce the number of
active vulnerable items and remediation tasks and reconcile assets in your CMDB. You can use all the integrations with the Vulnerability Response Integration with Tenable to close stale VIs automatically.
Instance
: This term refers to a distinct occurrence of your ServiceNow AI Platform®
application.
Integration
: An integration is a product-specific reference to an integration, such as the Tenable.io Assets Integration, or the Tenable.sc Plugin Integration.
These are the separate integrations that belong to specific Tenable products in the Tenable
Vulnerability Integration in your instance.
Integration instance
: This term refers to the separate Tenable integrations listed by their Tenable.io and Tenable.sc products.
Deployment
: When an integration supports multi-source, a single, distinct integration existence is referred to as a deployment of your integration. The term is used to refer to the integration(s) and products across your
environment. For example, you might have multiple deployments of various integrations of the Tenable.io and Tenable.sc products in your environment.
The Tenable.io, Tenable.sc, and Tenable.cs integrations also include the following key features:
* Configuration assessment findings can be imported into the Configuration Compliance application with the Tenable.io product. These findings include test results, policies, configuration tests (controls), and citations with authoritative sources. For more information, see [Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications](https://www.servicenow.com/docs/pFgitSRAaGtU0yWhnw9NbQ "The Tenable.io integrations in the Vulnerability Response Integration with Tenable with Tenable application are available for use with both the Vulnerability Response and Configuration Compliance applications.") and [Exploring Configuration Compliance](https://www.servicenow.com/docs/mcVx8uzRm8~upAeQa8EAwg "Use test results obtained from third-party Secure Configuration Assessment (SCA) integrations to verify compliance with security or corporate policies. Identify, prioritize, and remediate non-compliant configuration items.").
* Use the Tenable Vulnerability Integration to create unique configuration items (CIs) that include different network partition identifiers for assets in your environment that share the same IP address. This helps you identify distinct assets across your environment. You can update the CIs on your existing discovered item, vulnerable item, and detection records to get more details about your vulnerabilities.
* You can schedule when you want the jobs to run for all the Tenable.io, Tenable.sc and Tenable.cs integrations. You can also execute scheduled jobs manually on-demand.
* For asset imports with Tenable.io, you can enable asset tags to organize and track the assets listed in your CMDB in the Tenable.io environment.
* The Tenable.io, Tenable.sc and Tenable.cs integrations permit you to configure CI Lookup Rules. These rules define how asset data from third-party sources are used to identify Configuration Items (CIs) in your ServiceNow AI Platform CMDB.
* The Tenable.io, Tenable.sc and Tenable.cs integrations permit you to set import filters on the vulnerabilities import so that you import only the vulnerabilities from Tenable that you want. For Tenable.io, you have the option to import Fixed vulnerabilities from Tenable with the vulnerabilities import.
* For Tenable.sc, you have the option to initiate rescans on-demand directly from a vulnerable item, remediation task, and third-party entry records in your ServiceNow AI Platform instance. If VIs have been transitioned to Closed/Fixed but aren't yet updated in your instance, you can verify vulnerabilities on specific configuration items have been remediated. See [Initiate rescan for the Tenable.sc integration](https://www.servicenow.com/docs/hNyKiki5GHzrugGXNfj3qw "Verify your vulnerable items have been remediated between scheduled scanning cycles by initiating rescans in the Tenable platform. You can initiate a rescan on-demand for vulnerable items for the Tenable.sc product from your ServiceNow AI Platform instance.").
{#tenableIntegration__ul_hs1_f3v_wmb}
The following sections list more details about the Tenable integrations.
## Required ServiceNow AI Platform roles {#tenableIntegration__section_plr_nfg_tlb}
The integration tasks require the following roles in your ServiceNow AI Platform
instance.
admin
: The system admin uses Setup Assistant to install the Vulnerability Response Integration with Tenable
application. If not assigned, the admin assigns the vulnerability admin
(sn_vul.vulnerability_admin) and other roles in Setup Assistant.
sn_vul.vulnerability_admin
: Once assigned, the vulnerability admin completes the configuration of the Tenable
integrations in Setup Assistant. This role has complete access to the Vulnerability Response
(VR) application and its records. The vulnerability admin configures all VR applications and
rules for installed third-party integrations.
sn_vul_tenable.configure_integration
: This role contains the sn_vul_tenable.read_integration granular role and users with this
role can configure the Vulnerability Response Integration with Tenable application.
sn_vul_tenable.read_integration
: Users with this roles can view (read) but not edit records of the Vulnerability Response Integration with Tenable application.
Vulnerability Response group
: By default, the Vulnerability Response group is available in Setup Assistant. Users
assigned to the Vulnerability Response group inherit the sn_vul.read_all and
sn_vul.remediation_owner roles automatically.
## Vulnerable items {#tenableIntegration__section_xzx_lgj_ppb}
Vulnerable items are grouped into remediation tasks according to remediation task rules and assigned for remediation based on your assignment rules. For more information, see [Vulnerability Response remediation tasks and remediation task rules overview](https://www.servicenow.com/docs/a7Z9DVk5024DYfVdfELq8A "Configure remediation tasks (VULs) to help analysts and remediation specialists organize vulnerable items (VI) and analyze them in bulk. The criteria by which remediation tasks are formed is configured so that you do not have to manually assign vulnerable items into remediation tasks. Using remediation tasks, you can monitor progress and drive the remediation process more efficiently.") and .
## Configuration item (CI) lookup rules {#tenableIntegration__section_otj_5hz_2mb}
CI Lookup Rules identify CIs and determine when to add them to a vulnerable item. For more information on how CI lookup rules work, see [CI Lookup Rules for identifying configuration items from Configuration Compliance third-party vulnerability integrations](https://www.servicenow.com/docs/kNHr72W2lpGyXDtlpjDSQg "When data is imported from a third-party integration, Configuration Compliance automatically uses host data to search for matches in the Configuration Management Database (CMDB). It does this using CI Lookup Rules. These rules are used to identify configuration items (CIs) and add them to the test result record to aid in remediation.").
Note:
Rules, once removed, can't be recovered. Rather than removing existing rules, disable them when creating ones.
The following Tenable.io lookup rules are shipped with the base system.
* MAC_ADDRESS
* FQDN
* NetBIOS
* HostName
* DNS
* IP
{#tenableIntegration__ul_l1g_r3z_2mb}
Note:
The Tenable.io CI lookup rules prioritize and populate the non-empty network interface values (FDQN, IPV4, and MacAddress) over the regular FDQN, IPV4, and MacAddress values for a discovered item. When these network interface values are empty, the regular FDQN, IPV4, and MacAddress values are populated for a discovered item.
The following Tenable.sc lookup rules are shipped with the base system.
* MAC_ADDRESS
* FQDN
* NetBIOS
* IP
{#tenableIntegration__ul_c1s_cjz_2mb}
Note:
Multiple values for ip_address, mac_address, fqdns and network_interfaces are used for an asset. All values are considered in CI lookup rules for matching. All values are used to create multiple network adapters using IRE.
The Tenable.cs lookup rule Cloud Resource Id is shipped with the base system.
For more information on how to configure the categorization of unmatched cloud resources into your preferred CI class, see [Updating CI class for unmatched cloud assets](https://www.servicenow.com/docs/r84JXzrzNzpRsbVHPyZQBQ "Starting with Vulnerability Response v20.0, you can categorize the unmatched cloud assets from Qualys, Rapid7 and Tenable scanners into Unclassed Hardware by using the sn_sec_cmn.unmatched_cloud_resource_enabled system property.").
## Properties to ignore IP addresses {#tenableIntegration__section_dsz_yxf_4nb}
In Tenable.io, there are two properties available if you want to ignore multiple IP addresses or multiple Mac addresses as part of your CI lookup rules:
ignoreIPAddress
: A list of IP addresses to be ignored for CI lookup and CI creation.
ignoreMacAddress
: A list of MAC addresses to be ignored for CI lookup or CI creation.
## Discovered items {#tenableIntegration__section_p24_2jz_2mb}
This module lists configuration items detected during import from the Tenable Vulnerable Item integrations and the Tenable Asset integrations.
Note:
The default filter for this list is set to Unmatched. You can view all discovered items from an import by removing the filter.
For more information on the Discovered Items module, see [Discovered Items](https://www.servicenow.com/docs/eCeTriYKp1Wkq_Ym33tczQ "Assets are automatically matched to configuration items (CIs) in the Configuration Management Database (CMDB) when they are imported using CI Lookup Rules. Discovered Items give you visibility into how asset identification is mapped to CIs in the CMDB.").
## Asset tags {#tenableIntegration__section_ddd_vjz_2mb}
Asset tags (also referred to as host tags) are used for organizing and tracking the assets in your organization. You can assign tags to your assets. Then, when launching the scans, you can select tags associated with the assets
you want to scan. The Asset Tags module enables you to download asset tag data from Tenable.io to your instance on a scheduled basis. Asset data that includes asset tags is pulled from Tenable.io and transformed using the [Tenable.io Asset Transform](https://www.servicenow.com/docs/kSAf2UasHqfzdFDGMgfU3g "After you identify the data to import, it’s retrieved from the Tenable product and processed through a set of data sources and transforms in your instance.") integration transformation maps.
All Asset tags are imported as part of the Tenable.io Asset integration. Asset tags are used for filtering in Vulnerability Response assignment rules and Remediation Task Rules. The tags are displayed in the Discovered Item form.
Note:
Run the Tenable.io Asset Integration prior to creating Vulnerability Response assignment rules or remediation task rules in the Vulnerability Response application so that all tags are available for these rules before vulnerable items are imported and grouped. Also note the following points about tags:
* Tag storage isn't case-sensitive. For example, if you create a San Diego tag, you can't also create a SAN DIEGO tag. San Diego and SAN DIEGO are considered to be the same asset tag by the system. Whichever tag is imported first is the tag that is stored and recognized going forward.
* Using asset tags as a Group Key in a remediation task rule may have unexpected results. Asset tags are intended for use only in the condition builder.
* Asset tags are controlled by the global system property sn_vul.import_asset_tags. This property is set to true by default. Disabling tags disables them across all ServiceNow AI Platform® instances.
{#tenableIntegration__ul_xfb_pkz_2mb}
## Data retrieval filters {#tenableIntegration__section_lyn_ylz_2mb}
Data retrieval settings help you determine specifically the type and scope of data you want to import from the Tenable application to your ServiceNow AI Platform® instance. For a list of the most commonly used settings, see [Data retrieval settings for the Tenable Vulnerability Integration](https://www.servicenow.com/docs/OjNARqOmvyDAYG4Yy1Y48g "The following data retrieval settings help you determine specifically the type and scope of data you want to import from the ServiceNow Tenable Vulnerability Integration to your ServiceNow AI Platform instance.").
## Vulnerability Priority Rating (VPR) {#tenableIntegration__section_hbz_mcx_wmb}
The Vulnerability Priority Rating (VPR) is an attribute from the Tenable product that is
imported and used with a new default risk calculator in Vulnerability Response. The Tenable
Risk Rule is installed with the Vulnerability Response Integration with Tenable application as part of the
Default Risk Calculator in the Vulnerability Calculators from Vulnerability Response.
This risk rule is inactive by default.
By enabling the Tenable risk calculator rule, the imported VPR values are used to calculate
the Risk Score for vulnerable items. The default weight distribution for this risk calculator:
VPR = 70%, Asset=15%, and Business Criticality=15%. Enabling this Tenable Risk Calculator rule
may impact your data ingestion performance. For more information about Vulnerability Response
calculators and the Tenable risk calculator rule, see [Vulnerability Response calculators and vulnerability calculator rules](https://www.servicenow.com/docs/3Hl03aogPFrru7chhJttaQ "Vulnerability calculators automate calculating initial values for the fields on vulnerable items. The condition for each calculator is evaluated in order, and the first matching calculator is used.").
## Installation and configuration {#tenableIntegration__section_yz3_vdg_4nb}
After you download the Vulnerability Response Integration with Tenable from the ServiceNow® Store, installation and configuration is supported by the Setup
Assistant in Vulnerability Response. See [Configuring Vulnerability Response using the Setup Assistant](https://www.servicenow.com/docs/8JZbr3YS3g9s8JFGaKtKpQ "Setup Assistant walks you through setting up Vulnerability Response and certain third-party integrations for your environment. Setup Assistant provides almost everything you need to install and set up your environment so that you can use Vulnerability Response.") for more
information.