--- sourceDocument: Brazil Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/security-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Understanding the Tenable Vulnerability Integration # Understanding the Tenable Vulnerability Integration {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 11 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Understanding the Tenable Vulnerability Integration The Vulnerability Response Integration with Tenable is a ServiceNow application designed to import and process vulnerability data from Tenable.io, Tenable.sc, and Tenable.cs products. This integration helps you prioritize and remediate vulnerabilities on your assets by matching imported vulnerabilities to your Configuration Management Database (CMDB) assets or creating new unmatched configuration items (CIs) when no matches exist. The application is available through a separate subscription from the ServiceNow Store and supports both cloud-based (Tenable.io, Tenable.cs) and on-premises (Tenable.sc) deployments. Show full answer Show less ## Key Features * **Multi-product Support:** Integrates vulnerability data from Tenable.io (cloud), Tenable.sc (on-premises), and Tenable.cs (cloud) with version compatibility details. * **Vulnerable Item Creation:** Automatically creates vulnerable items in your ServiceNow instance by matching third-party scan data to existing CIs or creating unmatched CIs using the Identification and Reconciliation Engine (IRE). * **Third-Party Vulnerability Entries:** Imports vulnerability entries (referred to as Plugins by Tenable) and associates them with assets in your CMDB, including Common Platform Enumerations (CPEs) for software identification. * **CI Lookup Rules:** Uses configurable rules based on attributes such as MAC address, FQDN, IP address, and others to identify and link imported data to CIs, improving accuracy in vulnerability tracking. * **Rescan and Remediation Scans:** Enables targeted rescans directly from vulnerable item, remediation task, or third-party vulnerability records to verify remediation status. * **Auto-Close Stale Vulnerable Items:** Automatically closes older, inactive vulnerable items to reduce clutter and maintain CMDB accuracy. * **Asset Tags:** Supports importing and managing asset tags from Tenable.io to organize and filter assets during scans and in assignment or remediation task rules. * **Data Retrieval Filters:** Allows configuration of import scopes and filters to control which vulnerabilities and assets are imported from Tenable products. * **Vulnerability Priority Rating (VPR):** Integrates Tenable's VPR metric into ServiceNow's risk scoring to enhance vulnerability prioritization through a dedicated risk calculator rule. * **Scheduled and On-Demand Jobs:** Provides flexibility to schedule data import jobs or run them manually on demand for all supported Tenable integrations. ## Configuration and Roles * **Installation:** The integration is installed via the ServiceNow Store and configured using the Vulnerability Response Setup Assistant. * **Required Roles:** Includes system admin, vulnerability admin, and specific granular roles for configuring or reading the integration, ensuring proper access control. * **CI Class Management:** Supports the creation and reclassification of CIs for unmatched assets, improving data integrity in the CMDB. * **Best Practices:** Advises disabling rather than removing CI lookup rules to maintain system integrity and recommends running the Tenable.io Asset Integration before creating assignment or remediation task rules. ## Benefits for ServiceNow Customers * Streamlines the ingestion and management of vulnerability data from multiple Tenable products into ServiceNow's Vulnerability Response application. * Enhances visibility and accuracy by matching vulnerabilities to existing assets or creating new CIs when necessary. * Improves remediation workflows with targeted rescans and automated stale item closure, reducing manual effort and increasing data relevancy. * Enables better asset organization and targeted vulnerability management through asset tags and configurable import filters. * Supports risk-based prioritization of vulnerabilities using Tenable's VPR integrated into ServiceNow's risk scoring framework. The Vulnerability Response Integration with Tenable application developed by ServiceNow engineering for the Tenable Vulnerability Integration uses data imported from the Tenable.io, Tenable.sc, and Tenable.cs products to help you prioritize and remediate vulnerabilities for your assets. The application is available with a separate subscription from the ServiceNow® Store. Note: Starting with v14.9 of Configuration Compliance, the following terms have been renamed:{#tenableIntegration__entry__2} | Terminology prior to v14.9 | Terminology v14.9 onwards | |-|-| | Test Result Group | Remediation Task | | Group Rules | Remediation Task Rules | | Policy | Test group | [Table 1. Changes in terminology] The Tenable Vulnerability Integration employs three Tenable integrations, Tenable.io, Tenable.sc and Tenable.cs, to import third-party scanner data about your assets and vulnerabilities. The Vulnerability Response Integration with Tenable application supports the Tenable.sc product starting with version 5.13 and Tenable.cs product starting with version 5.0.1. * Tenable.io is a cloud-based enterprise integration. * Tenable.sc is an on-premises integration that gives you the option to use a MID Server if the Tenable.sc product and your ServiceNow AI Platform instance are in the same environment. * If the Tenable.sc product and your ServiceNow AI Platform instance aren't in the same environment, you're required to use a MID Server. * Tenable.cs is a cloud-based enterprise integration. {#tenableIntegration__ul_zxz_l1f_qnb} The Vulnerability Response Integration with Tenable application is available on the ServiceNow Store with a separate subscription. For lists and descriptions of the integrations in the Tenable Vulnerability Integration, see [Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications](https://www.servicenow.com/docs/XTWmazpCCZ5KzkNbJROzIQ "The Tenable.io integrations in the Vulnerability Response Integration with Tenable with Tenable application are available for use with both the Vulnerability Response and Configuration Compliance applications.") and [Tenable.sc integrations with the Vulnerability Response application](https://www.servicenow.com/docs/PVlIiYgMUjjBWms7qeSDNA "The Tenable.sc integrations in the Vulnerability Response Integration with Tenable application."). Figure 1. Tenable Vulnerability Integration ## Available versions for Brazil {#tenableIntegration__section_fkf_kcx_gnb} {#tenableIntegration__table_k3h_mcx_gnb__entry__2} | Release version | Release notes | |-|-| | Vulnerability Response Integration with Tenable v3.13.1, v4.1, v5.0.1 | For compatibility information, see [KB0856498 Vulnerability Response Compatibility Matrix and Release Schema Changes](https://support.servicenow.com/kb_view.do?sysparm_article=KB0856498) | [ ] {#tenableIntegration__table_k3h_mcx_gnb} ## Terms and Key features of the integrations {#tenableIntegration__section_gt5_xfv_wmb} Vulnerable items and vulnerabilities : A vulnerable item is created in your ServiceNow AI Platform instance when: * An imported vulnerability from a third-party scanner is matched to an existing asset (a configuration item in your CMDB). The Tenable product refers to these matches as vulnerabilities. * An imported vulnerability from a third-party scanner isn't matched to an existing asset in your CMDB. In this case, an unmatched CI is also created along with a vulnerable item. For unmatched CIs, you can also use the Identification and Reconciliation Engine (IRE) to create CIs in two new classes when an existing CI can't be matched with a host. Otherwise, unmatched CIs are created in the Unmatched CI classes. For more information, see [Creating CIs using the Identification and Reconciliation engine](https://www.servicenow.com/docs/kMyA3CfTwJLg0znDRpb3yg "You can create configuration items (CIs) in the Configuration Management Database (CMDB) using the Identification and Reconciliation engine (IRE) API. By using the IRE API to create CIs, you can prevent duplicate CIs from being created and you can reconcile CI attributes by allowing only authoritative data sources to write to CMDB."). {#tenableIntegration__ul_nh4_kr3_3nb} Third-party vulnerability entries and plugins : Third-party vulnerability entries are imported from third-party scanners and listed in the Third-Party Vulnerability Entries table in your ServiceNow AI Platform instance. Starting with v24.0 of Vulnerability Response, the Softwares column in the Third-Party Vulnerability Entries table populates the Common Platform Enumerations (CPEs) associated with a third-party entry. Third-party vulnerability entries from Tenable are ingested into Vulnerability Response and matched to existing assets listed in your CMDB. Tenable refers to third-party vulnerability entries as Plugins. Configuration item (CI) : Configuration items are the existing assets listed in your CMDB. Discovered item : Assets ingested from the Tenable asset import are matched to existing configuration items in your CMDB. Imported assets are updated. If a match isn't found, a CI is created in the Unmatched CI class of the CMDB. If the CMDB CI Class Models plugin is enabled, the Identification and Reconciliation Engine (IRE) creates CIs using new classes. For more information, see [Creating CIs using the Identification and Reconciliation engine](https://www.servicenow.com/docs/kMyA3CfTwJLg0znDRpb3yg "You can create configuration items (CIs) in the Configuration Management Database (CMDB) using the Identification and Reconciliation engine (IRE) API. By using the IRE API to create CIs, you can prevent duplicate CIs from being created and you can reconcile CI attributes by allowing only authoritative data sources to write to CMDB."). If the original, unmatched CI is reclassified, discovered item records are updated to reflect the state. Discovered items give you visibility into how assets are identified and mapped to CIs in the CMDB. CI lookup rules : When data is imported from a third-party integration, Vulnerability Response automatically uses host (asset) data to search for matches in the Configuration Management Database (CMDB). CI lookup rules are used to identify CIs and add them to VI records when VITs are created to aid you with remediation. Rescan and remediation scan : You can initiate a targeted rescan command on a specific configuration item, remediation task, or third-party entry directly from vulnerable item, remediation task, and third-party vulnerability entry records in your ServiceNow AI Platform instance. Tenable refers to this rescan as a remediation scan. Automatically close older VIs : With the Auto-Close Stale Vulnerable Items module in your ServiceNow AI Platform, you can clean up older, stale vulnerable items (VI)s not recently found by your third-party integrations. Moving these VIs to Closed helps you reduce the number of active vulnerable items and remediation tasks and reconcile assets in your CMDB. You can use all the integrations with the Vulnerability Response Integration with Tenable to close stale VIs automatically. Instance : This term refers to a distinct occurrence of your ServiceNow AI Platform® application. Integration : An integration is a product-specific reference to an integration, such as the Tenable.io Assets Integration, or the Tenable.sc Plugin Integration. These are the separate integrations that belong to specific Tenable products in the Tenable Vulnerability Integration in your instance. Integration instance : This term refers to the separate Tenable integrations listed by their Tenable.io and Tenable.sc products. Deployment : When an integration supports multi-source, a single, distinct integration existence is referred to as a deployment of your integration. The term is used to refer to the integration(s) and products across your environment. For example, you might have multiple deployments of various integrations of the Tenable.io and Tenable.sc products in your environment. The Tenable.io, Tenable.sc, and Tenable.cs integrations also include the following key features: * Configuration assessment findings, that is, test results along with policies, configuration tests (controls), and citations with authoritative sources can be imported into the Configuration Compliance application with the Tenable.io product. See [Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications](https://www.servicenow.com/docs/XTWmazpCCZ5KzkNbJROzIQ "The Tenable.io integrations in the Vulnerability Response Integration with Tenable with Tenable application are available for use with both the Vulnerability Response and Configuration Compliance applications.") and [Exploring Configuration Compliance](https://www.servicenow.com/docs/zR8RWWF2WZ8_ZXSNHyeRHA "Use test results obtained from third-party Secure Configuration Assessment (SCA) integrations to verify compliance with security or corporate policies. Identify, prioritize, and remediate non-compliant configuration items.") for more information about how this integration works with the Configuration Compliance application. * Starting with v2.1 of the Tenable Vulnerability Integration, create unique configuration items (CIs) that include different network partition identifiers for assets in your environment that share the same IP address. Identify the distinct assets across your environment and update the CIs on your existing discovered item, vulnerable item, and detection records to give you more details about your vulnerabilities. * You can schedule when you want the jobs to run for all the Tenable.io, Tenable.sc and Tenable.cs integrations. You can also execute scheduled jobs manually on-demand. * For asset imports with Tenable.io, you can enable asset tags to organize and track the assets listed in your CMDB in the Tenable.io environment. * The Tenable.io, Tenable.sc and Tenable.cs integrations permit you to configure CI Lookup Rules to define how asset data from third-party sources are used to identify Configuration Items (CIs) in your ServiceNow AI Platform CMDB. * The Tenable.io, Tenable.sc and Tenable.cs integrations permit you to set import filters on the vulnerabilities import so that you import only the vulnerabilities from Tenable that you want. For Tenable.io, you have the option to import Fixed vulnerabilities from Tenable with the vulnerabilities import. * For Tenable.sc, you have the option to initiate rescans on-demand directly from a vulnerable item, remediation task, and third-party entry records in your ServiceNow AI Platform instance. If VIs have been transitioned to Closed/Fixed but aren't yet updated in your instance, you can verify vulnerabilities on specific configuration items have been remediated. See [Initiate rescan for the Tenable.sc integration](https://www.servicenow.com/docs/i8gKDe4qcxOX6J~mF949ZA "Verify your vulnerable items have been remediated between scheduled scanning cycles by initiating rescans in the Tenable platform. You can initiate a rescan on-demand for vulnerable items for the Tenable.sc product from your ServiceNow AI Platform instance."). {#tenableIntegration__ul_hs1_f3v_wmb} The following sections list more details about the Tenable integrations. ## Required ServiceNow AI Platform roles {#tenableIntegration__section_plr_nfg_tlb} The integration tasks require the following roles in your ServiceNow AI Platform instance. admin : The system admin uses Setup Assistant to install the Vulnerability Response Integration with Tenable application. If not assigned, the admin assigns the vulnerability admin (sn_vul.vulnerability_admin) and other roles in Setup Assistant. sn_vul.vulnerability_admin : Once assigned, the vulnerability admin completes the configuration of the Tenable integrations in Setup Assistant. This role has complete access to the Vulnerability Response (VR) application and its records. The vulnerability admin configures all VR applications and rules for installed third-party integrations. sn_vul_tenable.configure_integration : This role contains the sn_vul_tenable.read_integration granular role and users with this role can configure the Vulnerability Response Integration with Tenable application. sn_vul_tenable.read_integration : Users with this roles can view (read) but not edit records of the Vulnerability Response Integration with Tenable application. Vulnerability Response group : By default, the Vulnerability Response group is available in Setup Assistant. Users assigned to the Vulnerability Response group inherit the sn_vul.read_all and sn_vul.remediation_owner roles automatically. ## Vulnerable items {#tenableIntegration__section_xzx_lgj_ppb} Vulnerable items are grouped into remediation tasks according to remediation task rules and assigned for remediation based on your assignment rules. For more information, see [Vulnerability Response remediation tasks and remediation task rules overview](https://www.servicenow.com/docs/5PdcBvF~OqyD4Ji5WeIyPg "Configure remediation tasks (VULs) to help analysts and remediation specialists organize vulnerable items (VI) and analyze them in bulk. The criteria by which remediation tasks are formed is configured so that you do not have to manually assign vulnerable items into remediation tasks. Using remediation tasks, you can monitor progress and drive the remediation process more efficiently.") and . ## Configuration item (CI) lookup rules {#tenableIntegration__section_otj_5hz_2mb} CI Lookup Rules identify CIs and determine when to add them to a vulnerable item. For more information on how CI lookup rules work, see [CI Lookup Rules for identifying configuration items from Configuration Compliance third-party vulnerability integrations](https://www.servicenow.com/docs/Vuv0QYJFv37nA5BD9~gCUA "When data is imported from a third-party integration, Configuration Compliance automatically uses host data to search for matches in the Configuration Management Database (CMDB). It does this using CI Lookup Rules. These rules are used to identify configuration items (CIs) and add them to the test result record to aid in remediation."). Note: Rules, once removed, can't be recovered. Rather than removing existing rules, disable them when creating ones. The following Tenable.io lookup rules are shipped with the base system. * MAC_ADDRESS * FQDN * NetBIOS * HostName * DNS * IP {#tenableIntegration__ul_l1g_r3z_2mb} Note: The Tenable.io CI lookup rules prioritize and populate the non-empty network interface values (FDQN, IPV4, and MacAddress) over the regular FDQN, IPV4, and MacAddress values for a discovered item. When these network interface values are empty, the regular FDQN, IPV4, and MacAddress values are populated for a discovered item. The following Tenable.sc lookup rules are shipped with the base system. * MAC_ADDRESS * FQDN * NetBIOS * IP {#tenableIntegration__ul_c1s_cjz_2mb} Note: Multiple values for ip_address, mac_address, fqdns and network_interfaces are used for an asset. All values are considered in CI lookup rules for matching. All values are used to create multiple network adapters using IRE. The Tenable.cs lookup rule Cloud Resource Id is shipped with the base system. For more information on how to configure the categorization of unmatched cloud resources into your preferred CI class, see [Updating CI class for unmatched cloud assets](https://www.servicenow.com/docs/tAa0Rs_8G2tfCcGpsQYSrg "Starting with Vulnerability Response v20.0, you can categorize the unmatched cloud assets from Qualys, Rapid7 and Tenable scanners into Unclassed Hardware by using the sn_sec_cmn.unmatched_cloud_resource_enabled system property."). ## New properties to ignore IP addresses {#tenableIntegration__section_dsz_yxf_4nb} In Tenable.io, there are two properties available if you want to ignore multiple IP addresses or multiple Mac addresses as part of your CI lookup rules: ignoreIPAddress : A list of IP addresses to be ignored for CI lookup and CI creation. ignoreMacAddress : A list of MAC addresses to be ignored for CI lookup or CI creation. ## Discovered items {#tenableIntegration__section_p24_2jz_2mb} This module lists configuration items detected during import from the Tenable Vulnerable Item integrations and the Tenable Asset integrations. Note: The default filter for this list is set to Unmatched. You can view all discovered items from an import by removing the filter. For more information on the Discovered Items module, see [Discovered Items](https://www.servicenow.com/docs/ny~SJXAR~S7KzCs2udsMYw "Assets are automatically matched to configuration items (CIs) in the Configuration Management Database (CMDB) when they are imported using CI Lookup Rules. Discovered Items give you visibility into how asset identification is mapped to CIs in the CMDB."). ## Asset tags {#tenableIntegration__section_ddd_vjz_2mb} Asset tags (also referred to as host tags) are used for organizing and tracking the assets in your organization. You can assign tags to your assets. Then, when launching the scans, you can select tags associated with the assets you want to scan. The Asset Tags module enables you to download asset tag data from Tenable.io to your instance on a scheduled basis. Asset data that includes asset tags is pulled from Tenable.io and transformed using the [Tenable.io Asset Transform](https://www.servicenow.com/docs/9YMvvf8NQfwH_EfsZS5gJw "After you identify the data to import, it’s retrieved from the Tenable product and processed through a set of data sources and transforms in your instance.") integration transformation maps. All Asset tags are imported as part of the Tenable.io Asset integration. Asset tags are used for filtering in Vulnerability Response assignment rules and Remediation Task Rules. The tags are displayed in the Discovered Item form. Note: Run the Tenable.io Asset Integration prior to creating Vulnerability Response assignment rules or remediation task rules in the Vulnerability Response application so that all tags are available for these rules before vulnerable items are imported and grouped. Also note the following points about tags: * Tag storage isn't case-sensitive. For example, if you create a tag to describe assets in your San Diego location, and you create the San Diego tag, you can't also create a SAN DIEGO tag and store it in the Asset tag table. San Diego and SAN DIEGO are considered to be the same asset tag by the system. Whichever tag is imported first is the tag that is stored and recognized going forward. * Using asset tags as a Group Key in a remediation task rule may have unexpected results. Asset tags are intended for use only in the condition builder. * Asset tags are controlled by the global system property sn_vul.import_asset_tags. This property is set to true by default. Disabling tags disables them across all ServiceNow AI Platform® instances. {#tenableIntegration__ul_xfb_pkz_2mb} ## Data retrieval filters {#tenableIntegration__section_lyn_ylz_2mb} Data retrieval settings help you determine specifically the type and scope of data you want to import from the Tenable application to your ServiceNow AI Platform® instance. For a list of the most commonly used settings, see [Data retrieval settings for the Tenable Vulnerability Integration](https://www.servicenow.com/docs/I62N7V0e8coLJ_B_yUuq~w "The following data retrieval settings help you determine specifically the type and scope of data you want to import from the ServiceNow Tenable Vulnerability Integration to your ServiceNow AI Platform instance."). ## Vulnerability Priority Rating (VPR) {#tenableIntegration__section_hbz_mcx_wmb} The Vulnerability Priority Rating (VPR) is an attribute from the Tenable product that is imported and used with a new default risk calculator in Vulnerability Response. The Tenable Risk Rule is installed with the Vulnerability Response Integration with Tenable application as part of the Default Risk Calculator in the Vulnerability Calculators from Vulnerability Response. This risk rule is inactive by default. By enabling the Tenable risk calculator rule, the imported VPR values are used to calculate the Risk Score for vulnerable items. The default weight distribution for this risk calculator: VPR = 70%, Asset=15%, and Business Criticality=15%. Enabling this Tenable Risk Calculator rule may impact your data ingestion performance. For more information about Vulnerability Response calculators and the Tenable risk calculator rule, see [Vulnerability Response calculators and vulnerability calculator rules](https://www.servicenow.com/docs/ZCaCzWCHHwidBWX_NWpEFQ "Vulnerability calculators automate calculating initial values for the fields on vulnerable items. The condition for each calculator is evaluated in order, and the first matching calculator is used."). ## Installation and configuration {#tenableIntegration__section_yz3_vdg_4nb} After you download the Vulnerability Response Integration with Tenable from the ServiceNow® Store, installation and configuration is supported by the Setup Assistant in Vulnerability Response. See [Configuring Vulnerability Response using the Setup Assistant](https://www.servicenow.com/docs/uYRn2ebpNfNocidjsXSrVw "Setup Assistant walks you through setting up Vulnerability Response and certain third-party integrations for your environment. Setup Assistant provides almost everything you need to install and set up your environment so that you can use Vulnerability Response.") for more information.