Tenable.io CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

See the Custom Objects topic for steps on how to install the required custom object.

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Tenable.io Vulnerable Assets

The Tenable.io Vulnerable Assets feed periodically pulls vulnerable assets from Tenable.io, including metadata for the assets themselves, their vulnerabilities, and relevant CVEs.

POST https://cloud.tenable.com/vulns/export

Sample Request Body:

{
    "filters": {
        "state": ["<selected state filters"],
        "severity": ["<selected severity filters>"],
        "since": "<feed last run timestamp>"
    },
    "num_assets": 500,
    "include_unlicensed": true
}

Sample Response:

{
    "export_uuid": "<UUID>"
}

ThreatQuotient provides the following default mapping for this feed:

Get Export Job Chunk (Supplemental)

The Get Export Job Chunk supplemental feed fetches a specific chunk of the export job's results.

GET https://cloud.tenable.com/vulns/export/{{ uuid }}/chunks/{{ chunk }}

Sample Response:

[
    {
        "asset": {
            "agent_uuid": "7640d8143c5f4830834fd4128697cd45",
            "bios_uuid": "53e22042-a344-ae31-0b79-0a58ab414826",
            "device_type": "general-purpose",
            "fqdn": "localhost.localdomain",
            "hostname": "10.13.0.163",
            "uuid": "caa34c9e-a1de-4ea3-9d91-90387b0965d1",
            "ipv4": "10.13.0.102",
            "last_authenticated_results": "2022-11-28T19:16:16Z",
            "mac_address": "02:42:59:E1:E1:C9",
            "operating_system": [
                "Linux Kernel 3.10.0-1160.76.1.el7.x86_64 on CentOS Linux release 7.9.2009 (Core)"
            ],
            "network_id": "00000000-0000-0000-0000-000000000000",
            "tracked": true
        },
        "output": "\nThe following client-to-server Cipher Block Chaining (CBC) algorithms\nare supported : \n\n  3des-cbc\n  aes128-cbc\n  aes192-cbc\n  aes256-cbc\n  blowfish-cbc\n  cast128-cbc\n\nThe following server-to-client Cipher Block Chaining (CBC) algorithms\nare supported : \n\n  3des-cbc\n  aes128-cbc\n  aes192-cbc\n  aes256-cbc\n  blowfish-cbc\n  cast128-cbc\n",
        "plugin": {
            "bid": [
                32319
            ],
            "checks_for_default_account": false,
            "checks_for_malware": false,
            "cve": [
                "CVE-2008-5161"
            ],
            "cvss3_base_score": 0,
            "cvss3_temporal_score": 0,
            "cvss_base_score": 2.6,
            "cvss_temporal_score": 1.9,
            "cvss_temporal_vector": {
                "exploitability": "Unproven",
                "remediation_level": "Official-fix",
                "report_confidence": "Confirmed",
                "raw": "E:U/RL:OF/RC:C"
            },
            "cvss_vector": {
                "access_complexity": "High",
                "access_vector": "Network",
                "authentication": "None required",
                "availability_impact": "None",
                "confidentiality_impact": "Partial",
                "integrity_impact": "None",
                "raw": "AV:N/AC:H/Au:N/C:P/I:N/A:N"
            },
            "description": "The SSH server is configured to support Cipher Block Chaining (CBC) encryption.  This may allow an attacker to recover the plaintext message from the ciphertext. \n\nNote that this plugin only checks for the options of the SSH server and does not check for vulnerable software versions.",
            "exploit_available": false,
            "exploit_framework_canvas": false,
            "exploit_framework_core": false,
            "exploit_framework_d2_elliot": false,
            "exploit_framework_exploithub": false,
            "exploit_framework_metasploit": false,
            "exploitability_ease": "No known exploits are available",
            "exploited_by_malware": false,
            "exploited_by_nessus": false,
            "family": "Misc.",
            "family_id": 23,
            "has_patch": false,
            "id": 70658,
            "in_the_news": false,
            "name": "SSH Server CBC Mode Ciphers Enabled",
            "modification_date": "2018-07-30T00:00:00Z",
            "publication_date": "2013-10-28T00:00:00Z",
            "risk_factor": "Low",
            "see_also": [
                ""
            ],
            "solution": "Contact the vendor or consult product documentation to disable CBC mode cipher encryption, and enable CTR or GCM cipher mode encryption.",
            "synopsis": "The SSH server is configured to use Cipher Block Chaining.",
            "type": "remote",
            "unsupported_by_vendor": false,
            "version": "1.4",
            "vuln_publication_date": "2008-11-24T00:00:00Z",
            "xrefs": [
                {
                    "type": "CERT",
                    "id": "958563"
                },
                {
                    "type": "CWE",
                    "id": "200"
                }
            ],
            "vpr": {
                "score": 2.5,
                "drivers": {
                    "age_of_vuln": {
                        "lower_bound": 731
                    },
                    "exploit_code_maturity": "UNPROVEN",
                    "cvss_impact_score_predicted": true,
                    "cvss3_impact_score": 2.5,
                    "threat_intensity_last28": "VERY_LOW",
                    "threat_sources_last28": [
                        "No recorded events"
                    ],
                    "product_coverage": "HIGH"
                },
                "updated": "2020-12-30T05:20:01Z"
            }
        },
        "port": {
            "port": 22,
            "protocol": "TCP",
            "service": "ssh"
        },
        "scan": {
            "completed_at": "2022-11-28T19:16:27.855Z",
            "schedule_uuid": "template-ac0f7c9e-1ee4-4040-a156-72682dc7a9991b8279485af00a75",
            "started_at": "2022-11-28T18:51:49.270Z",
            "uuid": "93b6356d-ba19-42f8-bda9-e1bebe363783"
        },
        "severity": "low",
        "severity_id": 1,
        "severity_default_id": 1,
        "severity_modification_type": "NONE",
        "first_found": "2022-11-28T19:16:27.855Z",
        "last_found": "2022-11-28T19:16:27.855Z",
        "state": "OPEN",
        "indexed": "2022-11-28T19:17:05.003Z"
    }
]

Get Export Job (Supplemental)

The Get Export Job supplemental feed finds a given job by its UUID.

GET https://cloud.tenable.com/vulns/export/status

Sample Response:

{
    "exports": [
        {
            "uuid": "8184a7f2-3038-445f-8c77-727551a464d5",
            "status": "FINISHED",
            "total_chunks": 0,
            "chunks_available_count": 0,
            "empty_chunks_count": 0,
            "finished_chunks": 0,
            "filters": {
                "severity": [
                    "INFO",
                    "LOW",
                    "MEDIUM",
                    "HIGH",
                    "CRITICAL"
                ],
                "state": [
                    "OPEN",
                    "REOPENED"
                ],
                "tags": {},
                "since": 1669828186,
                "first_found": 0,
                "last_found": 0,
                "last_fixed": 0,
                "first_seen": 0,
                "last_seen": 0,
                "indexed_at": 0
            },
            "num_assets_per_chunk": 500,
            "created": 1669914589334
        }
    ]
}

PDF Guides