Tenable Security Center

Tenable Security Center (Tenable.sc) is an on-premises vulnerability management platform that provides comprehensive visibility into the security posture of an organization's IT infrastructure. For more detailed information refer to Tenable's official website.

Integration Method:  Data Collector (API Ingest)

Tables: Vulnerability Finding (2002)

This integration supports the following events.

This integration supports the following versions.

Prerequisites

• The user should have access to the Tenable Security Center console with administrator privileges.

• The user should have a compatible version of the system in which we can configure the data collector.

• The user should have access to the DataBee console.

Configuration Overview

1. Data Collector Configuration and Installation.

2. Generate API credentials from the Tenable Security Center.

3. Create Tenable Security Center Data Feed in the DataBee console.

   DataBee Parameter	Tenable Security Center Parameter
   Base URL	Base Url
   Access Key	Access Key
   Secret Key	Secret Key

Data Collector Configuration and Installation

To receive events from Tenable Security Center, a Data Collector must be installed and configured. The data collector is used to call Tenable Security Center APIs and send data to DataBee securely.

Follow the steps provided in DataBee's official documentation to complete the configuration. Additionally, refer to this guide for detailed instructions on installing the Data Collector on your machine.

Tenable Security Center Configuration

1. Log in to the Tenable Security Center UI using Administrator credentials. Copy the Base URL highlighted in the image below for later use.

    

2. In the left navigation, click System > Configuration. The Configuration page appears.

   

3. Click the Security tile. The Security Configuration page appears.

    

4. In the Authentication Settings section, enable Allow API Keys.

   

5. Click Submit.

   

6. From the left navigation menu, go to Users > Users. The Users page appears.
    

7. Click the user who has the Security Manager role. If no such user exists, create one using the + Add option first (refer to the provided documentation for detailed steps).

   Then, proceed with either of the following:

   1. Right-click the user's row to open the Actions menu, or

   2. Select the checkbox next to the user to display the available actions at the top of the table.

   From the available actions, select Generate API Key.

   

8. Click Generate. The Your API Key window appears, displaying the access key and secret key for the user.

   

9. Copy the Access Key and Secret Key for later use and click OK.
    

   Note:

   Copy these credentials to a safe location. You cannot view the API secret keys again. If you lose your secret key, you must generate new API keys.

DataBee Configuration

1. Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
    

2. Search for Tenable Security Center and click on it as shown below.
    

3. Click on the Data Collector option for collection method.
    

4. Click on the API Ingest option as the polling mechanism.
    

5. Enter the feed contact information, select the collector that you have created from the drop down, and scroll down.
    

6. In the configuration page, confirm the following, then scroll down:

   • Base URL: Paste the Base URL which would be the IP address/instance of the Tenable Security Center.

   • Request Count: Set to 100

   • Interval: Set to 60 seconds

   • Event Types: Preselected for all the event types that integration pulls.
      

7. In the configure authentication page, confirm the following, then click Next.

   • Authorization Method: Custom API Key

   • Access Key: Paste the Access Key

   • Secret Key: Paste the Secret Key.

   • Enable TLS: Check the Enable TLS option

   • Skip Server-side Certificate Verification: Check it to disable the server-side certificate verification

   

8. Click Submit.
    

Troubleshooting Tips

• Ensure that the Tenable Security Center server is reachable by opening the terminal on the data collector machine and running ping <server_ip> command.

  

• Ensure that the API key pair (Access Key and Secret Key) is valid.

• If you encounter TLS/SSL certificate errors, ensure the "Skip Server-side Certificate Verification" option is enabled, or provide the correct CA certificate path.

• If you encounter any issues regarding log forwarding, refer to the DataBee troubleshooting document for detailed guidance.