Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Tenable.io - AskJ1 Community
<main> <article class="userContent"> <h2 data-id="tenable-io-jupiterone-integration-benefits">Tenable.io + JupiterOne Integration Benefits</h2> <ul><li><p>Visualize Tenable.io users, scans, findings, reports, vulnerabilities, and<br> container findings in the JupiterOne graph.</p></li> <li><p>Map Tenable.io users to employees in your JupiterOne account.</p></li> <li>Monitor Tenable vulnerabilities and findings within the alerts app.</li> <li>Monitor changes to Tenable.io users, scans, findings, reports,<br> vulnerabilities, and container findings using JupiterOne alerts.</li> </ul><h2 data-id="how-it-works">How it Works</h2> <ul><li><p>JupiterOne periodically fetches Tenable.io users, scans, findings, agents, and<br> vulnerabilities to update the graph.</p></li> <li><p>Write JupiterOne queries to review and monitor updates to the graph.</p></li> <li>Configure alerts to reduce the noise of findings.</li> <li>Configure alerts to take action when the JupiterOne graph changes.</li> </ul><h2 data-id="requirements">Requirements</h2> <ul><li><p>JupiterOne requires an access key and secret key used to authenticate with<br> Tenable.io.</p></li> <li><p>You must have the Tenable Administrator role for a successful integration.</p></li> <li>You must have permission in JupiterOne to install new integrations.</li> </ul><h2 data-id="support">Support</h2> <p>If you need help with this integration, please contact<br><a rel="nofollow" href="https://support.jupiterone.io">JupiterOne Support</a>.</p> <h2 data-id="integration-walkthrough">Integration Walkthrough</h2> <h3 data-id="in-tenable-io">In Tenable.io</h3> <ol><li>Make sure the account you use to integrate has the <strong>Administrator</strong> role.</li> <li>Click the hamburger icon in the top left corner to open the left pane.</li> <li>Navigate to <strong>Settings</strong></li> <li>Click <strong>My Account</strong></li> <li>On the left side, click <strong>API Keys</strong></li> <li>In the bottom right corner click <strong>Generate</strong></li> <li>Copy your Access Key and Secret Key into the respective fields in the<br> JupiterOne Tenable.io integration setup.</li> </ol><h3 data-id="in-jupiterone">In JupiterOne</h3> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Tenable.io</strong> integration tile and click it.</li> <li>Click the <strong>Add Configuration</strong> button and configure the following settings:</li> </ol><ul><li><p>Enter the <strong>Account Name</strong> by which you'd like to identify this Tenable.io<br> account in JupiterOne. Ingested entities will have this value stored in<br><code class="code codeInline" spellcheck="false" tabindex="0">tag.AccountName</code> when <strong>Tag with Account Name</strong> is checked.</p></li> <li><p>Enter a <strong>Description</strong> that will further assist your team when identifying<br> the integration instance.</p></li> <li><p>Select a <strong>Polling Interval</strong> that you feel is sufficient for your monitoring<br> needs. You may leave this as <code class="code codeInline" spellcheck="false" tabindex="0">DISABLED</code> and manually execute the integration.</p></li> <li><p>Enter the <strong>Access Key</strong> used to authenticate with Tenable.io.</p></li> <li>Enter the <strong>Secret Key</strong> associated with the access key.</li> </ul><ol start="4"><li>Click <strong>Create Configuration</strong> once all values are provided.</li> </ol><h2 data-id="how-to-uninstall">How to Uninstall</h2> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Tenable.io</strong> integration tile and click it.</li> <li>Identify and click the <strong>integration to delete</strong>.</li> <li>Click the <strong>trash can</strong> icon.</li> <li>Click the <strong>Remove</strong> button to delete the integration.</li> </ol><p><br></p> <h2 data-id="data-model">Data Model</h2> <h3 data-id="entities">Entities</h3> <p>The following entities are created:</p> <table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Account</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_account</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Account</code></td> </tr><tr><td>Agent</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_agent</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HostAgent</code></td> </tr><tr><td>Asset</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_asset</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Record</code></td> </tr><tr><td>Container Finding</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_finding</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr><tr><td>Container Image</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_image</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Image</code></td> </tr><tr><td>Container Malware</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_malware</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr><tr><td>Container Report</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_report</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Assessment</code></td> </tr><tr><td>Container Repository</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_repository</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Repository</code></td> </tr><tr><td>Container Unwanted Program</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_unwanted_program</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr><tr><td>Service</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_scanner</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> </tr><tr><td>User</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_user</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">User</code></td> </tr><tr><td>Vulnerability</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr></tbody></table><h3 data-id="relationships">Relationships</h3> <p>The following relationships are created:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_agent</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_asset</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_image</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_repository</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_account</code></td> <td><strong>PROVIDES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_scanner</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_asset</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_image</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_image</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_malware</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_image</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_report</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_image</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_unwanted_program</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_report</code></td> <td><strong>IDENTIFIED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_report</code></td> <td><strong>IDENTIFIED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_malware</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_report</code></td> <td><strong>IDENTIFIED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_unwanted_program</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_repository</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_image</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_scanner</code></td> <td><strong>SCANS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_container_image</code></td> </tr></tbody></table><h3 data-id="mapped-relationships">Mapped Relationships</h3> <p>The following mapped relationships are created:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Direction</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_asset</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">*aws_instance*</code></td> <td>FORWARD</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_asset</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">*azure_vm*</code></td> <td>FORWARD</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_asset</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">*google_compute_instance*</code></td> <td>FORWARD</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">*aws_instance*</code></td> <td>REVERSE</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">*azure_vm*</code></td> <td>REVERSE</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">*google_compute_instance*</code></td> <td>REVERSE</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">*cve*</code></td> <td>FORWARD</td> </tr></tbody></table><p><br></p> </article> </main>
.png)