Tenable.io

The TenableIO CVE integration will download data about all hosts with CVE’s that match the provided criteria. It fetches CVEs known to Tenable, using its Vulnerability Management API. If the ‘interval_hours’ is set to 0, the integration will attempt to download additional content each time the Corelight-update service runs. See Configuration settings

Once downloaded, this data will be used to create an Input Framework file that can be used by Zeek scripts to enrich logs, such as the notice or suricata_corelight.log.

The input file will be published with any other input files from other integrations (if there are any). If “input” is enabled in the “push_content” settings, the file will automatically get pushed to the Fleet Manager policy and/or all sensors in the policy. See Push content settings for more details.

Settings

tenable_io:
  enabled: false
  interval_hours: 24
  filename: cve_data.tsv
  access_key: ""                         #  required field
  secret_key: ""                         #  required field
  severity: critical,high,medium,low     #  Comma separated, one or more of: critical,high,medium,low,info. If omitted, the export will include all vulnerabilities regardless of severity.
  plugin_type: ""                        #  One of: remote,local,combined. If omitted, the export will include all vulnerabilities regardless of plugin type.
  include_unlicensed: false
  cidr_range: ""                         #  Restricts search for vulnerabilities to assets assigned an IP address within the specified CIDR range. If omitted no restriction will apply.
  since_in_days: 30                      #  Days data you want to export. if omitted export will only include vulnerabilities found or fixed within the last 30 days.
  state: open,reopened,fixed             #  Comma separated, one or more of: open,reopened,fixed. If omitted, the export will only include vulnerabilities in the open and reopened states.
  ignore_tls: false
  debug: false

Input file

The input file contains the following information (if it’s available):

  • IP address (required)

  • Hostname

  • Host Unique ID: Provided by the export vulnerabilities Chunk data’s 'uuid' field.

  • Customer ID

  • Criticality

  • Machine domain

  • OS version

  • Endpoint information source (required)

  • CVE list

The following is a sample input file created by this integration, using tab-separated values.

 #fields   ip     hostname                uid                                   cid    criticality   machine_domain                                       os_version                                                          source       cve_list
 12.122.0.3       gcp-scc-compare-agent   0b3af008-05c9-429f-8b6c-94f434bb095a   -          -         instance-1.c.tenable-technical-alliances.internal   CentOS Linux 7 (Core)                                               Tenable.IO   CVE-2023-20592,CVE-2022-27635,CVE-2022-36351,CVE-2022-38076,CVE-2022-40964,CVE-2022-46329,CVE-2023-32233,CVE-2023-35001,CVE-2023-3609
 99.222.221.189   aws-test-agent          cbf8648d-48c4-428c-8b93-3968ab1b811e   -          -         ip-10-254-221-189.ec2.internal                      Ubuntu 22.04.4 LTS (Jammy Jellyfish)                                Tenable.IO   CVE-2023-47233,CVE-2023-52601,CVE-2023-52602,CVE-2023-52604,CVE-2023-52615,CVE-2024-2201,CVE-2024-26614,CVE-2024-26622,CVE-2024-26637
 92.142.101.107   test-hostname           c5e7f41f-c68e-4d60-8c56-eefe2fea2008   -          -         -                                                   Linux Kernel 5.15.0-102-generic on Oracle Linux Server release 9.4  Tenable.IO   CVE-1999-0511,CVE-1999-0524,CVE-2023-6597,CVE-2024-0450
 19.151.244.1     cds-agent-name          8653144c-be8a-422e-b937-2ed13831838b   -          -         -                                                   CentOS Linux 7 (Core)                                               Tenable.IO   CVE-2023-4408,CVE-2023-50387,CVE-2023-50868,CVE-2024-37891,CVE-2024-32487,CVE-2019-17571,CVE-2020-9488,CVE-2022-23302,CVE-2022-23305,CVE-2022-23307,CVE-2023-26464,CVE-2024-27281

Attention

The Tenable.IO integrations only create Input Framework files to be loaded on sensors. Additional Zeek scripts are required to be loaded on the sensors to use this data. If you enable these integrations, Corelight-update will upload the input files to the sensor. But if the desired script isn’t available on the sensor, the input data won’t be used.

See Zeek package management for information about using Corelight-update to manage Zeek package bundles.

See Zeek-CVE-Enrichment for an example of a Zeek package that can use this data.