Tenable.io / Nessus — Integration Setup
Prerequisites
- Tenable.io subscription (or Nessus Professional with API access)
- Admin or Standard user with API key generation permissions
- CMDash Essentials tier or above
Step 1: Generate API Keys
- Log in to Tenable.io
- Click your profile icon → My Account
- Go to the API Keys tab
- Click Generate (or copy existing keys)
- Copy both:
- Access Key
- Secret Key
Security note: API keys have the same permissions as your user account. Consider creating a dedicated service account with read-only permissions.
Step 2: Connect in CMDash
- Navigate to Integrations in your CMDash dashboard
- Find Tenable and click Connect
- Enter:
- Access Key
- Secret Key
- Click Save & Test Connection
What Syncs
| Data Type | Tenable API | Sync Frequency |
|---|---|---|
| Assets | /assets | Every 4 hours by default |
| Vulnerabilities | /workbenches/vulnerabilities | Every 4 hours by default |
Tenable Data Mapping
| Tenable Field | CMDash Field | Notes |
|---|---|---|
asset.id | Endpoint ID | Unique asset identifier |
asset.fqdn | Hostname | Fully qualified domain name |
asset.ipv4 | IP Address | Primary IPv4 |
asset.operating_system | OS | Operating system string |
plugin.severity | Severity | 0=Info, 1=Low, 2=Medium, 3=High, 4=Critical |
plugin.cvss_base_score | CVSS Score | Base CVSS v2/v3 score |
plugin.cve | CVE IDs | Associated CVE identifiers |
Troubleshooting
- 401 Unauthorized: Verify API keys are correct; regenerate if necessary
- 403 Forbidden: Your Tenable user may lack permissions; use an admin or create a service account
- No assets returned: Ensure at least one scan has completed in Tenable; the assets API only returns scanned hosts
- Stale vulnerability data: Tenable updates vulnerability data after each scan completes; check scan schedule in Tenable console
Rate Limits & Sync Behavior
| Setting | Value |
|---|---|
| Sync frequency | Every 4 hours by default (configurable per integration) |
| First sync | Historical data pulled on initial connection (all assets and vulnerabilities visible to the API key's account) |
| Asset limit | The asset list call returns at most 5,000 assets; at that size CMDash switches to Tenable's asset export (chunked, up to 50,000 assets). If the export cannot run, the 5,000 listed are kept and the sync is flagged Partial |
| Vulnerability limit | Tenable's workbench list returns at most 5,000 vulnerabilities and has no paging; a result at that size is flagged Partial |
| Rate limit handling | Per-(tenant, provider) token bucket; requests are batched and rate-limited automatically |
| 429 handling | CMDash reads the Retry-After response header and reschedules the sync accordingly; exponential backoff applied if no header is present |
| Vendor rate limit | 200 req/min |
| Failed sync retry | Dead-letter queue — see docs/developers/dead-letter.md |
Tenable.io imposes a 200 req/min rate limit per API key. CMDash reads large asset inventories through Tenable's chunked asset export, spreading calls across the sync window. When a 429 is returned, CMDash honors the Retry-After header value exactly rather than applying its own backoff guess, which minimizes unnecessary wait time on Tenable's well-documented rate limit schedule.
Credential Rotation
Tenable API keys (Access Key + Secret Key) do not expire. CMDash recommends rotating them whenever team membership changes or annually at minimum.
To rotate:
- Log in to Tenable.io.
- Click your profile icon → My Account → API Keys.
- Click Regenerate. Note: this immediately invalidates the existing keys.
- Copy the new Access Key and Secret Key.
- In CMDash: Settings → Integrations → Tenable → Edit.
- Enter the new Access Key and Secret Key, then click Save.
Note: Because Tenable API keys do not carry an expiry timestamp, CMDash cannot display the 30-day warning banner for this integration. Set a calendar reminder for your chosen rotation cadence.
Multiple Instances / Multi-Site
If your organization uses multiple Tenable.io sites or a mix of Tenable.io and Tenable.sc, each instance requires a separate CMDash connection.
To add a second instance:
- In CMDash: Settings → Integrations → Add Integration → Tenable.
- Enter the credentials for the second instance.
- Give the connection a descriptive name that identifies the instance (e.g.,
Tenable - US East,Tenable - EU,Tenable.sc - On-Prem). - Click Save & Test Connection.
Use clear naming conventions from the start — the integration name appears throughout the CMDash compliance dashboard and reports, so names like Tenable - US East and Tenable - EU make it easy to identify which data comes from which instance.
Compliance Framework Coverage
The Tenable integration provides evidence for the following controls. Coverage is automatically mapped when data is synced.
| Framework | Control | Description |
|---|---|---|
| PCI DSS | 11.2 | Internal vulnerability scans — Tenable scan results satisfy the quarterly internal scan requirement |
| PCI DSS | 11.3 | External vulnerability scans — external scan results mapped to PCI external scan evidence |
| HITRUST | 10.m | Patch management — vulnerability age and CVSS scores used to assess patch posture |
| HITRUST | 09.aa | Audit logging — scan history and asset discovery logs |
| CMMC L2 | RA.2.141 | Vulnerability scanning — scan results and asset coverage mapped to scanning evidence |
| CMMC L2 | RA.2.142 | Remediation — vulnerability age and closure data used for remediation evidence |
| SOC 2 | CC7.1 | Vulnerability management — Tenable findings feed the vulnerability management evidence bucket |