{ "name": "tenable_io", "title": "Tenable Vulnerability Management", "version": "4.10.0", "release": "ga", "description": "Collect logs from Tenable Vulnerability Management with Elastic Agent.", "type": "integration", "download": "/epr/tenable_io/tenable_io-4.10.0.zip", "path": "/package/tenable_io/4.10.0", "icons": [ { "src": "/img/tenable_io-logo.svg", "path": "/package/tenable_io/4.10.0/img/tenable_io-logo.svg", "title": "Tenable Vulnerability Management logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.0 || ^9.1.0" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "vulnerability_management", "vulnerability_workflow", "cloudsecurity_cdr" ], "signature_path": "/epr/tenable_io/tenable_io-4.10.0.zip.sig", "format_version": "3.4.0", "readme": "/package/tenable_io/4.10.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/tenable_io-screenshot.png", "path": "/package/tenable_io/4.10.0/img/tenable_io-screenshot.png", "title": "Tenable Vulnerability Management dashboard screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/tenable_io/4.10.0/LICENSE.txt", "/package/tenable_io/4.10.0/changelog.yml", "/package/tenable_io/4.10.0/manifest.yml", "/package/tenable_io/4.10.0/validation.yml", "/package/tenable_io/4.10.0/docs/README.md", "/package/tenable_io/4.10.0/img/tenable_io-logo.svg", "/package/tenable_io/4.10.0/img/tenable_io-screenshot.png", "/package/tenable_io/4.10.0/kibana/tags.yml", "/package/tenable_io/4.10.0/data_stream/asset/manifest.yml", "/package/tenable_io/4.10.0/data_stream/asset/sample_event.json", "/package/tenable_io/4.10.0/data_stream/audit/manifest.yml", "/package/tenable_io/4.10.0/data_stream/audit/sample_event.json", "/package/tenable_io/4.10.0/data_stream/plugin/manifest.yml", "/package/tenable_io/4.10.0/data_stream/plugin/sample_event.json", "/package/tenable_io/4.10.0/data_stream/scan/manifest.yml", "/package/tenable_io/4.10.0/data_stream/scan/sample_event.json", "/package/tenable_io/4.10.0/data_stream/vulnerability/manifest.yml", "/package/tenable_io/4.10.0/data_stream/vulnerability/sample_event.json", "/package/tenable_io/4.10.0/kibana/dashboard/tenable_io-0d902a50-edec-11ed-b550-bd5e656b580f.json", "/package/tenable_io/4.10.0/kibana/dashboard/tenable_io-2f561e3c-2bd2-4c63-a19a-bd40c9cd6106.json", "/package/tenable_io/4.10.0/kibana/dashboard/tenable_io-4d784610-1ec2-11ed-bad4-551c615a34d1.json", "/package/tenable_io/4.10.0/kibana/dashboard/tenable_io-84586900-1ed4-11ed-bad4-551c615a34d1.json", "/package/tenable_io/4.10.0/kibana/dashboard/tenable_io-f2dacba0-1e22-11ed-bad4-551c615a34d1.json", "/package/tenable_io/4.10.0/data_stream/asset/fields/agent.yml", "/package/tenable_io/4.10.0/data_stream/asset/fields/base-fields.yml", "/package/tenable_io/4.10.0/data_stream/asset/fields/fields.yml", "/package/tenable_io/4.10.0/data_stream/audit/fields/base-fields.yml", "/package/tenable_io/4.10.0/data_stream/audit/fields/beats.yml", "/package/tenable_io/4.10.0/data_stream/audit/fields/fields.yml", "/package/tenable_io/4.10.0/data_stream/plugin/fields/agent.yml", "/package/tenable_io/4.10.0/data_stream/plugin/fields/base-fields.yml", "/package/tenable_io/4.10.0/data_stream/plugin/fields/fields.yml", "/package/tenable_io/4.10.0/data_stream/scan/fields/agent.yml", "/package/tenable_io/4.10.0/data_stream/scan/fields/base-fields.yml", "/package/tenable_io/4.10.0/data_stream/scan/fields/fields.yml", "/package/tenable_io/4.10.0/data_stream/vulnerability/fields/agent.yml", "/package/tenable_io/4.10.0/data_stream/vulnerability/fields/base-fields.yml", "/package/tenable_io/4.10.0/data_stream/vulnerability/fields/ecs-overridden.yml", "/package/tenable_io/4.10.0/data_stream/vulnerability/fields/fields.yml", "/package/tenable_io/4.10.0/data_stream/vulnerability/fields/package.yml", "/package/tenable_io/4.10.0/data_stream/vulnerability/fields/resource.yml", "/package/tenable_io/4.10.0/data_stream/vulnerability/fields/vulnerability.yml", "/package/tenable_io/4.10.0/elasticsearch/transform/latest_cdr_vulnerabilities/transform.yml", "/package/tenable_io/4.10.0/data_stream/asset/agent/stream/cel.yml.hbs", "/package/tenable_io/4.10.0/data_stream/asset/elasticsearch/ingest_pipeline/default.yml", "/package/tenable_io/4.10.0/data_stream/audit/agent/stream/cel.yml.hbs", "/package/tenable_io/4.10.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml", "/package/tenable_io/4.10.0/data_stream/plugin/agent/stream/cel.yml.hbs", "/package/tenable_io/4.10.0/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml", "/package/tenable_io/4.10.0/data_stream/scan/agent/stream/cel.yml.hbs", "/package/tenable_io/4.10.0/data_stream/scan/elasticsearch/ingest_pipeline/default.yml", "/package/tenable_io/4.10.0/data_stream/vulnerability/agent/stream/cel.yml.hbs", "/package/tenable_io/4.10.0/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml", "/package/tenable_io/4.10.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/agent.yml", "/package/tenable_io/4.10.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/base-fields.yml", "/package/tenable_io/4.10.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/ecs-overridden.yml", "/package/tenable_io/4.10.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/fields.yml", "/package/tenable_io/4.10.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/package.yml", "/package/tenable_io/4.10.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/resource.yml", "/package/tenable_io/4.10.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/vulnerability.yml" ], "policy_templates": [ { "name": "tenable_io", "title": "Tenable Vulnerability Management", "description": "Collect logs from Tenable Vulnerability Management.", "inputs": [ { "type": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "URL for the Tenable Vulnerability Management API (Add https:// before the url).", "multi": false, "required": true, "show_user": true, "default": "https://cloud.tenable.com" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "access_key", "type": "password", "title": "Access Key", "description": "Access key for the Tenable Vulnerability Management API.", "multi": false, "required": true, "show_user": true }, { "name": "secret_key", "type": "password", "title": "Secret Key", "description": "Secret key for the Tenable Vulnerability Management API.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Tenable Vulnerability Management logs via API", "description": "Collecting Tenable Vulnerability Management logs via API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } } ], "data_streams": [ { "type": "logs", "dataset": "tenable_io.asset", "title": "Collect Asset data from Tenable Vulnerability Management", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Tenable Vulnerability Management. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the asset events from Tenable Vulnerability Management. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "720h" }, { "name": "export_status_timeout", "type": "text", "title": "Export Status Timeout", "description": "Duration for which the export job should check its status. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "12h" }, { "name": "batch_size", "type": "integer", "title": "Chunk Size", "description": "Specifies the number of assets per exported chunk. The range is 100-10000.", "multi": false, "required": true, "show_user": false, "default": 100 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tenable_io-asset" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tenable_io.asset fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the data is parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Asset data", "description": "Collect asset data from Tenable Vulnerability Management.", "enabled": true, "ingestion_method": "API" } ], "package": "tenable_io", "path": "asset" }, { "type": "logs", "dataset": "tenable_io.audit", "title": "Collect Audit logs from Tenable Vulnerability Management", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the audit events from Tenable Vulnerability Management. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Tenable Vulnerability Management. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Size", "description": "The number of records to include in the result set. The maximum supported size value is 10,000.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tenable_io-audit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tenable_io.audit fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Audit logs", "description": "Collect audit logs from Tenable Vulnerability Management.", "enabled": false, "ingestion_method": "API" } ], "package": "tenable_io", "path": "audit" }, { "type": "logs", "dataset": "tenable_io.plugin", "title": "Collect Plugin logs from Tenable Vulnerability Management", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Tenable Vulnerability Management. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "batch_size", "type": "integer", "title": "Size", "description": "The number of records to include in the result set. Default is 1,000. The maximum size is 10,000.", "multi": false, "required": false, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tenable_io-plugin" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tenable_io.plugin fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Plugin logs", "description": "Collect plugin logs from Tenable Vulnerability Management.", "enabled": true, "ingestion_method": "API" } ], "package": "tenable_io", "path": "plugin" }, { "type": "logs", "dataset": "tenable_io.scan", "title": "Collect Scan logs from Tenable Vulnerability Management", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "select", "title": "Interval", "description": "Duration between requests to the Tenable Vulnerability Management. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tenable_io-scan" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Scan logs", "description": "Collect Scan logs from Tenable Vulnerability Management.", "enabled": false, "ingestion_method": "API" } ], "package": "tenable_io", "path": "scan" }, { "type": "logs", "dataset": "tenable_io.vulnerability", "title": "Collect Vulnerability logs from Tenable Vulnerability Management", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Tenable Vulnerability Management. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the vulnerability events from Tenable Vulnerability Management. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2160h" }, { "name": "export_status_timeout", "type": "text", "title": "Export Status Timeout", "description": "Duration for which the export job should check its status. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "12h" }, { "name": "severity_level", "type": "text", "title": "Severity Level", "description": "Returns vulnerabilities with the specified severity. Defaults to all severity levels.", "multi": true, "required": false, "show_user": true, "default": [ "critical", "high", "medium", "low", "info" ] }, { "name": "num_assets", "type": "integer", "title": "Number of Assets", "description": "Specifies the number of assets used to chunk the vulnerabilities.", "multi": false, "required": true, "show_user": false, "default": 50 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "max_executions", "type": "integer", "title": "Maximum Pages Per Interval", "description": "Maximum Pages Per Interval is the maximum number of pages that can be collected at each interval.", "multi": false, "required": false, "show_user": false, "default": 2000 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tenable_io-vulnerability" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tenable_io.vulnerability fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Vulnerability logs", "description": "Collect vulnerability logs from Tenable Vulnerability Management.", "enabled": true, "ingestion_method": "API" } ], "package": "tenable_io", "path": "vulnerability" } ] }