Tenable

Purpose

This guide explains how to generate an Access Key and Secret Key in Tenable.io, identify the Base URL, and configure the connection in AirMDR.The integration supports the following workflows through its available skills:

Retrieve vulnerability findings to enrich security investigations.
Identify assets associated with an IP address, hostname, or vulnerability.
Export asset and vulnerability records for data collection.
Review scan results and generate reports.
Retrieve attack paths where the required Exposure Management capabilities are available.

Creating a connection stores the credentials used by AirMDR skills. Configure the relevant skills or playbooks to retrieve data or perform scheduled collection.

Supported Versions

Item	Details
Product	Tenable.io, now named Tenable Vulnerability Management. Current documentation also uses Tenable One Vulnerability Management.
Deployment	Tenable-hosted cloud service.
API compatibility	Uses the Tenable cloud APIs associated with the configured skills. There is no customer-installed server version to select.
Base URL	`https://cloud.tenable.com` for the standard commercial service.
Authentication	Access Key and Secret Key supplied through the `X-ApiKeys` request header.
Additional capabilities	Some skills use Exposure Management APIs. Confirm that your tenant has the necessary subscription entitlements and permissions.

The supplied skills use both Vulnerability Management and Exposure Management API resources. In particular, finding searches and attack-path searches use Exposure Management endpoints.

For specialized Tenable cloud environments, confirm the API hostname and AirMDR compatibility before configuration.

Authentication

AirMDR authenticates to Tenable.io using an Access Key and Secret Key generated for a Tenable user account.Tenable.io API requests use the following header: X-ApiKeys: accessKey=<ACCESS_KEY>; secretKey=<SECRET_KEY>;Enter the key values separately in AirMDR. Do not include accessKey=, secretKey=, or the complete header in the credential fields.This connection uses API keys; it does not require an OAuth client ID, client secret, or interactive login session for each request. Tenable API authorization.Role and Access Considerations

Use a dedicated integration account to separate AirMDR access from personal user activity.
Enable API-key authentication for that account.
Assign the role and resource permissions required by the selected skills.
Ensure that the account can access the relevant assets and scans.
Have an administrator generate credentials for an API-only account.

Permission to generate API keys does not establish access to every Tenable resource. Examples of Endpoint PermissionsThe following are verified requirements for individual API operations. They are not a complete permissions matrix for all integration skills.

API Operation	Documented Role or Custom Privilege
List scans	Basic [16] role with Can View [16] scan permission, or the documented custom-role alternative: `VM.VM_SCAN.VM_SCAN.READ`.
Search findings	Basic [16] role, or both `ASSET_INVENTORY.CYBER_ASSET_MANAGEMENT.READ` and `AD.TOGGLE_AD.USE`.
Search attack paths	Basic [16] role, or `ATTACK_PATH_ANALYSIS.QUERY.SEARCH`.

An AirMDR skill may call multiple endpoints. Validate permissions for the complete operation, including any export-status and download requests.

Pre-requisites

An active Tenable.io subscription with access to the APIs required by your selected skills.

A dedicated Tenable integration account with API-key authentication enabled and appropriate permissions to access the required assets, vulnerabilities, scans, and reports.

A Tenable administrator available to configure user access when necessary.

Setup Steps

To connect Tenable.io to AirMDR, first verify API access for the integration account, generate its credentials, and identify the Base URL. Then enter these values in AirMDR and validate a skill execution.

Verify API Access

Updating another user’s access requires a Tenable administrator.

Sign in to Tenable cloud.
Open Settings → Access Control → Users.
Select the dedicated integration user.
In the authentication settings, enable API Key.
Review the user’s role and resource permissions.
Click Save.

If a dedicated account does not exist, have the administrator create one and assign access for the required integration operations.

Generate the Access Key and Secret Key

Use the procedure appropriate to the integration account’s login access.

Option A: Generate Keys for Your Own Account

Use this procedure when the integration account has interactive login access.

Sign in to Tenable.io using the integration account.
Click the blue user circle in the upper-right corner.
Select My Profile. The My Account page opens.
Select the API Keys tab.
Click Generate.
Review the replacement warning and click Generate to confirm.
Copy the Access Key and Secret Key to approved credential storage before leaving the page.
Generating a new pair replaces the account’s existing keys. Coordinate the change with any applications using those credentials.

If Generate is unavailable, ask the administrator to verify API access for the account.

Option B: Have an Administrator Generate the Keys

Use this procedure for an API-only account or when an administrator manages the integration credentials.

Open Settings → Access Control → Users.
Select the integration user.
In API Keys, click Generate API Keys.
Review the warning and select Replace & Generate.
Copy both keys to approved credential storage before navigating away.

Identify the Base URL

For the standard commercial Tenable.io service, enter: https://cloud.tenable.com.The Base URL identifies the service. Individual skills add the required API resource path.

URL Type	Example
Base URL	`https://cloud.tenable.com`
Complete API endpoint	`https://cloud.tenable.com/scans`

Do not include a browser navigation fragment, query string, or endpoint path such as /scans in the Base URL field. The official authorization example uses this cloud hostname.

Tenable Credential Reference Table

AirMDR Field	What to Enter	Where to Get It in the UI	Example
Access Key	The access key generated for the dedicated Tenable integration account.	User circle → My Profile → API Keys → Generate. An administrator can also generate keys from the integration user’s account record.	`<YOUR_ACCESS_KEY>`
Secret Key	The secret key generated together with the access key.	Copy it from the same key-generation screen before leaving the page.	`<YOUR_SECRET_KEY>`
Base URL	The Tenable.io API service origin.	For the standard commercial service, use the documented address below. This value is not generated in the API Keys tab.	`https://cloud.tenable.com`

Enter the Base URL explicitly, even though the supplied AirMDR form does not mark it as mandatory. The connector’s default value has not been confirmed.

Validate Connectivity

The following optional read-only API requests validate Tenable access separately from the AirMDR connector. Run them from an authorized environment with the same network reachability as the integration.

The token or service account role must permit GET /api/v2/events/datasearch/alert. Permission for a Dataexport endpoint does not automatically establish permission for this endpoint.

In Bash, use the following prompts to avoid placing the literal key values in command history:

read -r -s -p "Tenable access key: " TENABLE_ACCESS_KEY
printf '\n'

read -r -s -p "Tenable secret key: " TENABLE_SECRET_KEY
printf '\n'

Request Sample - To validate Tenable.io connectivity

curl --silent --show-error --include \
  --request GET 'https://cloud.tenable.com/scans' \
  --header "X-ApiKeys: accessKey=${TENABLE_ACCESS_KEY}; secretKey=${TENABLE_SECRET_KEY};" \
  --header 'Accept: application/json'

Tenable.io Expected result

HTTP status 200.
A JSON response containing the accessible scan information.

This endpoint requires the Basic [16] role and Can View [16] scan permission, or the documented custom-role alternative.

These permissions apply to this diagnostic endpoint, not every AirMDR skill. An empty scan list does not prove access to the resources required by the integration.

Configure Tenable in AirMDR Integrations Dashboard

Navigate to AirMDR, provide the credentials and click Login
Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select ADMIN → Integrations.
Use the search option, enter the keyword “Tenable”, select the Connections tab, and click + New Connection button.

Use the following values in the AirMDR integration configuration screen:

Field	What to Enter	Example
Instance	A descriptive name for the connection.	`Tenable-IO-Production`
Organization	The AirMDR organization that owns the connection.	Select the appropriate organization.
Description	A brief description of the connection’s purpose.	`Tenable.io vulnerability and asset enrichment`
Access Key	The generated access key.	`<YOUR_ACCESS_KEY>`
Secret Key	The corresponding secret key.	`<YOUR_SECRET_KEY>`
Base URL	The Tenable.io service origin.	`https://cloud.tenable.com`

Expand Advanced Configuration if required. (Optional)

In Remote Agent, select an AirMDR Remote Agent when your Tenable deployment requires a private network connection, an approved proxy, or a controlled outbound network route.
- Tenable.io: If API IP allowlisting is enabled, ensure that the selected execution environment’s outbound IP address is permitted.
  Otherwise, leave this field unselected unless instructed by your AirMDR administrator.
In Expiry, select a date according to your organization’s credential-rotation policy. Coordinate this date with the planned replacement of the Tenable Access Key and Secret Key.

Manage API-key replacement in Tenable separately from the AirMDR Expiry setting. Generating a new pair replaces the previous pair. Update both values in AirMDR promptly and validate the connection.

Click Save.

Skills provided by this Integration

The Tenable integration provides skills for retrieving asset information, investigating vulnerabilities, analyzing attack paths, and generating reports. The following skills are grouped by their purpose.

Asset Discovery & Inventory

Use these skills to identify assets involved in an investigation and retrieve asset inventory data.

Skill	Purpose	Permissions Required
Get Tenable assets	Search assets by hostname, FQDN, or IP address, or retrieve detailed information using an asset UUID.	Basic role and access to the requested assets. The inventory-search operation also requires access to the relevant Exposure Management capability.
Export Tenable assets	Export asset records in bulk for inventory synchronization and scheduled collection.	Basic role with Can View permission for the assets being exported.

Vulnerability Investigation & Enrichment

Use these skills to investigate security findings, understand affected assets, and retrieve remediation information.

Skill	Purpose	Permissions Required
Get Tenable findings	Search findings by CVE, asset ID, or finding ID to enrich security investigations.	Basic role and access to the relevant Exposure Management findings.
Get Tenable asset vulnerabilities	List vulnerabilities on an asset and optionally retrieve detection details, remediation guidance, and supporting plugin output.	Basic role for listing vulnerabilities, with access to the requested asset’s vulnerability data. Confirm permissions for the optional detail and plugin-output requests.
Get Tenable vulnerability details	Retrieve vulnerability descriptions, remediation guidance, affected asset information, and optional plugin metadata.	Basic role for the workbench details request. Confirm access for the additional plugin-catalogue request when enabled.
Export Tenable vulnerabilities	Export vulnerability records in bulk for ingestion or historical collection.	Basic role with Can View permission for the assets whose vulnerabilities are exported.

Attack Path Analysis

Use this skill to assess how weaknesses could allow an attacker to reach critical assets.

Skill	Purpose	Permissions Required
Get Tenable attack paths	Retrieve attack paths, affected assets, priority scores, associated techniques, and remediation status.	Basic role and access to the Exposure Management attack-path capability.

Scan Review & Reporting

Use these skills to review scan coverage and retrieve reports for investigations or security reviews.

Skill	Purpose	Permissions Required
Get Tenable scans	List scans or retrieve detailed results for a specific scan or historical run.	Basic role to list scans. Scan Operator role to retrieve a specific scan’s results. Both operations require Can View permission for the relevant scans.
Generate Tenable report	Generate a PDF report summarizing vulnerabilities, plugins, or affected assets.	Basic role for report creation and status retrieval. Validate access through the complete workflow, including downloading the generated report.
Export Tenable scan report	Export the results of a specific scan or historical run in a supported format.	Scan Operator role with Can View permission for the scan. These requirements cover export creation, status polling, and download.

Generate Tenable report produces a template-based report across the selected vulnerability data. Export Tenable scan report exports the results of an individual scan run.

Filter Discovery & Query Preparation

Use this skill to identify valid filters before configuring searches, exports, or reports.

Skill	Purpose	Permissions Required
Get Tenable filter properties	Retrieve supported properties, operators, data types, and allowed values for constructing valid filters.	Basic role for finding-property discovery. Permissions for other resource types depend on the endpoint selected by the skill and require separate validation.

To view the details of Input Parameters and Output for the respective skills

Go to AirMDR → Tenable Integration page.
Select the Skills tab and click on the required listed skills.

Additional Information

🛑 Security & Access Best Practices

✅ Do

Use a dedicated integration account and grant only the required permissions.
Store the Access Key and Secret Key in approved credential storage.
Validate HTTPS certificates and confirm endpoint ownership.
Restrict API access to approved integration outbound IP addresses where applicable.
Coordinate key rotation, update AirMDR, and validate the connection afterward.
Revoke unused credentials when decommissioning the integration.

❌ Don’t

Share a personal administrator account across integrations.
Paste credentials into tickets, messages, documentation, or screenshots.
Disable TLS verification to bypass connection errors.
Add broad IP ranges without reviewing the access impact.
Regenerate keys without checking other applications using the same account.
Leave unused integration accounts active indefinitely.

👉 Support & Maintenance

📧 Contact AirMDR Support through your designated support channel.
📧 Contact Tenable Support for Tenable account, API, or platform issues.
🔁 Rotate credentials regularly. Recommended cadence: As per internal security policy
🔄 Reconnect in AirMDR immediately when API Keys are changed.

🛑 Data Flow & Security

AirMDR sends authenticated requests to Tenable.io. Tenable returns information permitted by the account’s permissions and available product capabilities. AirMDR skills use that information for enrichment, investigation, exports, and reporting.Data Exchanged

Data Type	Examples
Asset information	Asset identifiers, IP addresses, hostnames, operating systems, tags, and exposure information.
Vulnerability information	Findings, CVEs, severity, plugin details, remediation guidance, and detection evidence.
Scan information	Scan status, targets, execution information, and results.
Reports	Generated vulnerability reports and exported scan results.
Attack paths	Associated assets, techniques, priorities, and remediation status, where available.

Network and Security Requirements

Item	Requirement
Destination	`cloud.tenable.com` for the standard commercial service.
Protocol	HTTPS.
Port	TCP 443.
Authentication	`X-ApiKeys` header containing the access and secret keys.
Certificate validation	Keep certificate and hostname verification enabled.
IP restrictions	Permit the approved outbound IP addresses used by the integration, where API allowlisting is configured.
Stored data and credentials	Apply approved AirMDR credential-storage and retention policies. Obtain specific encryption-at-rest details from the applicable platform security documentation.

Review API IP RestrictionsIf your tenant restricts API access by IP address:

Open Settings → Access Control.
Select API Access Security.
Review the configured allowed addresses.
Ensure that the integration’s approved outbound addresses are included.
Account for IPv4 and IPv6 where applicable.

🧰 Error Handling

Symptom	Likely Cause	Recovery Action
Generate is unavailable	API access is disabled for the account.	Ask an administrator to enable API-key access.
HTTP `401`	Invalid, mismatched, or replaced credentials.	Verify both key values and update AirMDR if they were rotated.
HTTP `403` or access denied	Missing permissions, resource restrictions, or unavailable product capabilities.	Review the endpoint requirements, account access, and tenant entitlements.
HTTP `400`	Invalid filters, unsupported properties, or missing inputs.	Check the skill inputs and use Get Tenable filter properties where applicable.
HTTP `404` or an HTML response	Incorrect Base URL or request path.	Verify `https://cloud.tenable.com` and ensure that the Base URL has no UI route or endpoint suffix.
HTTP `429`	API rate limit exceeded.	Honor `Retry-After` and reduce request frequency or concurrent activity.
HTTP `5xx`	Service or upstream processing error.	Retry with a delay. Escalate persistent failures with sanitized diagnostics.
DNS error or timeout	Network, proxy, firewall, or hostname issue.	Test connectivity from the actual execution environment.
TLS validation failure	Untrusted issuer, certificate mismatch, or interception issue.	Correct the trust configuration. Keep certificate verification enabled.
Successful request with empty results	Filters exclude the data, access is restricted, or no matching records exist.	Test against a known resource and review the query scope.
Export or report remains pending	The requested job is still processing.	Follow the skill’s status-polling or resume procedure using the returned job identifier.
Export results are truncated	The configured result limit was reached.	Review `max_records` and the returned truncation indicator; retrieve the required data in appropriately bounded operations.

Tenable documents 401, 429, and 500 responses for the scan-list endpoint. For throttling, the cloud API returns a Retry-Aftervalue indicating how long to wait.

🔄 Monitoring & Logs

Where to Review Activity

Location	What to Review
AirMDR skill or playbook execution details	Connection used, execution status, returned data, and errors.
Tenable.io: Settings → Activity Logs	Relevant user and configuration activity.
Approved network or proxy logs	Connection failures, blocked requests, and routing issues when applicable.

Tenable’s activity logs can be accessed through Settings → Activity Logs. Activity Logs.Recommended LoggingWhere configurable, use:

Level	Use
INFO	Routine execution summaries.
WARN	Rate limiting, retries, or recoverable issues.
ERROR	Failed operations requiring investigation.
DEBUG	Temporary troubleshooting with sensitive information redacted.

Sample Log EntriesThese examples illustrate useful diagnostic information; they are not actual AirMDR log formats.

INFO  integration=tenable operation=list_scans http_status=200
WARN  integration=tenable http_status=429 retry_after_seconds=30
ERROR integration=tenable operation=list_scans http_status=401

Do not log API keys, authentication headers, or unnecessary sensitive asset data.

Getting Started

AirMDR Detections

Integrations

API Reference

AirMDR Product Suite

Pre-requisites

Setup Steps

Option A: Generate Keys for Your Own Account

Option B: Have an Administrator Generate the Keys

Tenable Credential Reference Table

Validate Connectivity

Configure Tenable in AirMDR Integrations Dashboard

Skills provided by this Integration

Additional Information

​Pre-requisites

​Setup Steps

​Option A: Generate Keys for Your Own Account

​Option B: Have an Administrator Generate the Keys

​Tenable Credential Reference Table

​Validate Connectivity

​Configure Tenable in AirMDR Integrations Dashboard

​Skills provided by this Integration

​Additional Information

Pre-requisites

Setup Steps

Option A: Generate Keys for Your Own Account

Option B: Have an Administrator Generate the Keys

Tenable Credential Reference Table

Validate Connectivity

Configure Tenable in AirMDR Integrations Dashboard

Skills provided by this Integration

Additional Information