# Vulnerability Findings

Retrieves vulnerability data and associated metadata for assets from Tenable, including details like CVE identifiers, CVSS scores, descriptions, solution information, and affected systems.

**Sync Type: Incremental**

 ## Requirements
- Log in to [Tenable.io](https://cloud.tenable.com/#/) and go to the [Create a service account](https://cloud.tenable.com/tio/app.html#/settings/access-control/users) page.
- Enter `Monad Service` as the name.
- Fill out the rest of the service account fields using your organization's usual process.
- Set the **Role** to `Scan Manager` and click **Finish**.
  <img src="/docs/img/tenable/setup.png" className="m-3 rounded-xl"/>
- Click the new service user and select **API Keys** on the left.
  <img src="/docs/img/tenable/api_keys.png" className="m-3 rounded-xl"/>
- Copy the access key and secret key. You'll need them when you set up the Monad connector.

### Details
Monad uses the `since` filter on the [API](https://developer.tenable.com/reference/exports-vulns-request-export) and no others to determine which vulnerabilities to export. This field is updated every time the export is successful with the last export initiation time. as per the tenable documentation linked above... If you do not include the state filter in your request(which we do not), the export includes data for OPEN and REOPENED vulnerabilities that were seen on or after the since date you specify, and FIXED vulnerabilities that were fixed on or after the since date you specify. This means if any vulnerabilities are updated beyond its state its updated data will not be included in the export.

## Configuration
The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

#### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Backfill Start Time | string | No | The date to start fetching data from. If not specified, no past records will be fetched. |
| API Rate Limit | object | No | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. |


#### Secrets

| Secret | Type | Required | Description |
|---------|------|----------|-------------|
| Access Key | string | Yes | Access Key for the Tenable API. This is required to authenticate requests. |
| Secret Key | string | Yes | Secret Key for the Tenable API. This is required to authenticate requests. |


# OCSF Conversion

The following JQ transformation converts Tenable Vulnerability data to OCSF Version 1.0.0-rc.2 compliant format.

## JQ Transformation
```jq
{
  class_uid: 2002, #Vulnerability Finding
  category_uid: 2, #Findings
  type_uid: 200200, #Vulnerability Finding: Unknown
  activity_id: 0, #Unknown
  time: (.scan.started_at | gsub("\\.\\d+Z$"; "") | strptime("%Y-%m-%dT%H:%M:%S") | mktime),
  severity_id: .severity_id,
  metadata: {
    version: "1.1.0",
    product: {
      vendor_name: "Tenable",
      name: "Nessus"
    }
  },
  raw_data: (. | tostring),
  finding_info: {
    title: .plugin.name,
    uid: (.plugin.id | tostring),
    last_seen_time: (.last_found | gsub("\\.\\d+Z$"; "") | strptime("%Y-%m-%dT%H:%M:%S") | mktime),
    first_seen_time: (.first_found | gsub("\\.\\d+Z$"; "") | strptime("%Y-%m-%dT%H:%M:%S") | mktime)
  },
  vulnerabilities: [{
    desc: .plugin.description,
    name: .plugin.name,
    uid: (.plugin.id | tostring),
    cvss: {
      version: "3.0",
      vector: .plugin.cvss3_vector.raw,
      base_score: .plugin.cvss3_base_score
    },
    remediation: {
      desc: .plugin.solution
    }
  }]
}
```

## OCSF Mapping Details

The JQ transformation converts Tenable Vulnerabilities to OCSF Version 1.0.0-rc.2 with the following key mappings:

### Core Fields
- **Class UID**: Set to 2002 (Vulnerability Finding)
- **Category UID**: Set to 2 (Findings)
- **Type UID**: Set to 200200 (Vulnerability Finding: Unknown)
- **Activity ID**: Set to 0 (Unknown)
- **Time**: Extracted from the scan's `started_at` field
    - Strips milliseconds from the ISO timestamp
    - Converts to Unix timestamp format
- **Severity ID**: Maps directly from the vulnerability's `severity_id`

### Finding Information
- **Title**: Maps from the plugin's name
- **UID**: Converts the plugin ID to string format
- **Last Seen Time**: Converts `last_found` timestamp to Unix format
- **First Seen Time**: Converts `first_found` timestamp to Unix format

### Vulnerability Details
- **Description**: Maps from plugin description
- **Name**: Maps from plugin name
- **UID**: Plugin ID in string format
- **CVSS Information**:
    - Version: Set to "3.0"
    - Vector: Maps from raw CVSS3 vector
    - Base Score: Maps from CVSS3 base score
- **Remediation**: Maps solution information from plugin

### Metadata
- **Version**: Set to "1.0.0-rc.2"
- **Product**:
    - Vendor name: "Tenable"
    - Name: "Nessus"

### Customization
The transformation serves as a starting point and can be modified to accommodate specific requirements while maintaining OCSF compliance.
The mapping prioritizes essential asset information and cloud provider detection while providing fallback values for optional fields.

### Related Articles
- [https://developer.tenable.com/reference/exports-vulns-download-chunk](https://developer.tenable.com/reference/exports-vulns-download-chunk)
- [https://docs.tenable.com/vulnerability-management/Content/Settings/access-control/CreateAUserAccount.htm](https://docs.tenable.com/vulnerability-management/Content/Settings/access-control/CreateAUserAccount.htm)
- [https://developer.tenable.com/reference/exports-vulns-request-export](https://developer.tenable.com/reference/exports-vulns-request-export)
- [https://developer.tenable.com/reference/exports-vulns-export-status](https://developer.tenable.com/reference/exports-vulns-export-status)
- [https://developer.tenable.com/reference/exports-vulns-download-chunk](https://developer.tenable.com/reference/exports-vulns-download-chunk)
## Sample Record

```json
{
  "asset": {
    "agent_uuid": "08b52ca9c8a44c0593d6b3f56235c291",
    "device_type": "general-purpose",
    "fqdn": "macbook-air.local",
    "hostname": "John Miller -macbook-air-2.local",
    "uuid": "41fb04af-6de3-49f5-9b76-6cd021f09333",
    "ipv4": "172.240.152.101",
    "ipv6": "fde7:ae64:a9bc:154d:46b:2b3a:1357:cffe",
    "last_authenticated_results": "2025-08-11T23:46:44.387875Z",
    "mac_address": "b2:21:5c:6b:8a:a0",
    "netbios_name": "MacBook-Air",
    "operating_system": [
      "macOS 14.4.1"
    ],
    "network_id": "00000000-0000-0000-0000-000000000000",
    "tracked": true
  },
  "output": "\n  Path              : /Applications/Firefox.app\n  Installed version : 82.0.3\n  Fixed version     : 122.0\n",
  "plugin": {
    "bid": [
      189363
    ],
    "checks_for_default_account": false,
    "checks_for_malware": false,
    "cpe": [
      "cpe:/a:mozilla:firefox"
    ],
    "cvss3_base_score": 8.8,
    "cvss3_temporal_score": 7.7,
    "cvss3_temporal_vector": {
      "exploitability": "Unproven",
      "remediation_level": "Official Fix",
      "report_confidence": "Confirmed",
      "raw": "E:U/RL:O/RC:C"
    },
    "cvss3_vector": {
      "access_complexity": "Low",
      "access_vector": "Network",
      "availability_impact": "High",
      "confidentiality_impact": "High",
      "integrity_impact": "High",
      "raw": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    },
    "cvss_base_score": 10.0,
    "cvss_temporal_score": 7.4,
    "cvss_temporal_vector": {
      "exploitability": "Unproven",
      "remediation_level": "Official Fix",
      "report_confidence": "Confirmed",
      "raw": "E:U/RL:OF/RC:C"
    },
    "cvss_vector": {
      "access_complexity": "Low",
      "access_vector": "Network",
      "authentication": "None required",
      "availability_impact": "Complete",
      "confidentiality_impact": "Complete",
      "integrity_impact": "Complete",
      "raw": "AV:N/AC:L/Au:N/C:C/I:C/A:C"
    },
    "description": "adipiscing pariatur ex proident laborum dolore consectetur consectetur aute incididunt officia aliquip consequat nisi qui eu nostrud commodo minim dolor aute dolore reprehenderit lorem proident dolore mollit in occaecat cillum laborum laborum dolor elit consequat aliquip dolor quis incididunt aute ullamco nulla adipiscing est nisi voluptate in officia laboris qui",
    "exploit_available": false,
    "exploit_framework_canvas": false,
    "exploit_framework_core": false,
    "exploit_framework_d2_elliot": false,
    "exploit_framework_exploithub": false,
    "exploit_framework_metasploit": false,
    "exploitability_ease": "No known exploits are available",
    "exploited_by_malware": false,
    "exploited_by_nessus": false,
    "family": "MacOS X Local Security Checks",
    "family_id": 26,
    "has_patch": true,
    "id": 189363,
    "in_the_news": false,
    "name": "Mozilla Firefox < 122.0",
    "patch_publication_date": "2025-08-11T23:46:44.38792Z",
    "modification_date": "2025-08-11T23:46:44.387921Z",
    "publication_date": "2025-08-11T23:46:44.387923Z",
    "risk_factor": "critical",
    "see_also": [
      "https://www.mozilla.org/en-US/security/advisories/mfsa2024-01/"
    ],
    "solution": "Upgrade to Mozilla Firefox version 122.0 or later.",
    "stig_severity": "I",
    "synopsis": "A web browser installed on the remote macOS or Mac OS X host is affected by multiple vulnerabilities.",
    "unsupported_by_vendor": false,
    "version": "1.7",
    "vuln_publication_date": "2025-08-11T23:46:44.387924Z",
    "xrefs": [
      {
        "type": "CVE",
        "id": "2024-0741"
      },
      {
        "type": "CVE",
        "id": "2024-0742"
      },
      {
        "type": "CVE",
        "id": "2024-0743"
      },
      {
        "type": "CVE",
        "id": "2024-0744"
      },
      {
        "type": "CVE",
        "id": "2024-0745"
      },
      {
        "type": "CVE",
        "id": "2024-0746"
      },
      {
        "type": "CVE",
        "id": "2024-0747"
      },
      {
        "type": "CVE",
        "id": "2024-0748"
      },
      {
        "type": "CVE",
        "id": "2024-0749"
      },
      {
        "type": "CVE",
        "id": "2024-0750"
      },
      {
        "type": "CVE",
        "id": "2024-0751"
      },
      {
        "type": "CVE",
        "id": "2024-0752"
      },
      {
        "type": "CVE",
        "id": "2024-0753"
      },
      {
        "type": "CVE",
        "id": "2024-0754"
      },
      {
        "type": "CVE",
        "id": "2024-0755"
      },
      {
        "type": "IAVA",
        "id": "2024-A-0053-S"
      },
      {
        "type": "IAVA",
        "id": "2024-A-0174-S"
      },
      {
        "type": "IAVA",
        "id": "2024-A-0245-S"
      }
    ],
    "vpr": {
      "score": 6.7,
      "drivers": {
        "age_of_vuln": {
          "lower_bound": 61,
          "upper_bound": 180
        },
        "exploit_code_maturity": "UNPROVEN",
        "cvss_impact_score_predicted": false,
        "cvss3_impact_score": 5.9,
        "threat_intensity_last28": "VERY_LOW",
        "threat_sources_last28": [
          "No recorded events"
        ],
        "product_coverage": "MEDIUM"
      },
      "updated": "2025-08-11T23:46:44.387927Z"
    },
    "cve": [
      "CVE-2024-0741",
      "CVE-2024-0742",
      "CVE-2024-0743",
      "CVE-2024-0744",
      "CVE-2024-0745",
      "CVE-2024-0746",
      "CVE-2024-0747",
      "CVE-2024-0748",
      "CVE-2024-0749",
      "CVE-2024-0750",
      "CVE-2024-0751",
      "CVE-2024-0752",
      "CVE-2024-0753",
      "CVE-2024-0754",
      "CVE-2024-0755"
    ],
    "type": "local"
  },
  "port": {
    "port": 0,
    "protocol": "TCP"
  },
  "scan": {
    "schedule_uuid": "template-382cf2db-8da2-d050-0e26-77fcb89a68a313c4f6712eaeab02",
    "started_at": "2025-08-11T23:46:44.387928Z",
    "uuid": "8fe8810b-e7cb-ef75-6046-25b405133937"
  },
  "severity": " Low",
  "severity_id": "2",
  "severity_default_id": 4,
  "severity_modification_type": "NONE",
  "first_found": "2025-08-11T23:46:44.387976Z",
  "last_found": "2025-08-11T23:46:44.387978Z",
  "state": "OPEN",
  "indexed": "2024-07-08T17:17:08.504884Z",
  "source": "AGENT"
}
```