View a markdown version of this page

Source configuration for Tenable Vulnerability Management - Amazon CloudWatch
Integrating with Tenable Vulnerability ManagementPrerequisitesAuthenticating with Tenable Vulnerability ManagementConfigure Authentication for Tenable Vulnerability ManagementConfiguring the CloudWatch PipelineSupported Open Cybersecurity Schema Framework Event Classes
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Source configuration for Tenable Vulnerability Management

Integrating with Tenable Vulnerability Management

CloudWatch pipelines use the Tenable REST API to retrieve asset inventories, vulnerability findings, compliance data, scan results, audit logs, and plugin metadata from your Tenable environment. The API exposes REST and bulk export endpoints that allow fetching security data for monitoring and analysis.

To integrate CloudWatch Pipelines with Tenable Vulnerability Management, complete the following high-level steps:

  • Generate an Access Key and Secret Key from the Tenable UI.

  • Store the credentials in Amazon Secrets Manager.

  • Create a CloudWatch pipeline with Tenable as the data source.

  • Verify that data is flowing into the pipeline.

Prerequisites

Before you begin, make sure you have the following:

  • An active Tenable account with the Administrator role

  • An Amazon account with permissions to create and manage CloudWatch Pipelines

  • An Amazon account with permissions to create, retrieve, and update secrets in Amazon Secrets Manager

  • An Amazon account with permissions to create and manage CloudWatch Logs log groups

Authenticating with Tenable Vulnerability Management

Tenable uses API key authentication with an access key and secret key. The pipeline passes these credentials through the X-ApiKeys header to authenticate each API request.

Configure Authentication for Tenable Vulnerability Management

To configure authentication credentials for the pipeline:

  1. Log in to the Tenable Vulnerability Management UI.

  2. Navigate to Settings > My Account > API Keys.

  3. Generate a new API key pair. Note the Access Key and Secret Key values.

  4. Make sure your account has the Administrator role.

  5. Store the access_key and secret_key in Amazon Secrets Manager.

Configuring the CloudWatch Pipeline

To configure the pipeline, choose Tenable as the data source. Provide the access_key and secret_key. After you create and activate the pipeline, vulnerability management data from Tenable will begin flowing into the selected CloudWatch Logs log group.

The following optional parameters are available:

  • Export settings – chunk_size (default 1000, range 100–10,000), export_backfill (default P30D, range 30 minutes–90 days), export_polling_interval (default P1D, range 30 minutes–7 days)

  • Backfill durations – Configure historical backfill for audit logs, plugins, and scans independently.

  • Polling intervals – Configure independent polling intervals for audit, scan, and plugin streams.

  • Page sizes – Configure the number of records retrieved per API request page.

Supported Open Cybersecurity Schema Framework Event Classes

This integration supports the following OCSF event classes:

  • Device Inventory Info [5001] – Assets

  • Compliance Finding [2003] – Compliance

  • Vulnerability Finding [2002] – Vulnerability

  • Scan Activity [6007] – Scans

  • Authentication [3002] – Audit Logs (authentication-related actions)

  • API Activity [6003] – Audit Logs (API-related actions)

  • Account Change [3001] – Audit Logs (account modification actions)

Plugins are passed as raw data and are not mapped to OCSF event classes.