Seamlessly deploy patches from Patch Manager Plus for the vulnerabilities detected by Tenable.io

The Patch Manager Plus - Tenable.io integration aims at closing the gap between vulnerability detection and remediation(namely patch deployment). With this integration, IT admins can effortlessly deploy patches from the Patch Manager Plus console for the vulnerabilities detected by Tenable.io.

No more multiple dashboards, No more manual correlations between vulnerabilities and the relevant patches, the Patch Manager Plus - Tenable.io integration does all the work for you!

Steps to integrate Tenable.io with Patch Manager Plus

Generate API keys in Tenable.io

• To generate Tenable.io API keys, you need to have Administrator access to Tenable.io.

Note: Administrators need at least Can View access control permission to import the vulnerability details from Tenable.io. Learn more.

• If you have Administrator privileges, you can generate the required API keys by following this user-guide by Tenable.io.
• Once you click Generate, Tenable.io generates an Access key and Secret key.
• Store these keys in a secure location.

Configure API Settings in Patch Manager Plus

• Navigate to Admin > Integration > Threat scanner settings. Only users with Administrator privileges can configure the API Settings.
• Enter the Access key and the Secret key.
• Enable or Disable Asset export from ManageEngine to Tenable.io.

To post asset data, you need to have Administrator access to Tenable.io. Learn more.

• Configure the frequency at which you want the data sync to happen.
• Click on Save to enable the Integration.

Workflow

• After enabling the Integration, Patch Manager Plus will import the vulnerability details and the affected machine details from Tenable.io.
• Only the following plugin families are supported now,
  • Windows
  • Windows: Microsoft Bulletins
  • Databases
  • Misc
  • CentOS Local Security Checks
  • Debian Local Security Checks
  • Oracle Linux Local Security Checks
  • Red Hat Local Security Checks
  • Rocky Linux Local Security Checks
  • SUSE Local Security Checks
  • Ubuntu Local Security Checks
• Identify the corresponding patch/fix for the respective vulnerabilities and remediate those vulnerabilities by installing the appropriate patch.

FAQs

1) Will the required patches be updated automatically by Tenable or do we need to configure Patch Manager Plus to extract the scan result?

The Tenable API details are required to be configured in the Patch Manager Plus console (one-time setup). Once the integration is set, the vulnerabilities scanned by Tenable would automatically be imported to the Patch Manager Plus console and the required patches will be mapped.

2) Do we need to perform scanning after patching or will the data be automatically updated to Tenable after Patch Manager Plus patches the vulnerabilities?

Once a Manual Deployment task is created in Patch Manager Plus and the patches are successfully deployed, a scan is required to be performed in Tenable (this can also be scheduled). This will update the latest scan results.

3) Do we need to install both the Tenable and Patch Manager Plus agents on the systems for a successful integration?

Yes, both the Tenable and Patch Manager Plus agents need to be installed on the systems. This ensures that the patches are automatically mapped to the vulnerabilities scanned by Tenable.

4) Can I integrate Patch Manager Plus with Nessus?

Since Nessus does not support APIs for integration, it is not possible to integrate it with Patch Manager Plus.

5) How would patches be deployed to mitigate the vulnerabilities, post-integration?

Upon successful integration, the details of the vulnerabilities scanned by Tenable can be imported to the Patch Manager Plus console. Patches can then be deployed for the required vulnerabilities by creating a Manual Deployment task. Patches would not be automatically deployed (via Automate Patch Deployment tasks) for the imported vulnerabilities.

6) How can I selectively integrate data from Tenable for a specific group of systems?

To import data for a specific group of systems, you can create an Access Group in Tenable containing only the assets data that you intend to import. Then, you can grant Can View permissions to the created Access Group. Subsequently, use the dedicated user API key for integrating with Patch Manager Plus.

7) Why are certain vulnerabilities marked as Not Available in terms of Patch Availability?

Patches for vulnerabilities detected by Tenable are mapped by comparing with the imported CVE information. Specifically, only patches supported by Patch Manager Plus will be associated with Tenable-detected vulnerabilities. Check the list of supported applications for reference. Note: Patch Manager Plus currently does not support patching user installed applications.

8) Why are the imported vulnerability details fewer than the data present in Tenable?

Only vulnerabilities associated with certain Tenable plugin families is imported. Additionally, vulnerability details are imported solely for systems accessible to or within the scope of the specific integrated user.