Seamlessly deploy patches for the vulnerabilities detected by Tenable Security Center (formerly Tenable.sc)

The integration of Tenable Security Center (formerly Tenable.sc) aims to bridge the gap between the detection of vulnerabilities and the deployment of patches. With this integration, IT admins can effortlessly deploy patches from the Patch Manager Plus console for the vulnerabilities detected by Tenable Security Center (formerly Tenable.sc). No more multiple dashboards, No more manual correlations between vulnerabilities and the relevant patches, the Tenable Security Center (formerly Tenable.sc) integration does all the work for you!

Steps to integrate Tenable Security Center (formerly Tenable.sc) with Patch Manager Plus

Generate API keys in Tenable Security Center (formerly Tenable.sc)

• To generate Tenable Security Center (formerly Tenable.sc) API keys, you need to have Security Manager access to Tenable Security Center (formerly Tenable.sc)
• If you have Security Manager privileges, you can generate the required API keys by following this user-guide by Tenable Security Center (formerly Tenable.sc)
• Once you click Generate, Tenable Security Center generates Access key and Secret key.
• Store these keys in a secure location.

Configure API Settings in Patch Manager Plus

• Navigate to Admin > Integration > Threat scanner settings. Only users with Security Manager privileges can configure the API Settings.
• Enter the Tenable Security Center (formerly Tenable.sc) base URL, Access key and the Secret key
• Configure the frequency at which you want the data sync to happen.
• Click on Save to enable the Integration.

Workflow

• After enabling the Integration, Patch Manager Plus will import the vulnerability details and the affected machine details from Tenable Security Center.
• Only the following plugin families are supported now,
  • Windows
  • Windows: Microsoft Bulletins
  • Databases
  • Misc
  • CentOS Local Security Checks
  • Debian Local Security Checks
  • Oracle Linux Local Security Checks
  • Red Hat Local Security Checks
  • Rocky Linux Local Security Checks
  • SUSE Local Security Checks
  • Ubuntu Local Security Checks
  • Amazon Linux Local Security Checks
• Identify the corresponding patch/fix for the respective vulnerabilities and remediate those vulnerabilities by installing the appropriate patch.

• Threats detected by Tenable, with the patch availability, will be listed under Tenable.sc Threats. Users can also deploy patches for vulnerabilities from this view.

FAQs

1) Will the required patches be updated automatically by Tenable or do we need to configure Patch Manager Plus to extract the scan result?

The Tenable API details are required to be configured in the Patch Manager Plus console (one-time setup). Once the integration is set, the vulnerabilities scanned by Tenable would automatically be imported to the Patch Manager Plus console and the required patches will be mapped.

2) Do we need to perform scanning after patching or will the data be automatically updated to Tenable after Patch Manager Plus patches the vulnerabilities?

Once a Manual Deployment task is created in Patch Manager Plus and the patches are successfully deployed, a scan is required to be performed in Tenable (this can also be scheduled). This will update the latest scan results.

3) Can I integrate Patch Manager Plus with Nessus?

Since Nessus does not support APIs for integration, it is not possible to integrate it with Patch Manager Plus.

4) How would patches be deployed to mitigate the vulnerabilities, post-integration?

Upon successful integration, the details of the vulnerabilities scanned by Tenable can be imported to the Patch Manager Plus console. Patches can then be deployed for the required vulnerabilities by creating a Manual Deployment task. Patches would not be automatically deployed (via Automate Patch Deployment tasks) for the imported vulnerabilities.

5) Why are certain vulnerabilities marked as Not Available in terms of Patch Availability?

Patches for vulnerabilities detected by Tenable are mapped by comparing with the imported CVE information. Specifically, only patches supported by Patch Manager Plus will be associated with Tenable-detected vulnerabilities. Check the list of supported applications for reference. Note: Patch Manager Plus currently does not support patching user installed applications.

6) Why are the imported vulnerability details fewer than the data present in Tenable?

Only vulnerabilities associated with certain Tenable plugin families is imported. Additionally, vulnerability details are imported solely for systems accessible to or within the scope of the specific integrated user.