Tenable Trigger icon

Tenable Trigger

Triggers workflows based on events from Tenable One platform.

Tenable Trigger

AI-generated

Overview

The Tenable Trigger node is designed to trigger workflows based on various events from the Tenable One platform. It supports monitoring component status changes, new incidents or advisories, new vulnerabilities found in Security Center or Vulnerability Intelligence, and asset discoveries in Vulnerability Management. This node is useful for automating responses to security events, monitoring cloud service statuses, and integrating Tenable security data into broader workflows.

Use Case Examples

  1. Trigger a workflow when a cloud service component status changes to 'Major Outage'.
  2. Trigger a workflow when a new security incident or advisory is published by Tenable.
  3. Trigger a workflow when new vulnerabilities are detected in the Vulnerability Management system.

Properties

Name Meaning
Trigger Type Specifies the type of event to trigger the workflow, such as component status changes, new incidents, new vulnerabilities, or asset discoveries.
Product to Monitor The parent product or service group to monitor for component status events. Only applicable when Trigger Type is 'Component Status'.
Regions to Monitor Specific regions or sub-components to monitor within the selected product. Only applicable when Trigger Type is 'Component Status'.
Status Types to Trigger On The component status types that will trigger the workflow, such as 'Under Maintenance' or 'Major Outage'. Only applicable when Trigger Type is 'Component Status'.
Only Trigger on Status Change If enabled, the workflow triggers only when a component's status changes. If disabled, it triggers on every run with the current status. Only applicable when Trigger Type is 'Component Status'.

Output

JSON

  • componentStatus
    • ``
      * id - ID of the cloud service component.
      * name - Name of the cloud service component.
      * status - Current status of the component.
      * previousStatus - Previous status of the component (only if 'Only Trigger on Status Change' is enabled and status changed).
  • newIncident
    • ``
      * title - Title of the new incident or advisory.
      * link - Link to the incident or advisory details.
  • newVulnerabilitySC
    • ``
      * vulnerabilityDetails - Details of new vulnerabilities found in Tenable Security Center.
  • newVulnerabilityVM
    • ``
      * vulnerabilityDetails - Details of new vulnerabilities found in Vulnerability Intelligence.
  • assetDiscoveredVM
    • ``
      * assetDetails - Details of newly discovered assets in Vulnerability Management.

Dependencies

  • Tenable One API credentials

Troubleshooting

  • Ensure the Tenable One API credentials are correctly configured and have necessary permissions.
  • For 'Component Status' trigger, verify that the selected product and regions are valid and available in the Tenable status API.
  • If no triggers fire, check if the 'Only Trigger on Status Change' option is enabled and if there have been any status changes since the last run.
  • For 'New Incident or Advisory', ensure the RSS feed URL is accessible and returning data.
  • Advanced filtering for Tenable.sc vulnerabilities is not supported; only time-based polling is available, so complex filters will cause errors.

Links

Discussion