Tenable VM Integration

Introduction

The following guide will help you to integrate Tenable VM with Sprinto.

Tenable Vulnerability Management (VM) is a comprehensive solution designed to identify, assess, and manage vulnerabilities across an organization’s IT infrastructure.

How does this integration help Sprinto

This integration assists Sprinto in retrieving detected vulnerabilities from your Tenable VM account. According to data security compliance standards, all identified vulnerabilities must be resolved within the defined Service Level Agreement (SLA). Once a vulnerability is resolved and its status updated in Tenable VM, Sprinto detects the changes and updates the Sprinto check status to 'passing' for the resolved vulnerability.

Sprinto checks for Tenable VM

Below are the Sprinto checks available for Tenable VM:

Sprinto check	Required action
Tenable vulnerability alerts should be resolved within SLA	A current vulnerability in the “Open” status was detected on your integrated Tenable VM account. Resolve the vulnerability from the source and close the vulnerability from your Halo Security account.

Before you begin

• Log in to the Sprinto admin portal using your credentials.

---

Required Permissions for Tenable VM Integration

To successfully connect Tenable VM with Sprinto, ensure the user configuring the integration has the following minimum role and permissions.

Minimum user role required

• Basic [16] user role (Lowest permission level in Tenable)

Specific permissions required

With the Basic Role [16], a user must have the following specific permissions.

• Can View [16] - Scan permissions (Required for connection validation)

• Can View [64] - Asset permissions (Required to fetch asset data)

• Can View (Access Control) - For the asset objects being exported

  • Recommended scope: All Assets

Alternative Option - Custom Role

If users prefer not to assign the Basic role, they can create a Custom Role with the following permissions enabled:

Platform / Vulnerability Management

• Assets → Read

• Findings → Read

• My Account → Read

• Access Control → Read

• Access Control Users → Read

• Export → Manage All

• General Settings → Read

Scan

• Nessus/Agent Scan → Read

Sensors

• Agent → Read

• Scanner → Read

Web App Scanning

• Web Application Scan → Read

No Manage permissions are required except:

• Export → Manage All

Procedure

Step 1: Generate API Keys in Tenable

1. Log in to your Tenable VM account.

2. Generate your API Key and Secret Key from Tenable.

3. Securely copy both keys — you will need them while configuring the integration in Sprinto.

Refer to Tenable’s official documentation for instructions on generating API credentials.

---

Step 2: Connect Tenable VM in Sprinto

1. Log in to the Sprinto dashboard.

2. Navigate to Settings → Integrations.

3. In the All tab, search for Tenable VM.

4. Click Connect next to Tenable VM.

1. Review the permissions and data usage information shown in the drawer.

2. Click Next.

1. Enter the API Key and Secret Key generated in Step 1.

2. Click Connect.

The integration will now be established.

---

Post-connection Flow

Once the Tenable VM integration is successfully connected, you will remain on:

Settings → Integrations → Tenable VM

The integration status will change to Connected.

From this screen, you can:

• View the list of automated controls and checks.

• Confirm the permissions granted to Sprinto.

• Monitor integration status (Active / Error).

• Reconnect or update credentials if required.

• Disconnect the integration if needed.

---

What happens after connection

• Once you. choose the assets for which they want to fetch vulnerabilities, Sprinto begins syncing asset and vulnerability data from Tenable VM automatically.

• The initial sync may take several minutes depending on your asset volume.

• Control and check statuses update after the first successful data sync.

• Any sync errors will be reflected in the integration status panel.

No additional configuration under Vulnerabilities is required.

---

Troubleshooting

Integration fails to connect

• Ensure the API and Secret keys are copied correctly.

• Verify that the Tenable user has:

  • Basic [16] role

  • Scan, Asset, and Vulnerability view permissions

  • Access Control permission for exported assets

Vulnerabilities are not syncing

• Wait 15–20 minutes after integration.

• Confirm that:

  • Assets fall under the permitted scope (recommended: All Assets).

  • Vulnerabilities are in Open status in Tenable.

Sprinto checks remain failing after resolution

• Ensure the vulnerability status is updated to Closed in Tenable.

• Allow time for Sprinto to re-evaluate the check.

---

Support

Get in touch with our support team if you have any queries related to Tenable VM integration or need any assistance.