Tenable Vulnerability Management Audit Events

Tenable Vulnerability Management provides comprehensive audit logging for monitoring user activities, authentication events, and administrative actions. These logs capture information such as user authentication attempts, scan management operations, API access, and configuration changes. They help administrators track platform usage, ensure compliance, and audit changes for troubleshooting and security analysis.

Ingest Methods

Setup the ingestion of this source using one of the following guides.

• API Polling

API Polling

Tenable supports API polling to collect audit log events from your Tenable Vulnerability Management platform.

Setup

1. Go to Sources in RunReveal
2. Click the Tenable source tile
3. Give it a name and click Connect Source
4. Fill in the required fields with your Tenable API credentials

Tenable API Key Configuration

To generate API keys for RunReveal:

Prerequisites:

• You will need an Administrator role (role ID 64) to access and create API keys

Creating the API Key:

1. Sign in to Tenable Vulnerability Management as an Administrator
2. Go to Settings > My Account
3. Click Generate under the API Keys section
4. Copy both the Access Key and Secret Key immediately
5. Paste the Access Key and Secret Key into the RunReveal source configuration form

Tenable Event Types

The Tenable integration collects comprehensive audit events from your Tenable Vulnerability Management platform. These events provide visibility into user activities, platform operations, and administrative actions across your organization.

Event Categories Collected

User Authentication

• Password Authentication - User login attempts via username and password
• API Key Authentication - API access using access key and secret key pairs
• Session Management - User session creation, expiration, and logout events

Scan Management

• Scan Lifecycle - Scan creation, launch, pause, resume, and completion events
• Scan Configuration - Changes to scan templates, policies, and schedules
• Scanner Management - Scanner group creation, updates, and agent management

Administrative Actions

• User Management - User creation, role changes, group assignments, and account modifications
• Permission Changes - Updates to access controls, roles, and authorization policies
• Configuration Changes - Modifications to platform settings and organization preferences

API Access

• API Operations - REST API calls and their outcomes
• Export Operations - Vulnerability and asset export requests and completions
• Plugin Management - Plugin feed updates and custom plugin modifications

Event Data Structure

Each Tenable audit event includes:

• Actor Information - User ID, name, and authentication context
• Event Details - Action type, CRUD operation, timestamp, and description
• Target Information - Target resource ID, name, and type
• Status Flags - Whether the action was anonymous or resulted in a failure
• Additional Fields - Key-value pairs with extra context about the event

Data Collection

• Collection Method: API polling every 5 minutes
• Data Retention: Tenable provides audit events from the past 3 years
• Event Format: JSON with normalized fields for consistent querying
• Real-time Updates: New events appear in RunReveal within 5-10 minutes

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Helpful Links

• Tenable Audit Log API - API reference for querying audit log events
• Tenable API Authorization - How to generate and use API keys for authentication