Tenable IO Connector

Complete the following prerequisites before configuring the connector in Qualys ETM:

1. Ensure you have a Tenable.io account with at least the Basic (16) role to generate API keys.
2. Generate API keys in Tenable.io. Navigate to Settings > My Account > API Keys tab and click Generate. Copy both the Access Key and Secret Key immediately, as the Secret Key cannot be viewed again after it is generated.
3. Confirm network connectivity: Qualys cloud must be able to reach the Tenable.io API over HTTPS (port 443).
4. Contact your Technical Account Manager (TAM) or Qualys Support to activate the Tenable IO Connector for your subscription, as it is available on demand.

Generating API Keys in Tenable.io

Follow these steps to generate the Access Key and Secret Key required for connector authentication:

1. Log in to Tenable.io at cloud.tenable.com.
2. Navigate to Settings > My Account and select the API Keys tab.
3. Click Generate and confirm the warning message.
4. Copy both the Access Key and Secret Key immediately and store them securely.

One-Time Visibility: The Secret Key cannot be retrieved after you leave the API Keys page. Regenerating API keys replaces any existing keys for the account and revokes the previous credentials.

Reference: Generate API Keys – Tenable Documentation

Permissions Required

The Tenable.io user account generating the API keys must have at least the Basic (16) role. API keys inherit the permissions of the user account, so the account must have sufficient access to view asset and vulnerability data in Tenable.io.

Scope and Data Access

The connector retrieves endpoint and host asset data along with vulnerability findings from Tenable.io. Note the following data access constraints:

• Custom filtering and filter queries are not supported.
• Asset-only data exports from Tenable expire within 24 hours (limit imposed by Tenable).
• Asset plus vulnerability data exports expire within 72 hours (limit imposed by Tenable).
• Import of installed software and source tags is not supported.

Key Rotation

If the Access Key or Secret Key is exposed or needs to be rotated, regenerate the keys in the Tenable.io My Account > API Keys page. Regenerating keys replaces the existing keys and revokes the previous credentials. Update both the Access Key and Secret Key in Qualys ETM using the Edit Connector option.

Configure the connector's identity and authenticate with Tenable.io. A valid connection test is required before proceeding to the next step.

1. Log in to Qualys ETM and navigate to Connectors > Integration.
2. Locate the Tenable IO Connector on the Connector Marketplace and click Add. This is a one-time task. 

If the connector is already added, navigate to My Connectors, search for the Wiz (Cloud Security) connector, and click Manage Connections.

3. Click Manage from the ellipsis menu to open the setup wizard.
4. Click Create Connection. The Setup Guide opens, displaying the Before You Begin checklist alongside four reference tabs: Overview, Auth Setup, Permissions, and Troubleshooting. Review these before proceeding.
5. Click Proceed to Setup.
6. On the Profile & Connectivity page, complete the following fields:

Connector Details

Provide the basic details of the connector.

Authentication Details

Provide the Access Key and Secret Key for Tenable.io in the Auth Details section.

Key Expiry and Regeneration: If keys are regenerated in Tenable.io, the previous keys are automatically revoked. Update both values in Qualys ETM via the Edit Connector option immediately to avoid authentication failures.

After entering credentials, click Test Connection. The wizard runs the following checks:

• Network Reachability — Verifies the API endpoint is reachable.
• TLS Handshake — Confirms a secure connection can be established.
• Authentication Credential Check — Validates the Client ID, Client Secret, and Token URL.
• Authorization Scope Check — Confirms the service account has the required permissions.
• Data Fetch — Verifies that data can be retrieved from the Tenable API.

All checks must pass before you proceed. If a check fails, refer to the Troubleshooting section for resolution steps.

Select the data to ingest from Tenable.io and configure when the connector should run.

1. Data to Sync — Select one of the following options:
   • Assets & Findings — (default) – Imports host asset records and associated vulnerability findings (CVEs) from Tenable.io.
   • Assets — Imports host asset records only, without vulnerability findings.

Data Export Expiration: Asset-only data chunks expire within 24 hours; asset-plus-vulnerability data chunks expire within 72 hours (limits set by Tenable). Ensure the connector schedule allows sufficient time for data processing to complete within these windows.

2. Advanced Settings (optional) — Turn on the Advanced Settings toggle to select the asset classes and finding types that you want to ingest into ETM.
3. Schedule — Under the Schedule section, select an execution frequency from the Occurs dropdown (for example, Daily). The system will display the calculated start date, end date, and timezone for the scheduled run. The schedule configuration supports recurring synchronization, such as Daily.

   Timezone: The schedule timezone is set per connector instance. Verify the correct timezone (for example, Asia/Calcutta or UTC) to ensure sync runs at the intended local time.

   • Daily – Runs automatically once per day at the configured time.
   • Custom – Allows configuration of Single Occurrence or Recurring schedule with explicit Start Date, Start Time, and Timezone Settings.

Advanced Settings

Enabling the Advanced Settings toggle on the Scope & Schedule page or clicking the Advanced Settings link opens a panel with two tabs: Filters and Transform Map.

Filters Tab

Use the Filters tab to restrict which asset types and findings are ingested.

Click Save once the changes are saved in the Advanced Settings panel. Closing without saving discards any modifications.

Transform Map 

The Transform Map tab displays the active data model mapping used to translate Tenable.io source fields into Qualys ETM target fields. The following map is active by default:

• Vulnerability Host Asset Tenable IO Map (Active)

Refer to the Transformation Maps section in Additional Information for the complete field-level mapping details.

Review Severity Mapping  

The Risk Severity Mapping tab defines how CrowdStrike severity values are translated into Qualys severity levels and QDS scores for findings that are not scored automatically by the Qualys Cloud Threat Database.

Qualys automatically updates scores for CVE-based vulnerabilities available in the Qualys Cloud Threat Database. The severity mapping below applies only to findings that are not CVE-based or are not present in the Qualys Cloud Threat Database.

The default Severity is 2. This value is applied when the severity value from CrowdStrike is unavailable for a given finding. 

Review all configuration settings before creating the connector. 

Click Create to save the connector. Click Previous to return to an earlier step to make changes.