Tenable

Proofroom reads Tenable Vulnerability Management (cloud.tenable.com) with the API keys of a dedicated user. It collects your internal scan cadence from scan history, and every open vulnerability with its age and remediation target from the vulnerability export.

Tenable Security Center (on-premises) is not covered; export its findings as CSV and import them on a Scan imports integration.

What each collector shows

Collector	Kind	Default cadence	What it shows	Suggested controls
Internal scans	window	quarterly	Each scan’s runs in the period from its history, with status and targets; which of the last four quarters had a finished internal scan; likely rescans (another run of the same scan within 30 days).	PCI DSS 11.3.1; SOC 2 CC7.1
Open vulnerabilities and remediation	snapshot	monthly	Every open or reopened finding seen in the last year by severity, with its age from first found; those past the remediation target; findings fixed since the last run, with days to fix. A `findings.csv` is attached.	PCI DSS 6.3.1, 6.3.3; SOC 2 CC7.1

Internal or external. Tenable’s scan list does not say where a scan ran from. List the names of your external scans in the settings; every other scan counts as internal. A name that matches no scan fails the run and the connection test, so a typing mistake is never filed as “no external scans”. An imported scan’s run time is when it was imported, not when it scanned, so it is listed as “imported” and never fills a quarter.

Remediation targets. A critical finding is past target when it is still open more than critical days (default 30, PCI DSS 6.3.3) after Tenable first found it; a high finding after high days (default 90). A critical or high finding with no first-found date is never counted as within target. Medium and low have no target, so PCI DSS 11.3.1.1 is not suggested. Informational findings are left out and counted. Findings with a recast severity or accepted risk in Tenable are shown as Tenable reports them, and counted in the notes.

Create the keys

Create a dedicated user for Proofroom. Give it the Scan Operator role (scan history needs it), or a custom role with VM_SCAN read (VM.VM_SCAN.VM_SCAN.READ) and vulnerability export (VM.VM_EXPLORE.VM_EXPLORE.EXPORT).
Give it Can View on the scans and the assets in scope (access groups or permissions).
Sign in as that user, open Settings → My Account → API Keys, and generate keys. Tenable keeps one key pair per user.

Connect

Field	Value
Host	`cloud.tenable.com`, or `fedcloud.tenable.com` for Tenable’s FedRAMP environment
Access key, Secret key	The user’s keys
External scans	Names of scans that scan from outside your network, one per line
Critical days, High days	Your remediation targets

The connection test reads /server/properties, lists the scans and checks every external scan name.

Calls

GET /scans?last_modification_date=<a year ago>, then for each scan GET /scans/{schedule_uuid}/history?limit=50&offset=…&sort=start_date:desc&exclude_rollover=true.
POST /vulns/export with state OPEN and REOPENED, severities low to critical and since a year ago; then a second export with state FIXED and last_fixed at the start of the period. Each export is polled at /vulns/export/{uuid}/status and its chunks are read from /vulns/export/{uuid}/chunks/{id}. An export that ends in ERROR or CANCELLED, or loses a chunk, fails the run; nothing partial is filed.

Tenable’s 429 answers are waited out with retry-after. An identical export already running (409) fails the run, which is retried later.

Known limits

UNVERIFIED: the FedRAMP host name (Tenable’s own pages do not state it); how long an export’s chunks stay available.
Triggered agent scans keep no history in Tenable, so they are not listed as scans; their findings are in the export.
Open findings last seen more than a year ago (assets no longer scanned) are not listed.

Live check

After the first runs, check that the scans list matches Scans → Vulnerability Management Scans for the period, and that the open critical count matches Explore → Findings filtered to Critical with state Active and Resurfaced.