Skip to content
Release: Australia · Updated: 2026-05-21 · Official documentation · View source

Data transformation for the Tenable Vulnerability Integration

After you identify the data to import, it’s retrieved from the Tenable product and processed through a set of data sources and transforms in your instance.

During installation, normalized severity maps are installed in the Normalized Severity Mapping module. These maps transform imported Tenable severity levels to standard severity levels for processing in your instance. For information about creating severity maps, see Create a Vulnerability Response severity map in the Vulnerability Response documentation.

Tenable.io asset import

Imported asset data is first loaded into the Tenable.io Asset Import [sn_vul_tenable_io_asset_import] Table.

The transform map writes the transformed asset records to the Discovered Items [sn_sec_cmn_src_ci] table.

The Tenable.io Asset Integration transform map is used to transform the imported assets information. Changes to this transform alter how data from the Tenable Asset import is processed. To access this transform map, navigate to System Import Sets > Transform Maps. Search for Tenable.io Asset Transform.

The following table lists the transform map fields by integration.

Source fieldTarget fieldDescription
u_idsource_idTenable provides a unique id for assets and maps to the discovered item record and is used for CI lookup.
u_ipv4sip_addressMaps the first ip value to the ip_address field on the discovered item record.
u_mac_addressesmac_addressMaps the first mac_address value to the mac address field on the discovered item record.
u_fqdnsfqdnMaps the first fqdn value to the fqdn field on the discovered item record.
u_netbios_namesnetbiosMaps the first netbios value to the netbios field on the discovered item record.
u_plugin.cvss4_base_scorev4_base_scoreCVSS v4 base score is mapped to the v4 base score in third-party entry record.
u_plugin.cvss4_threat_scorev4_threat_scoreCVSS v4 threat score is mapped to the v4 threat score in third-party entry record.
u_operating_systemsosMaps the first OS value to the os field on the discovered item record.
(Prior to v14.0 Vulnerability Response and v2.2 of the Tenable Vulnerability Integration)u_last_scan_timelast_scan_dateMaps to the last_scan_date field on the discovered item record.
u_last_authenticated_scan_datelast_auth_scan_dateMaps to the last_auth_scan_date field on the discovered item record.
[script]nameMaps the host name using the script's logic.
u_tags The Tags are saved in sn_sec_cmn_host_tag. The mapping from tags to assets is saved in sn_sec_cmn_m2m_src_ci_tag.
u_serial_numbersource_payloadThe serial number from the Tenable.io asset data is included in the source_payload field on the Discovered Items [sn_sec_cmn_src_ci] record. The source_payload stores the raw source data and is used for CI matching.

There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.

Tenable.io asset transform map script timing and purpose

When the script is runPurpose
onStart (when an import set has started transformation)Initializes the values in the import_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.
onBefore (before an import set has completed transformation).Updates values in the host and verify if the host exists. Based on the results, modifies the values in an import_set. This script is for internal use, and modifying or deleting them isn’t recommended.
onComplete (when an import set has completed transformation).Sets the values of new CIs created, and CIs that have been updated and ignored.This script is for internal use, and modifying or deleting them isn’t recommended.

Tenable.io plugins integration

The Tenable.io plugins transform map is used to transform plugins imported from Tenable.io.

Note: Changes to this transform map alters how data received from the Tenable plugins is processed.

To access this transform map, navigate to System Import Sets > Transform Maps. Search for the Tenable.io Plugin Transform.

The tenable.io plugins payload contains all the fields in the u_attributes column of the sn_vul_tenable_io_plugin_import table. The attributes field is parsed and mapped to the third-party entry table records as listed in the following table.

The transform map writes the transformed plugin data to the Third-Party Entry [sn_vul_third_party_entry] table.

Source fieldTarget fieldDescription
ididMaps id from source and adds the TEN-prefix to it. For example, if the id received is 12345, the id in the target table is TEN-12345.
DescriptionsummaryMaps the description of the plugin to the summary column.
\[script\]sourceThe source for imported third-party entry \(TPE\) is Tenable.io.
\[script\]source\_instanceReference to the Tenable deployment that imports this record.
familycategoryMaps the family of plugin to the category column.
plugin\_modification\_datelast\_modifiedMaps the plugin\_modification\_date to the last modified field.
plugin\_publication\_datedate\_publishedMaps the plugin\_publication\_date to the published date.
has\_patchremediation\_typeMaps the remediation type from has\_patch value.
synopsisthreatMaps the threat information about this vulnerability.
cvss\_base\_\_scorescoreMaps the Common Vulnerability Scoring System \(CVSS\) base score to the score column in third-party entry table.
solutionsolutionMaps the solution provided by scanner to the solution column in the third-party entry table.
exploit\_availableexploitMaps the exploit\_available provided by scanner to the exploit column in the third-party entry table.
vpr.scoresource\_risk\_scoreMaps the vpr score provided by scanner to the source\_risk\_score in the third-party entry table.
\[script\]source\_risk\_ratingMaps the vpr score to the standard risk rating based on the score ranges: - 9–10 – Critical - 7–9 – High - 4–7 – Medium - 0–4 - Low
vpr.drivers.age\_of\_vulnage\_of\_vulnMaps the age of the vulnerability from the scanner to the age\_of\_vuln column in the third-party entry table.
vpr.drivers.exploit\_code\_maturityexploit\_code\_maturityMaps exploit code maturity from the scanner to exploit\_code\_maturity in the third-party entry table.
vpr.drivers.product\_coverageproduct\_coverageMaps product coverage from the scanner to product\_coverage in the third-party entry table.
vpr.drivers.threat\_sources\_last28threat\_sourcesMaps threat sources in the last 28 days from the scanner to the threat\_sources in the third-party table.
vpr.drivers.threat\_intensity\_last28threat\_intensityMaps threat intensity in the last 28 days from the scanner to threat\_intensity in the third-party entry table.
vpr.drivers.threat\_recencythreat\_recencyMaps the threat recency information from scanner to threat\_recency in the third-party entry table.
vpr.drivers.cvss3\_impact\_scorev3\_impact\_subscoreMaps cvss3 impact score to v3\_impact\_subscore column in the third-party entry table.
cvss\_temporal\_scorecvss\_temporal\_scoreMaps the temporal score for CVSS v2.
cvss\_v3\_temporal\_scorev3\_temporal\_scoreMaps the temporal score for CVSS v3.
risk\_factorsource\_severityMaps to the source severity in the third-party entry table.
namenameMaps the name of the plugin to name in third-party entry table.
stig\_severitystig\_severityMaps the vpr score provided by the scanner to the source\_risk\_score in the third-party entry table.
plugin\_typecheck\_typeMaps the plugin type to check\_type in third-party entry table.
unsupported\_by\_vendorunsupported\_by\_vendorMaps the unsupported\_by\_vendor field to the unsupported\_by\_vendor column.
\[script\]exploit\_attack\_vectorThe exploit\_attack\_vector column in the third-party entry table is populated based on exploit\_available and v3\_attack\_vector of columns.
cpesoftware\_rawMaps the raw CPE strings from the plugin payload to the software\_raw column in the third-party entry table, stored as a comma-separated list.
cpevendorVendor names extracted from the CPE data are mapped to the vendor column in the third-party entry table, stored as a comma-separated list.
cpeproductProduct names extracted from the CPE data are mapped to the product column in the third-party entry table, stored as a comma-separated list.

In addition to the direct fields, other information is added as related lists to third-party entries.

Source fieldDescription
cveInserts CVE-related data into the reference table (sn_vul_nvd_entry). If the same Common Vulnerabilities and Exposures (CVE) in the NVD entry table (sn_vul_nvd_entry) is found, it associates the current vulnerability to the NVD entry. The mapping can be found in sn_vul_m2m_entry_cve.
bidThe list of bug traqs is added as a reference.
cpeCPE entries are added as individual related list entries on the third-party entry record, containing vendor, product, version, update, edition, and other CPE attributes.
see_alsoThe list of URLs is added as a reference.
xrefsThe list of X-REF is added as a reference.
[script]The list of exploits for that plugin and inserts mapping for applicable exploit framework and plugin to sn_vul_m2m_framework_vul.

There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.

When the script is runPurpose
onStart (when an import set has started transformation)Initializes the values in the import_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.
onBefore (before an import set has completed transformation).Updates the values in the third-party entry, and verify if the third-party entry exists. Based on the results, modifies the values in a third-party entry. This script is for internal use, and modifying or deleting them isn’t recommended.
onComplete (when an import set has completed transformation).Sets the values of new CIs created, and CIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.

The TenableIOPluginsImportProcessor script include is called from the onBefore transform script. It takes the output from Tenable.io plugins integration and transforms it into ServiceNow AI Platform third-party vulnerability entries. Any changes to this script include may alter the transformation of Tenable.io plugins data in the third-party entry table.

Tenable.io vulnerabilities import

The Tenable.io Vulnerable Item transform map is used to transform open and fixed vulnerabilities information imported from Tenable.io.

Note: Changes to this transform map alter how data from the Tenable Vulnerabilities Import is processed.

The same transform map is used for both the Tenable.io Fixed Vulnerabilities Integration and the Tenable.io Open Vulnerabilities Integration. To access this transform map, navigate to System Import Sets > Transform Maps. Search for the Tenable.io Vulnerable Item transform map.

The transform map writes the transformed vulnerability data to the Vulnerable Item [sn_vul_vulnerable_item] table.

Source fieldTarget fieldDescription
u\_asset.uuididUuid is mapped to the id field of the cmdb\_ci record.
u\_asset.ipv4ip\_addressThe ipv4 field is mapped to the ip address field of the cmdb\_ci record.
u\_asset.last\_authenticated\_resultslast\_auth\_scan\_dateThe last authenticated scan date is mapped to the last auth scan date of the cmdb\_ci record.
u\_asset.mac\_addessmac\_addressMac address is mapped to the host mac address field of the cmdb\_ci record.
u\_asset.netbios\_namenetbiosNetbios is mapped to the netbios field of cmdb\_ci record.
u.\_plugin.cvss3\_base\_scorev3\_base\_scoreCVSS v3 base score is mapped to the v3 base score of the third-party entry record. These changes will be implemented as part of Tenable 5.2.1 Version.
u.\_plugin.cvss3\_temporal\_scorev3\_temporal\_scoreCVSS v3 temporal score is mapped to the v3 temporal score in the third-party entry record. These changes will be implemented as part of Tenable 5.2.1 Version.
u.\_plugin.cvss\_base\_scorescoreCVSS base score is mapped to the score field of the third-party entry record.
u.\_plugin.cvss\_temporal\_scoretemporal\_scoreTemporal Score is mapped to the temporal score in the third-party entry record.
u\_plugin.descriptionsummaryDescription is mapped to the summary field in the third-party entry record.
u\_plugin.familycategoryMaps the family of plugin to the category column of the third-party entry record.
u\_plugin.modification\_datelast\_modifiedLast modified date is mapped to the plugin last modified date in the third-party entry record.
u\_plugin.publication\_datedate\_publishedPublication date is mapped to the date published field of the third-party entry record.
u\_plugin.risk\_factorsource\_severityRisk factor is mapped to the source\_severity field of the third-party entry record.
u\_plugin.solutionsolutionSolution is mapped to the solution field of the third-party entry record.
u\_plugin.synopsisthreatSynopsis is mapped to the threat field of the third-party entry record.
u\_severity\_idpriorityPriority is mapped to the severity id from the payload. The default value is 5.
u\_plugin.exploit\_availableexploitMaps the exploit\_available provided by the scanner to the exploit column in the third-party entry table.
vpr.scoresource\_risk\_scoreMaps the vpr score provided by the scanner to the source\_risk\_score in the third-party entry table.
\[script\]source\_risk\_ratingMaps the vpr score to the standard risk rating based on the score ranges:- 9–10 – Critical - 7–9 – High - 4–7 – Medium - 0–4 - Low
u\_plugin.vpr.drivers.age\_of\_vulnage\_of\_vulnMaps the age of vulnerability from the scanner to age\_of\_vuln in the third-party entry table.
u\_plugin.vpr.drivers.exploit\_code\_maturityexploit\_code\_maturityMaps exploit code maturity from the scanner to exploit\_code\_maturity in the third-party entry table.
u\_plugin.vpr.drivers.product\_coverageproduct\_coverageMaps product coverage from the scanner to product\_coverage in the third-party entry table.
u\_plugin.vpr.drivers.threat\_sources\_last28threat\_sourcesMaps threat sources in the last 28 days from the scanner to threat\_sources in the third-party entry table.
u\_plugin.vpr.drivers.threat\_intensity\_last28threat\_intensityMaps threat intensity in the last 28 days from the scanner to threat\_intensity in the third-party entry table.
u\_plugin.vpr.drivers.threat\_recencythreat\_recencyMaps the threat recency information from the scanner to threat\_recency in the third-party entry table.
u\_plugin.vpr.drivers.cvss3\_impact\_scorev3\_impact\_subscoreMaps CVSS3 v3 impact score to v3\_impact\_subscore column in the third-party entry table.
u\_plugin.typecheck\_typeMaps the plugin type to check\_type in third-party entry table.
u\_plugin.unsupported\_by\_vendorunsupported\_by\_vendorMaps the unsupported\_by\_vendor field in plugin to the unsupported\_by\_vendor column.
\[script\]exploit\_attack\_vectorThe exploit\_attack\_vector column in the third-party entry table is populated based on exploit\_available and v3\_attack\_vector of columns.
U\_plugin.on\_cisa\_kevcisa\_existsMaps on\_cisa\_kev field with cisa\_exists in third-party entry table.
u\_plugin.family\_idFamily\_idMaps the plugin Family id to family\_id column in third-party entry table.
portportPort is mapped to the port field of the vulnerable item record.
protocolprotocolProtocol is mapped to the protocol field of the vulnerable item record.
u\_first\_foundfirst\_foundFirst found is mapped to the first found field of the vulnerable item record.
u\_last\_foundlast\_foundLast found is mapped to the last found field of the vulnerable item record.
u\_statestateState is mapped to the State field in the vulnerable item record
\[script\]sourceThe source of the integration is populated. The vulnerable items created from this integration have Tenable.io as the source.
\[script\]integration\_instanceThe integration\_instance is the name of the instance from which the vulnerable item is imported.
u\_plugin.namenameMaps the name of the plugin to name in third-party entry table.
u\_plugin.stig\_severitystig\_severityMaps the stig severity of the plugin to stig severity column in third-party entry table
u\_plugin.vpr\_v2.malware\_observations\_intensity\_last30vprv2\_malware\_observations\_intensityMaps the VPRv2 malware\_observations\_intensity\_last30 value to the vprv2\_malware\_observations\_intensity field in the Tenable TPE Additional Attributes table.
u\_plugin.vpr\_v2.targeted\_industriesvprv2\_targeted\_industriesMaps the VPRv2 targeted\_industries value to the vprv2\_targeted\_industries field in the Tenable TPE Additional Attributes table.
u\_plugin.vpr\_v2.targeted\_regionsvprv2\_targeted\_regionsMaps the VPRv2 targeted\_regions value to the vprv2\_targeted\_regions field in the Tenable TPE Additional Attributes table.
u\_plugin.vpr\_v2.threat\_summaryvprv2\_threat\_summaryMaps the VPRv2 threat\_summary value to the vprv2\_threat\_summary field in the Tenable TPE Additional Attributes table.
u\_plugin.vpr\_v2.remediationvprv2\_remediationMaps the VPRv2 remediation value to the vprv2\_remediation field in the Tenable TPE Additional Attributes table.
u\_plugin.d2\_elliot\_named2\_elliot\_nameMaps the d2\_elliot\_name value to the d2\_elliot\_name field in the Tenable TPE Additional Attributes table.
u\_plugin.canvas\_packagecanvas\_packageMaps the canvas\_package value to the canvas\_package field in the Tenable TPE Additional Attributes table.
u\_plugin. checks\_for\_default\_accountchecks\_for\_default\_accountMaps the checks\_for\_default\_account value to the checks\_for\_default\_account field in the Tenable TPE Additional Attributes table.
u\_plugin.checks\_for\_malwarechecks\_for\_malwareMaps the checks\_for\_malware value to the checks\_for\_malware field in the Tenable TPE Additional Attributes table.
u\_plugin.exploitability\_easeexploitability\_easeMaps the exploitability\_ease value to the exploitability\_ease field in the Tenable TPE Additional Attributes table.
u\_plugin.exploithub\_skuexploithub\_skuMaps the exploithub\_sku value to the exploithub\_sku field in the Tenable TPE Additional Attributes table.
u\_plugin.in\_the\_newsin\_the\_newsMaps the in\_the\_news value to the in\_the\_news field in the Tenable TPE Additional Attributes table.
u\_plugin.metasploit\_namemetasploit\_nameMaps the metasploit\_name value to the metasploit\_name field in the Tenable TPE Additional Attributes table.
u\_plugin.ms\_bulletinms\_bulletinMaps the ms\_bulletin value to the ms\_bulletin field in the Tenable TPE Additional Attributes table.
u\_plugin.usnusnMaps the usn value to the usn field in the Tenable TPE Additional Attributes table.
u\_plugin.versionversionMaps the version value to the version field in the Tenable TPE Additional Attributes table.
u\_plugin.vuln\_publication\_datevuln\_publication\_dateMaps the vuln\_publication\_date value to the vuln\_publication\_date field in the Tenable TPE Additional Attributes table.
u\_plugin.workaroundworkaroundMaps the workaround value to the workaround field in the Tenable TPE Additional Attributes table.
u\_plugin.workaround\_typeworkaround\_typeMaps the workaround\_type value to the workaround\_type field in the Tenable TPE Additional Attributes table.
u\_plugin.workaround\_publishedworkaround\_publishedMaps the workaround\_published value to the workaround\_published field in the Tenable TPE Additional Attributes table.
u\_plugin.vendor\_unpatchedvendor\_unpatchedMaps the vendor\_unpatched value to the vendor\_unpatched field in the Tenable TPE Additional Attributes table.
u\_plugin.has\_workaroundhas\_workaroundMaps the has\_workaround value to the has\_workaround field in the Tenable TPE Additional Attributes table.
u\_plugin.vendor\_severityvendor\_severityMaps the vendor\_severity value to the vendor\_severity field in the Tenable TPE Additional Attributes table.
u\_plugin.vpr\_v2.cve\_idvprv2\_cve\_idMaps the VPRv2 cve\_id value to the vprv2\_cve\_id field in the Tenable TPE Additional Attributes table.
u\_plugin.epss\_scoreepss\_scoreMaps the epss\_score value to the epss\_score field in the Tenable TPE Additional Attributes table.

In addition to the direct fields, other information is added as related lists to third-party entries.

Source fieldDescription
cveInserts CVE-related data into the reference table (sn_vul_nvd_entry). If the same CVE in the NVD entry table (sn_vul_nvd_entry) is found, it associates the current vulnerability to the NVD entry. The mapping can be found in sn_vul_m2m_entry_cve.
bidThe list of bug traqs is added as a reference.
see_alsoThe list of URLs is added as a reference.
xrefsThe list of X-REF is added as a reference.
[script]The list of exploits for that plugin and Inserts mapping for applicable exploit framework and plugin to sn_vul_m2m_framework_vul.

There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.

When the script is runPurpose
onStart (when an import set has started transformation)TTriggers Tenable IO Vulnerabilities Processor which imports data from Tenable.io using the import set and loads each record into the CMDB CI table, the Vulnerable Items table, and the Third-party vulnerability table. This script is for internal use, and modifying or deleting them isn’t recommended.
onBefore (before an import set has completed transformation).Checks if the Third-Party Entry and Detections exist. If not, these records are created in their respective tables. isn’tThis script is for internal use, and modifying or deleting them is not recommended.
onComplete (when an import set has completed transformation).Updates the count of CIs, VITs, and Detections as imported from Tenable.io. This script is for internal use, and modifying or deleting them isn’t recommended.

Tenable.io compliance results integration

Tenable.io Compliance Results transform map enables you to import secure configuration assessment findings from Tenable.io into ServiceNow. This integration leverages Tenable’s compliance export APIs to retrieve test results on assets, supporting regular differential imports to keep data up to date.

Imported data is first loaded into the Tenable.io Test Results Import [sn_vul_tenable_io_tr_import] table.

To access the transform map, navigate to System Import Sets > Transform Maps. Search for Tenable.io Compliance Results Transform.

The following table lists the transform map fields by integration.

Source fieldTableTarget fieldDescription
asset_uuidsn_vulc_resultsn_sec_cmn_src_ci -> source_idUnique identifier for the asset in Tenable.io, mapped to the corresponding CMDB CI in ServiceNow after transformation.
first_seensn_vulc_resultfirst_seenDate and time when the compliance check was first observed on the asset.
last_seensn_vulc_resultlast_seenDate and time when the compliance check was last observed on the asset.
audit_filesn_vulc_policyshort_descriptionName or identifier of the audit file used for the compliance check.
check_idsn_vulc_testsource_idUnique identifier for the compliance check within Tenable.io.
check_namesn_vulc_testshort_descriptionHuman-readable name of the compliance check.
check_infosn_vulc_testdescriptionDetailed information about the compliance check, including its purpose and context.
expected_valuesn_vulc_resultexpected_valuesThe value expected for the configuration setting according to the compliance policy.
actual_valuesn_vulc_resultactual_valuesThe actual value found on the asset during the compliance check.
statussn_vulc_resultresultResult of the compliance evaluation. Possible values (from Tenable): PASSED, FAILED.
see_alsosn_vulc_resultremediationAdditional references or links for remediation guidance.
reference.frameworksn_vulc_auth_srcshort_descriptionCompliance framework associated with the check (e.g., CIS, NIST).
reference.controlsn_vulc_citationsectionSpecific control or section within the compliance framework.
solutionsn_vulc_testremediationRecommended steps to remediate the compliance failure.
profile_namesn_vulc_citationsection_nameName of the compliance profile or benchmark applied.
db_typesn_vulc_technologynameDatabase type or technology associated with the compliance check.

Note: Tenable does not provide a risk score for compliance test results. ServiceNow calculates risk scores using Configuration Compliance calculators and applies the default Medium risk value of 20 when no risk score is available. To ensure accurate prioritization, review and customize the risk calculator rules to reflect your organization’s priorities.

For more information, see Configuration Compliance calculators and calculator rules.

Tenable.sc asset import

Asset data imported from Tenable.sc is first loaded into the Tenable.sc Asset Import table (sn_vul_tenable_sc_asset_import). The Tenable.sc Asset Integration transform map is used to transform the imported assets information. Changes to this transform alter how data from the Tenable Asset import is Processed. To access this transform map, navigate to System Import Sets > Transform Maps. Search for the Tenable.sc Asset Transform.

The transform map writes the transformed asset records to the Discovered Items [sn_sec_cmn_src_ci] table.

Source fieldTarget fieldDescription
u_uuididThe uuid isn’t populated from the Tenable API, so the ‘u_uniqueness’ attribute is used to create a unique uuid field for assets and map it to the Discovered Items [sn_sec_cmn_src_ci] record.
u_ipsource_payloadThe IP address from the Tenable.sc API is stored in the source_payload field on the Discovered Items [sn_sec_cmn_src_ci] record for CI matching and lookup purposes.
u_macaddressmac_addressMaps the mac address field from the API to the address field on the Discovered Items [sn_sec_cmn_src_ci] record.
u_dnsnamefqdnMaps the dnsname field from the API to the fqdn field on the Discovered Items [sn_sec_cmn_src_ci] record.
u_netbiosnamenetbiosMaps the netbios field from the API to the netbios field on the Discovered Items [sn_sec_cmn_src_ci] record.
u_oscpeosThe OS information is extracted from the oscpe attribute in the payload and maps it to the os field on the Discovered Items [sn_sec_cmn_src_ci] record.
u_lastauthrunlast_auth_scan_dateMaps the lastauthrun field from the API to the last_auth_scan_date field on the discovered item record.
u_lastauthrun and u_lastunauthrunlast_scan_dateThe lastauthrun is extracted from the Tenable API or lastunauthrun. The last_scan_date field on the discovered item record is populated based on the value that appears in the payload.

There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.

When the script is runPurpose
onStart (when an import set has started transformation)Initializes the values in the import_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.
onBefore (before an import set has completed transformation).Updates the values in the host and verify if the host exists. Based on the results, modifies the values in an import_set. This script is for internal use, and modifying or deleting them isn’t recommended.
onComplete (when an import set has completed transformation).Sets the values of new CIs created, and CIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.

Tenable.sc plugins import

Plugins data imported from Tenable.sc is first loaded into the Tenable.sc Plugins Import table (sn_vul_tenable_sc_plugin_import). The Tenable.sc Plugin Transform Map is used to transform the plugins information that has been imported. Changes to this transform alter how data from the Tenable Plugin import is Processed. To access this transform map, navigate to System Import Sets > Transform Maps. Search for Tenable.sc Plugin Transform Map.

The transform map writes the transformed plugin data to the Third-Party Entry [sn_vul_third_party_entry] table.

Source fieldTarget fieldDescription
u\_ididMaps id from source and adds the TEN-prefix. For example, if the id received is 12345, the id in the target table is TEN-12345.
u\_descriptionsummaryMaps the description of the plugin to the summary column.
\[script\]sourceImported TPE from this integration has Tenable.sc as the source.
\[script\]source\_instanceReference to the Tenable deployment that imports this record.
u\_familycategoryMaps the name field in family object of plugin to the category column.
u\_plugin\_modification\_datelast\_modifiedMaps the plugin\_modification\_date to the last modified field.
u\_plugin\_publication\_datedate\_publishedMaps the plugin\_publication\_date to published date.
u\_has\_patchRemediation\_typeMaps the remediation type from has\_patch value.
u\_synopsisthreatMaps the threat information about this vulnerability.
u\_cvss\_base\_scorescoreMaps the CVSS base score to the score column in third-party entry table.
u\_solutionsolutionMaps the solution provided by the scanner to the solution column in the third-party entry table.
u\_cvss\_temporal\_scorecvss\_temporal\_scoreMaps the temporal score for CVSS v2.
u\_cvss\_v3\_temporal\_scorev3\_temporal\_scoreMaps the temporal score for CVSS v3.
u\_risk\_factorsource severityMaps to the source severity in the third-party entry table.
u\_cvss\_v3\_base\_scorev3\_base\_scoreMaps the CVSS base score in the third-party entry table.
u\_exploit\_availableexploitMaps the exploitAvailable provided by the scanner to the exploit column in the third-party entry table.
u\_vpr\_scoresource\_risk\_scoreMaps VPR score from the scanner to the Source risk score in the third-party entry table.
\[script\]source\_risk\_ratingMaps the vpr score to the standard risk rating based on the score ranges:- 9–10 – Critical - 7–9 – High - 4–7 – Medium - 0–4 - Low
u\_vpr\_context\[id=age\_of\_vuln\]age\_of\_vulnMaps the age of the vulnerability from the scanner to age\_of\_vuln in the third-party entry table.
u\_vpr\_context\[id=exploit\_code\_maturity\]exploit\_code\_maturityMaps exploit code maturity from the scanner to exploit\_code\_maturity in the third-party entry table.
u\_vpr\_context\[id=product\_coverage\]product\_coverageMaps product coverage from the scanner to product\_coverage in the third-party entry table.
u\_vpr\_context\[id=”threat\_sources\_last\_28\]threat\_sourcesMaps threat sources in the last 28 days from scanner to threat\_sources in the third-party table.
u\_vpr\_context\[id=”threat\_intensity\_last\_28\]threat\_intensityMaps threat intensity in the last 28 days from the scanner to threat\_intensity in the third-party entry table.
u\_vpr\_context\[id=”threat\_recency”\]threat\_recencyMaps the threat recency information from the scanner to threat\_recency in the third-part entry table.
u\_vpr\_context\[id=cvssV3\_impactScore\]v3\_impact\_subscoreMaps CVSS v3 impact score from the scanner to v3\_impact\_subscore in the third-party entry table.
u\_namenameMaps the name of the plugin to the name column in the third-party entry table.
u\_stig\_severitystig\_severityMaps the stig\_severity field in the plugin to stig\_severity in the third-party entry table.
u\_check\_typecheck\_typeMaps the check type to check\_type in the third-party entry table.
u\_family.idfamily\_idMaps the plugin family\_id to family\_id in the third-party entry table.
\[script\]exploit\_attack\_vectorThe exploit\_attack\_vector column in the third-party entry table is populated based on exploit\_available and v3\_attack\_vector of columns.
u\_cpesoftware\_rawMaps the raw CPE strings from the Tenable.sc plugin import to the software\_raw column in the third-party entry table, stored as a comma-separated list.
u\_cpevendorVendor names extracted from the CPE data are mapped to the vendor column in the third-party entry table, stored as a comma-separated list.
u\_cpeproductProduct names extracted from the CPE data are mapped to the product column in the third-party entry table, stored as a comma-separated list.

In addition to the direct fields, other information is added as related lists to third-party entries.

Source fieldDescription
u_cpeThe list of CPEs is added as a reference.
u_see_alsoThe list of URLs is added as a reference.
u_exploit_frameworksThe list of exploits for that plugin and inserts mapping for applicable exploit framework and plugin to sn_vul_m2m_framework_vul.

There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.

When the script is runPurpose
onStart (when an import set has started transformation)This transform is used to initialize the values in the import_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.
onBefore (before an import set has completed transformation).Function used to update the values in the third-party entry and verify if the third-party entry exists. Based on the results, modifies the values in a third-party entry. This script is for internal use, and modifying or deleting them isn’t recommended.
onComplete (when an import set has completed transformation).This transform is used to set the values of Plugins created and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.

The TenableSCPluginsImportProcessor script include is called from the onBefore transform script. It takes the output from the Tenable.sc plugins integration and transforms it into ServiceNow third-party vulnerability entries. Any changes to this script include may alter the transformation of Tenable.sc plugins data in the third-party entry table.

Tenable.sc vulnerabilities import

The Tenable.sc Open Vulnerabilities transform map is used to transform imported data from the Tenable.sc Open Vulnerabilities integration, and the Tenable.sc and Fixed Vulnerabilities transform map is used to transform imported data from the Tenable.sc Fixed Vulnerabilities Integration.

Note: Changes to these transform maps alter how data from the Fixed/Open Tenable Vulnerabilities Import is processed.

To access the Tenable.sc Open and Fixed Vulnerabilities transform maps, navigate to Tenable Vulnerability Integration > Administration > Integration Instances > Tenable.sc Fixed/Open Vulnerabilities Integration > Data Sources > Tenable.sc Open/Fixed Vulnerabilities > Tranforms.

The transform maps write the transformed vulnerability data to the Vulnerable Item [sn_vul_vulnerable_item] table.

Source fieldTarget fieldDescription
u\_pluginIDIdUsed as the identifier for the plugin. This field is mapped to the plugin Id in the third-party entry record.
u\_riskfactorsource\_severityThis field is mapped to source\_severity in the third-party entry record.
u\_severitypriorityThe priority field is mapped with the severity. The default value is 5.
u\_hasbeenmitigatedstateHas been mitigated is mapped to the state field of vulnerability record. For the Fixed vulnerabilities integration, all the VIs are in the 'Closed' state.
u\_ipip\_addressIp address is mapped to the host ip field of cmdb\_ci table.
u\_portportPort is mapped to the port field of the vulnerable item record.
u\_protocolprotocolProtocol is mapped to the port field of the vulnerfable item record.
u\_firstSeenfirst\_foundThe first seen value is mapped to the first found field of the VI record.
u\_lastSeenlast\_foundThe last seen value is mapped to the last found field of the VI record.
u\_exploitAvailableexploitExploitAvailable is mapped to the exploit field in the third-party entry record.
u\_synopsisthreatSynopsis is mapped to the threat field in the third-party entry record.
u\_descriptionsummaryDescription is mapped to the summary field in the third-party entry record.
u\_solutionsolutionSolution is mapped to the solution field in the third-party entry record.
u\_basescorescoreBaseScore is mapped to the score field in the third-party entry record.
u\_temporalScoretemporal\_scoreTemporal Score is mapped to the temporal score in the third-party entry record.
u\_cvssv3basescorev3\_base\_scoreCvssv3basescore is mapped to the v3 base score in the third-party entry record.
u\_cvsstemporalscorev3\_temporal\_scoreCvssv3temporal score is mapped to the v3 temporal score in the third-party entry record.
u\_pluginpubdatedate\_publishedPlugin published date is mapped to the plugin published date in the third-party entry record.
u\_pluginmoddatelast\_modifiedLast modified date is mapped to the plugin last modified date in the third-party entry record.
u\_dnsnamefqdnDnsName is mapped to the FQDN field of the cmdb\_ci record.
u\_macaddressmac\_addressMacAddress is mapped to the mac\_address field of the cmdb\_ci record.
u\_netbiosNamenetbiosNetbiosName is mapped to the NETBIOS field of the cmdb\_ci record.
u\_ipipIP is mapped to the IP field of cmdb\_ci record.
hostUniquenessuuidHost uniqueness is not mapped to any field but is used to determine uuid for the host.
u\_familycategoryMaps the name field in the family object of the plugin to the category column of third-party entry record.
u\_plugintextproofPlugin text is mapped to proof in tpe record.
\[script\]sourceThe source of the integration is populated. The vulnerable items created from this integration have Tenable.sc as the source.
\[script\}integration\_instanceThe integration\_instance is the name of the instance from which the vulnerable item is imported.
u\_vpr\_scoresource\_risk\_scoreMaps VPR score from the scanner to the Source risk score in the third-party entry table.
\[script\]source\_risk\_ratingMaps the vpr score to the standard risk rating based on the score ranges:- 9 - 10 – Critical - 7 – 9 – High - 4–7 – Medium - 0–4 - Low
u\_vpr\_context\[id=age\_of\_vuln\]age\_of\_vulnMaps the age of the vulnerability from the scanner to age\_of\_vuln in the third-party entry table.
u\_vpr\_context\[id=exploit\_code\_maturity\]exploit\_code\_maturityMaps exploit code maturity from the scanner to exploit\_code\_maturity in the third-party entry table.
u\_vpr\_context\[id=product\_coverage\]product\_coverageMaps product coverage from the scanner to product\_coverage in the third-party entry table.
u\_vpr\_context\[id=”threat\_sources\_last\_28\]threat\_sourcesMaps threat sources in the last 28 days from the scanner to threat\_sources in the third-party table.
u\_vpr\_context\[id=”threat\_intensity\_last\_28\]threat\_intensityMaps threat intensity in the last 28 days from the scanner to threat\_intensity in the third-party entry table.
u\_vpr\_context\[id=”threat\_recency”\]threat\_recencyMaps the threat recency information from the scanner to threat\_recency in the third-part entry table.
u\_vpr\_context\[id=cvssV3\_impactScore\]v3\_impact\_subscoreMaps CVSS v3 impact score from the scanner to v3\_impact\_subscore in the third-party entry table.
u\_pluginnamenameMaps the name of the plugin to name column in third-party entry table.
u\_stigseveritystig\_severityMaps the stig\_severity field in the plugin to stig\_severity in third-party entry table.
u\_checktypecheck\_typeMaps the check type to check\_type in third-party entry table.
u\_family.idfamily\_idMaps the plugin family.id to family\_id in the third-party entry table.
\[script\]exploit\_attack\_vectorThe exploit\_attack\_vector column in the third\_party\_entry table is populated based on exploit\_available and v3\_attack\_vector of columns.
Source fieldDescription
u_cveInserts CVE-related data into the reference table (sn_vul_nvd_entry). If the same CVE in the NVD entry table (sn_vul_nvd_entry) is found, it associates the current vulnerability to the NVD entry. The mapping is found in sn_vul_m2m_entry_cve.
u_bidThe list of bug traqs is added as a reference.
u_cpeThe list of CPEs is added as a reference.
u_seealsoThe list of URLs is added as a reference.
u_xrefsThe list of X-REFs is added as a reference.
u_exploitframeworksThe list of exploits for that plugin and Inserts mapping for applicable exploit framework and plugin to sn_vul_m2m_framework_vul.

There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.

When the script is runPurpose
onStart (when an import set has started transformation)This transform is used to initialize the values in the import_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.
onBefore (before an import set has completed transformation).Function used to update the values in the vulnerability and verify if the vulnerability exists. Based on the results, modifies the values in a vulnerable items table. This script is for internal use, and modifying or deleting them isn’t recommended.
onComplete (when an import set has completed transformation).This transform is used to set the values of new VIs created, and VIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.

Tenable.cs container asset import

Imported asset data is first loaded into the Tenable.cs Container Asset Import [sn_vul_tenable_cs_container_asset_import] Table.

The Tenable.cs Container Asset transform map is used to transform the imported assets information. Changes to this transform alter how data from the Tenable.cs Container Asset import is processed. To access this transform map, navigate to System Import Sets > Transform Maps. Search for Tenable.cs Container Asset Transform.

The following tables lists the transform map fields by integration.

Source fieldTarget fieldDescription
u_digestImage_idTenable provides a unique digest for the container assets and maps to the discovered container image and docker image record and is used for CI lookup.
u_digestImage_digestTenable provides a unique digest for the container assets and maps to the discovered container image and docker image record and is used for CI lookup.
u_namenameMaps to the name field of the docker image record.
u_repositoryurinameMaps to the container repository record
u_repositoryurirepoMaps to the discovered container image record.
u_virtualmachineshost_listMaps to the discovered container image record
u_labelsImage_labelsMaps the labels assigned to the container image to the image_labels field of the discovered container image record.
u_clustersimage_clusterMaps to the discovered container image record
u_imagetagstagsMaps to the discovered container image record
u_cloudprovidercloud_providersMaps to the discovered container image record
u_accountidcloud_account_idsMaps to the discovered container image record
u_regioncloud_regionsMaps to the discovered container image record
u_operatingsystemosMaps to the discovered container image record
u_scantimelast_scan_dateMaps to the discovered container image record

There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.

When the script is runPurpose
onStart \(when an import set has started transformation\)This transform is used to initialize the values in the import\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.
onBefore \(before an import set has completed transformation\).A function used to update values in the host and verify if the host exists. Based on the results, modifies the values in an import\_set. This script is for internal use, and modifying or deleting them isn’t recommended.
onComplete \(when an import set has completed transformation\).This transform is used to set the values of new CIs created, and CIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.

Tenable.cs container vulnerability import

Imported container vulnerability data is first loaded into the Tenable.cs Container Vulnerability Import [sn_vul_tenable_cs_container_vuln_import] Table.

The Tenable.cs Container Vuln transform map is used to transform the imported container vulnerability information. Changes to this transform alter how data from the Tenable.cs Container Vulnerability Import is processed. To access this transform map, navigate to System Import Sets > Transform Maps. Search for Tenable.cs Container Vuln Transform.

The following tables list the transform map fields by integration.

Source fieldTarget fieldDescription
[script]Image_idDigest is extracted from the Resource.Id field from the API and mapped to image_id field of discovered container image and docker image record.
[script]Image_digestDigest is extracted from the Resource.Id field from the API and mapped to image_digest field of discovered container image and docker image record.
[script]nameRepository information is extracted from name field and mapped to docker image and container repository record.
[script]repoRepository information is extracted from name field and mapped to discover container image record.
u_resource.LabelsImage_labelsMaps to the discovered container image record
u_resource.CloudProvidercloud_providersMaps to the discovered container image record
u_resource. AccountIdcloud_account_idsMaps to the discovered container image record
u_resource.Regioncloud_regionsMaps to the discovered container image record
u_vulnerability. IdidMaps id from source and adds the TEN- prefix. For example, if the id received is 12345, the id in the third-party entry table is TEN-12345.
u_vulnerability. Description IdsummaryidMaps to the third-party entry record. or CVE record.
u_vulnerability.Severityv4_base_severityMaps to the third-party entry record.
u_vulnerability.VprScoresource_risk_scoreMaps to the third-party entry record.
u_vulnerability.VprSeveritysource_severityMaps to the third-party entry record.
u_vulnerability.AttackVectorv4_attack_vectorMaps to the third-party entry record.
u_vulnerability.ExploitMaturityv4_exploit_maturityMaps to the third-party entry record.
[script]sourcehe source for imported TPE is Tenable.cs.
u_vulnerability.IdnameMaps to the vulnerability references record
u_vulnerability. LinksurlMaps to the vulnerability references record
 vulnerabilityReference of TPE or CVE in vulnerability references record
u_software.NamenameMaps to the container image package record
u_software.VersionversionMaps to the container image package record
u_software.Typepackage_typeMaps to the container image package record
u_softwarepathspathMaps to the container image package record
u_resolvedstatusMaps to the container image finding record
u_firstscantimefirst_foundMaps to the container image finding record
u_resource.ScanTimelast_foundMaps to the container image finding record
u_vulnerability.DescriptionproofMaps to the container image finding record
u_resolvedstateMaps to the container vulnerable item record
u_firstscantimefirst_foundMaps to the container vulnerable item record
u_resource.ScanTimelast_foundMaps to the container vulnerable item record
[script]sourceThe source for container vulnerable item record is Tenable.cs.

There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.

When the script is runPurpose
onStart (when an import set has started transformation)Triggers TenableCS Container Vulnerabilities Processor which imports data from Tenable.cs using the import set and loads each record into the CMDB CI table, the Vulnerable Item table, Third-party Vulnerability Entry table, Vulnerability Reference table, Container Image Package, Container Image Finding, and Container Vulnerable Item. Modifying or deleting isn’t recommended.
onBefore (before an import set has completed transformation)Checks if the third-party Entry and Image Findings exist. If not, these records are created in their respective tables. This script is for internal use, and modifying or deleting them isn’t recommended.
onComplete (when an import set has completed transformation)Updates the count of CIs, VITs, and Findings as imported from Tenable.cs. This script is for internal use, and modifying or deleting them isn’t recommended.

Tenable.cs compute vulnerability import

Imported host vulnerability data is first loaded into the Tenable.cs Compute Vulnerability Import [sn_vul_tenable_cs_compute_vuln_import] Table.

The Tenable.cs Compute Vuln transform map is used to transform the imported host vulnerability information. Changes to this transform alter how data from the Tenable.cs Compute Vulnerability Import is processed. To access this transform map, navigate to System Import Sets > System Import Sets. Search for Tenable.cs Compute Vuln Transform.

The following table lists the transform map fields by integration.

Source fieldTarget fieldDescription
u\_resource.Idobject\_idMaps to the CMDB Ci record.
u\_resource.NamenameMaps to the CMDB Ci record.
 asset\_categoryCloud is mapped as Asset Category in discovered item record.
U\_resource.CloudProvidercloud\_service\_providerMaps to the discovered item record
u\_resource.Regioncloud\_regionMaps to the discovered item record
u\_resource.AccountIdcloud\_accountMaps to the discovered item record
u\_resource. CloudProvidercloud\_resource\_typeMaps to the discovered item record
u\_resource.Idresource\_idMaps to the discovered item record
u\_resource.Nameresource\_nameMaps to the discovered item record
u\_vulnerability.IdidMaps id from source and adds the TEN- prefix. For example, if the id received is 12345, the id in the third-party entry table is TEN-12345. Maps id to CVEs as well.
u\_vulnerability. DescriptionsummaryMaps to the third-party entry record.
u\_vulnerability.Severityv4\_base\_severityMaps to the third-party entry record.
u\_vulnerability.VprScoresource\_risk\_scoreMaps to the third-party entry record.
u\_vulnerability.VprSeveritysource\_severityMaps to the third-party entry record.
u\_vulnerability.AttackVectorv4\_attack\_vectorMaps to the third-party entry record.
u\_vulnerability.ExploitMaturityv4\_exploit\_maturityMaps to the third-party entry record.
\[script\]sourceThe source for imported TPE is Tenable.cs.
u\_vulnerability.IdnameMaps to the vulnerability references record
u\_vulnerability.LinksurlMaps to the vulnerability references record
 vulnerabilityReference of TPE or CVE in vulnerability references record
u\_resolvedstatusMaps to the vulnerable item detection record
u\_firstscantimefirst\_foundMaps to the vulnerable item detection record
u\_resource.ScanTimelast\_foundMaps to the vulnerable item detection record
u\_softwarepathsproofMaps to the vulnerable item detection record
u\_softwareresolutionversionssolution\_summaryMaps to the vulnerable item detection record
u\_resolvedstateMaps to the vulnerable item record
u\_firstscantimefirst\_foundMaps to the vulnerable item record
u\_resource.ScanTimelast\_foundMaps to the vulnerable item record
\[script\]sourceThe source for vulnerable item record is Tenable.cs.

There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.

When the script is runPurpose
onStart (when an import set has started transformation)Triggers Tenable CS Compute Vulnerabilities Processor which imports data from Tenable.cs using the import set and loads each record into the CMDB CI table, the Vulnerable Items table, and the Third-party vulnerability table. This script is for internal use, and modifying or deleting them isn’t recommended.
onBefore (before an import set has completed transformation).Checks if the third-party entry and detections exist. If not, these records are created in their respective tables. This script is for internal use, and modifying or deleting them isn’t recommended.
onComplete (when an import set has completed transformation).Updates the count of CIs, VITs, and detections as imported from Tenable.cs. This script is for internal use, and modifying or deleting them isn’t recommended.
Source fieldTarget fieldDescription
u_digestImage_idA unique digest provided by Tenable for the container assets. It maps to the discovered container image and docker image record and is used for CI lookup.
u_namenameMaps to the name field of the docker image record.

Standardized logic for calculating source_risk_score and source_risk_rating

As part of the standardized data-transformation, the Tenable integration uses a centralized business rule to populate both source_risk_score and source_risk_rating.

During the integration run, if either vprv1_risk_score or vprv2_risk_score is updated, the system automatically recalculates and populates source_risk_score and source_risk_rating using the values from the vprv2_risk_score and vprv1_risk_score fields in the Third-Party Entry table.

  • If vprv2_risk_score is present, it takes precedence overvprv1_risk_score.
  • If the vprv1_risk_score and vprv2_risk_score are empty, then source_risk_score will not be changed.
  • source_risk_rating is derived from the finalized source_risk_score using the standardized thresholds:
    • 9-10 → Critical
    • 7-9 → High
    • 4-7 → Medium
    • 0-4 → Low
    • NaN → None

Note: The before changes will be implemented as part of Tenable 5.2.1 Version.