Data transformation for the Tenable Vulnerability Integration
After you identify the data to import, it’s retrieved from the Tenable product and processed through a set of data sources and transforms in your instance.
During installation, normalized severity maps are installed in the Normalized Severity Mapping module. These maps transform imported Tenable severity levels to standard severity levels for processing in your instance. For information about creating severity maps, see Create a Vulnerability Response severity map in the Vulnerability Response documentation.
Tenable.io asset import
Imported asset data is first loaded into the Tenable.io Asset Import [sn_vul_tenable_io_asset_import] Table.
The transform map writes the transformed asset records to the Discovered Items [sn_sec_cmn_src_ci] table.
The Tenable.io Asset Integration transform map is used to transform the imported assets information. Changes to this transform alter how data from the Tenable Asset import is processed. To access this transform map, navigate to System Import Sets > Transform Maps. Search for Tenable.io Asset Transform.
The following table lists the transform map fields by integration.
| Source field | Target field | Description |
|---|---|---|
| u_id | source_id | Tenable provides a unique id for assets and maps to the discovered item record and is used for CI lookup. |
| u_ipv4s | ip_address | Maps the first ip value to the ip_address field on the discovered item record. |
| u_mac_addresses | mac_address | Maps the first mac_address value to the mac address field on the discovered item record. |
| u_fqdns | fqdn | Maps the first fqdn value to the fqdn field on the discovered item record. |
| u_netbios_names | netbios | Maps the first netbios value to the netbios field on the discovered item record. |
| u_plugin.cvss4_base_score | v4_base_score | CVSS v4 base score is mapped to the v4 base score in third-party entry record. |
| u_plugin.cvss4_threat_score | v4_threat_score | CVSS v4 threat score is mapped to the v4 threat score in third-party entry record. |
| u_operating_systems | os | Maps the first OS value to the os field on the discovered item record. |
| (Prior to v14.0 Vulnerability Response and v2.2 of the Tenable Vulnerability Integration)u_last_scan_time | last_scan_date | Maps to the last_scan_date field on the discovered item record. |
| u_last_authenticated_scan_date | last_auth_scan_date | Maps to the last_auth_scan_date field on the discovered item record. |
| [script] | name | Maps the host name using the script's logic. |
| u_tags | The Tags are saved in sn_sec_cmn_host_tag. The mapping from tags to assets is saved in sn_sec_cmn_m2m_src_ci_tag. | |
| u_serial_number | source_payload | The serial number from the Tenable.io asset data is included in the source_payload field on the Discovered Items [sn_sec_cmn_src_ci] record. The source_payload stores the raw source data and is used for CI matching. |
There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.
Tenable.io asset transform map script timing and purpose
| When the script is run | Purpose |
|---|---|
| onStart (when an import set has started transformation) | Initializes the values in the import_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onBefore (before an import set has completed transformation). | Updates values in the host and verify if the host exists. Based on the results, modifies the values in an import_set. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onComplete (when an import set has completed transformation). | Sets the values of new CIs created, and CIs that have been updated and ignored.This script is for internal use, and modifying or deleting them isn’t recommended. |
Tenable.io plugins integration
The Tenable.io plugins transform map is used to transform plugins imported from Tenable.io.
Note: Changes to this transform map alters how data received from the Tenable plugins is processed.
To access this transform map, navigate to System Import Sets > Transform Maps. Search for the Tenable.io Plugin Transform.
The tenable.io plugins payload contains all the fields in the u_attributes column of the sn_vul_tenable_io_plugin_import table. The attributes field is parsed and mapped to the third-party entry table records as listed in the following table.
The transform map writes the transformed plugin data to the Third-Party Entry [sn_vul_third_party_entry] table.
| Source field | Target field | Description |
|---|---|---|
| id | id | Maps id from source and adds the TEN-prefix to it. For example, if the id received is 12345, the id in the target table is TEN-12345. |
| Description | summary | Maps the description of the plugin to the summary column. |
| \[script\] | source | The source for imported third-party entry \(TPE\) is Tenable.io. |
| \[script\] | source\_instance | Reference to the Tenable deployment that imports this record. |
| family | category | Maps the family of plugin to the category column. |
| plugin\_modification\_date | last\_modified | Maps the plugin\_modification\_date to the last modified field. |
| plugin\_publication\_date | date\_published | Maps the plugin\_publication\_date to the published date. |
| has\_patch | remediation\_type | Maps the remediation type from has\_patch value. |
| synopsis | threat | Maps the threat information about this vulnerability. |
| cvss\_base\_\_score | score | Maps the Common Vulnerability Scoring System \(CVSS\) base score to the score column in third-party entry table. |
| solution | solution | Maps the solution provided by scanner to the solution column in the third-party entry table. |
| exploit\_available | exploit | Maps the exploit\_available provided by scanner to the exploit column in the third-party entry table. |
| vpr.score | source\_risk\_score | Maps the vpr score provided by scanner to the source\_risk\_score in the third-party entry table. |
| \[script\] | source\_risk\_rating | Maps the vpr score to the standard risk rating based on the score ranges: - 9–10 – Critical - 7–9 – High - 4–7 – Medium - 0–4 - Low |
| vpr.drivers.age\_of\_vuln | age\_of\_vuln | Maps the age of the vulnerability from the scanner to the age\_of\_vuln column in the third-party entry table. |
| vpr.drivers.exploit\_code\_maturity | exploit\_code\_maturity | Maps exploit code maturity from the scanner to exploit\_code\_maturity in the third-party entry table. |
| vpr.drivers.product\_coverage | product\_coverage | Maps product coverage from the scanner to product\_coverage in the third-party entry table. |
| vpr.drivers.threat\_sources\_last28 | threat\_sources | Maps threat sources in the last 28 days from the scanner to the threat\_sources in the third-party table. |
| vpr.drivers.threat\_intensity\_last28 | threat\_intensity | Maps threat intensity in the last 28 days from the scanner to threat\_intensity in the third-party entry table. |
| vpr.drivers.threat\_recency | threat\_recency | Maps the threat recency information from scanner to threat\_recency in the third-party entry table. |
| vpr.drivers.cvss3\_impact\_score | v3\_impact\_subscore | Maps cvss3 impact score to v3\_impact\_subscore column in the third-party entry table. |
| cvss\_temporal\_score | cvss\_temporal\_score | Maps the temporal score for CVSS v2. |
| cvss\_v3\_temporal\_score | v3\_temporal\_score | Maps the temporal score for CVSS v3. |
| risk\_factor | source\_severity | Maps to the source severity in the third-party entry table. |
| name | name | Maps the name of the plugin to name in third-party entry table. |
| stig\_severity | stig\_severity | Maps the vpr score provided by the scanner to the source\_risk\_score in the third-party entry table. |
| plugin\_type | check\_type | Maps the plugin type to check\_type in third-party entry table. |
| unsupported\_by\_vendor | unsupported\_by\_vendor | Maps the unsupported\_by\_vendor field to the unsupported\_by\_vendor column. |
| \[script\] | exploit\_attack\_vector | The exploit\_attack\_vector column in the third-party entry table is populated based on exploit\_available and v3\_attack\_vector of columns. |
| cpe | software\_raw | Maps the raw CPE strings from the plugin payload to the software\_raw column in the third-party entry table, stored as a comma-separated list. |
| cpe | vendor | Vendor names extracted from the CPE data are mapped to the vendor column in the third-party entry table, stored as a comma-separated list. |
| cpe | product | Product names extracted from the CPE data are mapped to the product column in the third-party entry table, stored as a comma-separated list. |
In addition to the direct fields, other information is added as related lists to third-party entries.
| Source field | Description |
|---|---|
| cve | Inserts CVE-related data into the reference table (sn_vul_nvd_entry). If the same Common Vulnerabilities and Exposures (CVE) in the NVD entry table (sn_vul_nvd_entry) is found, it associates the current vulnerability to the NVD entry. The mapping can be found in sn_vul_m2m_entry_cve. |
| bid | The list of bug traqs is added as a reference. |
| cpe | CPE entries are added as individual related list entries on the third-party entry record, containing vendor, product, version, update, edition, and other CPE attributes. |
| see_also | The list of URLs is added as a reference. |
| xrefs | The list of X-REF is added as a reference. |
| [script] | The list of exploits for that plugin and inserts mapping for applicable exploit framework and plugin to sn_vul_m2m_framework_vul. |
There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.
| When the script is run | Purpose |
|---|---|
| onStart (when an import set has started transformation) | Initializes the values in the import_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onBefore (before an import set has completed transformation). | Updates the values in the third-party entry, and verify if the third-party entry exists. Based on the results, modifies the values in a third-party entry. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onComplete (when an import set has completed transformation). | Sets the values of new CIs created, and CIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended. |
The TenableIOPluginsImportProcessor script include is called from the onBefore transform script. It takes the output from Tenable.io plugins integration and transforms it into ServiceNow AI Platform third-party vulnerability entries. Any changes to this script include may alter the transformation of Tenable.io plugins data in the third-party entry table.
Tenable.io vulnerabilities import
The Tenable.io Vulnerable Item transform map is used to transform open and fixed vulnerabilities information imported from Tenable.io.
Note: Changes to this transform map alter how data from the Tenable Vulnerabilities Import is processed.
The same transform map is used for both the Tenable.io Fixed Vulnerabilities Integration and the Tenable.io Open Vulnerabilities Integration. To access this transform map, navigate to System Import Sets > Transform Maps. Search for the Tenable.io Vulnerable Item transform map.
The transform map writes the transformed vulnerability data to the Vulnerable Item [sn_vul_vulnerable_item] table.
| Source field | Target field | Description |
|---|---|---|
| u\_asset.uuid | id | Uuid is mapped to the id field of the cmdb\_ci record. |
| u\_asset.ipv4 | ip\_address | The ipv4 field is mapped to the ip address field of the cmdb\_ci record. |
| u\_asset.last\_authenticated\_results | last\_auth\_scan\_date | The last authenticated scan date is mapped to the last auth scan date of the cmdb\_ci record. |
| u\_asset.mac\_addess | mac\_address | Mac address is mapped to the host mac address field of the cmdb\_ci record. |
| u\_asset.netbios\_name | netbios | Netbios is mapped to the netbios field of cmdb\_ci record. |
| u.\_plugin.cvss3\_base\_score | v3\_base\_score | CVSS v3 base score is mapped to the v3 base score of the third-party entry record. These changes will be implemented as part of Tenable 5.2.1 Version. |
| u.\_plugin.cvss3\_temporal\_score | v3\_temporal\_score | CVSS v3 temporal score is mapped to the v3 temporal score in the third-party entry record. These changes will be implemented as part of Tenable 5.2.1 Version. |
| u.\_plugin.cvss\_base\_score | score | CVSS base score is mapped to the score field of the third-party entry record. |
| u.\_plugin.cvss\_temporal\_score | temporal\_score | Temporal Score is mapped to the temporal score in the third-party entry record. |
| u\_plugin.description | summary | Description is mapped to the summary field in the third-party entry record. |
| u\_plugin.family | category | Maps the family of plugin to the category column of the third-party entry record. |
| u\_plugin.modification\_date | last\_modified | Last modified date is mapped to the plugin last modified date in the third-party entry record. |
| u\_plugin.publication\_date | date\_published | Publication date is mapped to the date published field of the third-party entry record. |
| u\_plugin.risk\_factor | source\_severity | Risk factor is mapped to the source\_severity field of the third-party entry record. |
| u\_plugin.solution | solution | Solution is mapped to the solution field of the third-party entry record. |
| u\_plugin.synopsis | threat | Synopsis is mapped to the threat field of the third-party entry record. |
| u\_severity\_id | priority | Priority is mapped to the severity id from the payload. The default value is 5. |
| u\_plugin.exploit\_available | exploit | Maps the exploit\_available provided by the scanner to the exploit column in the third-party entry table. |
| vpr.score | source\_risk\_score | Maps the vpr score provided by the scanner to the source\_risk\_score in the third-party entry table. |
| \[script\] | source\_risk\_rating | Maps the vpr score to the standard risk rating based on the score ranges:- 9–10 – Critical - 7–9 – High - 4–7 – Medium - 0–4 - Low |
| u\_plugin.vpr.drivers.age\_of\_vuln | age\_of\_vuln | Maps the age of vulnerability from the scanner to age\_of\_vuln in the third-party entry table. |
| u\_plugin.vpr.drivers.exploit\_code\_maturity | exploit\_code\_maturity | Maps exploit code maturity from the scanner to exploit\_code\_maturity in the third-party entry table. |
| u\_plugin.vpr.drivers.product\_coverage | product\_coverage | Maps product coverage from the scanner to product\_coverage in the third-party entry table. |
| u\_plugin.vpr.drivers.threat\_sources\_last28 | threat\_sources | Maps threat sources in the last 28 days from the scanner to threat\_sources in the third-party entry table. |
| u\_plugin.vpr.drivers.threat\_intensity\_last28 | threat\_intensity | Maps threat intensity in the last 28 days from the scanner to threat\_intensity in the third-party entry table. |
| u\_plugin.vpr.drivers.threat\_recency | threat\_recency | Maps the threat recency information from the scanner to threat\_recency in the third-party entry table. |
| u\_plugin.vpr.drivers.cvss3\_impact\_score | v3\_impact\_subscore | Maps CVSS3 v3 impact score to v3\_impact\_subscore column in the third-party entry table. |
| u\_plugin.type | check\_type | Maps the plugin type to check\_type in third-party entry table. |
| u\_plugin.unsupported\_by\_vendor | unsupported\_by\_vendor | Maps the unsupported\_by\_vendor field in plugin to the unsupported\_by\_vendor column. |
| \[script\] | exploit\_attack\_vector | The exploit\_attack\_vector column in the third-party entry table is populated based on exploit\_available and v3\_attack\_vector of columns. |
| U\_plugin.on\_cisa\_kev | cisa\_exists | Maps on\_cisa\_kev field with cisa\_exists in third-party entry table. |
| u\_plugin.family\_id | Family\_id | Maps the plugin Family id to family\_id column in third-party entry table. |
| port | port | Port is mapped to the port field of the vulnerable item record. |
| protocol | protocol | Protocol is mapped to the protocol field of the vulnerable item record. |
| u\_first\_found | first\_found | First found is mapped to the first found field of the vulnerable item record. |
| u\_last\_found | last\_found | Last found is mapped to the last found field of the vulnerable item record. |
| u\_state | state | State is mapped to the State field in the vulnerable item record |
| \[script\] | source | The source of the integration is populated. The vulnerable items created from this integration have Tenable.io as the source. |
| \[script\] | integration\_instance | The integration\_instance is the name of the instance from which the vulnerable item is imported. |
| u\_plugin.name | name | Maps the name of the plugin to name in third-party entry table. |
| u\_plugin.stig\_severity | stig\_severity | Maps the stig severity of the plugin to stig severity column in third-party entry table |
| u\_plugin.vpr\_v2.malware\_observations\_intensity\_last30 | vprv2\_malware\_observations\_intensity | Maps the VPRv2 malware\_observations\_intensity\_last30 value to the vprv2\_malware\_observations\_intensity field in the Tenable TPE Additional Attributes table. |
| u\_plugin.vpr\_v2.targeted\_industries | vprv2\_targeted\_industries | Maps the VPRv2 targeted\_industries value to the vprv2\_targeted\_industries field in the Tenable TPE Additional Attributes table. |
| u\_plugin.vpr\_v2.targeted\_regions | vprv2\_targeted\_regions | Maps the VPRv2 targeted\_regions value to the vprv2\_targeted\_regions field in the Tenable TPE Additional Attributes table. |
| u\_plugin.vpr\_v2.threat\_summary | vprv2\_threat\_summary | Maps the VPRv2 threat\_summary value to the vprv2\_threat\_summary field in the Tenable TPE Additional Attributes table. |
| u\_plugin.vpr\_v2.remediation | vprv2\_remediation | Maps the VPRv2 remediation value to the vprv2\_remediation field in the Tenable TPE Additional Attributes table. |
| u\_plugin.d2\_elliot\_name | d2\_elliot\_name | Maps the d2\_elliot\_name value to the d2\_elliot\_name field in the Tenable TPE Additional Attributes table. |
| u\_plugin.canvas\_package | canvas\_package | Maps the canvas\_package value to the canvas\_package field in the Tenable TPE Additional Attributes table. |
| u\_plugin. checks\_for\_default\_account | checks\_for\_default\_account | Maps the checks\_for\_default\_account value to the checks\_for\_default\_account field in the Tenable TPE Additional Attributes table. |
| u\_plugin.checks\_for\_malware | checks\_for\_malware | Maps the checks\_for\_malware value to the checks\_for\_malware field in the Tenable TPE Additional Attributes table. |
| u\_plugin.exploitability\_ease | exploitability\_ease | Maps the exploitability\_ease value to the exploitability\_ease field in the Tenable TPE Additional Attributes table. |
| u\_plugin.exploithub\_sku | exploithub\_sku | Maps the exploithub\_sku value to the exploithub\_sku field in the Tenable TPE Additional Attributes table. |
| u\_plugin.in\_the\_news | in\_the\_news | Maps the in\_the\_news value to the in\_the\_news field in the Tenable TPE Additional Attributes table. |
| u\_plugin.metasploit\_name | metasploit\_name | Maps the metasploit\_name value to the metasploit\_name field in the Tenable TPE Additional Attributes table. |
| u\_plugin.ms\_bulletin | ms\_bulletin | Maps the ms\_bulletin value to the ms\_bulletin field in the Tenable TPE Additional Attributes table. |
| u\_plugin.usn | usn | Maps the usn value to the usn field in the Tenable TPE Additional Attributes table. |
| u\_plugin.version | version | Maps the version value to the version field in the Tenable TPE Additional Attributes table. |
| u\_plugin.vuln\_publication\_date | vuln\_publication\_date | Maps the vuln\_publication\_date value to the vuln\_publication\_date field in the Tenable TPE Additional Attributes table. |
| u\_plugin.workaround | workaround | Maps the workaround value to the workaround field in the Tenable TPE Additional Attributes table. |
| u\_plugin.workaround\_type | workaround\_type | Maps the workaround\_type value to the workaround\_type field in the Tenable TPE Additional Attributes table. |
| u\_plugin.workaround\_published | workaround\_published | Maps the workaround\_published value to the workaround\_published field in the Tenable TPE Additional Attributes table. |
| u\_plugin.vendor\_unpatched | vendor\_unpatched | Maps the vendor\_unpatched value to the vendor\_unpatched field in the Tenable TPE Additional Attributes table. |
| u\_plugin.has\_workaround | has\_workaround | Maps the has\_workaround value to the has\_workaround field in the Tenable TPE Additional Attributes table. |
| u\_plugin.vendor\_severity | vendor\_severity | Maps the vendor\_severity value to the vendor\_severity field in the Tenable TPE Additional Attributes table. |
| u\_plugin.vpr\_v2.cve\_id | vprv2\_cve\_id | Maps the VPRv2 cve\_id value to the vprv2\_cve\_id field in the Tenable TPE Additional Attributes table. |
| u\_plugin.epss\_score | epss\_score | Maps the epss\_score value to the epss\_score field in the Tenable TPE Additional Attributes table. |
In addition to the direct fields, other information is added as related lists to third-party entries.
| Source field | Description |
|---|---|
| cve | Inserts CVE-related data into the reference table (sn_vul_nvd_entry). If the same CVE in the NVD entry table (sn_vul_nvd_entry) is found, it associates the current vulnerability to the NVD entry. The mapping can be found in sn_vul_m2m_entry_cve. |
| bid | The list of bug traqs is added as a reference. |
| see_also | The list of URLs is added as a reference. |
| xrefs | The list of X-REF is added as a reference. |
| [script] | The list of exploits for that plugin and Inserts mapping for applicable exploit framework and plugin to sn_vul_m2m_framework_vul. |
There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.
| When the script is run | Purpose |
|---|---|
| onStart (when an import set has started transformation) | TTriggers Tenable IO Vulnerabilities Processor which imports data from Tenable.io using the import set and loads each record into the CMDB CI table, the Vulnerable Items table, and the Third-party vulnerability table. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onBefore (before an import set has completed transformation). | Checks if the Third-Party Entry and Detections exist. If not, these records are created in their respective tables. isn’tThis script is for internal use, and modifying or deleting them is not recommended. |
| onComplete (when an import set has completed transformation). | Updates the count of CIs, VITs, and Detections as imported from Tenable.io. This script is for internal use, and modifying or deleting them isn’t recommended. |
Tenable.io compliance results integration
Tenable.io Compliance Results transform map enables you to import secure configuration assessment findings from Tenable.io into ServiceNow. This integration leverages Tenable’s compliance export APIs to retrieve test results on assets, supporting regular differential imports to keep data up to date.
Imported data is first loaded into the Tenable.io Test Results Import [sn_vul_tenable_io_tr_import] table.
To access the transform map, navigate to System Import Sets > Transform Maps. Search for Tenable.io Compliance Results Transform.
The following table lists the transform map fields by integration.
| Source field | Table | Target field | Description |
|---|---|---|---|
| asset_uuid | sn_vulc_result | sn_sec_cmn_src_ci -> source_id | Unique identifier for the asset in Tenable.io, mapped to the corresponding CMDB CI in ServiceNow after transformation. |
| first_seen | sn_vulc_result | first_seen | Date and time when the compliance check was first observed on the asset. |
| last_seen | sn_vulc_result | last_seen | Date and time when the compliance check was last observed on the asset. |
| audit_file | sn_vulc_policy | short_description | Name or identifier of the audit file used for the compliance check. |
| check_id | sn_vulc_test | source_id | Unique identifier for the compliance check within Tenable.io. |
| check_name | sn_vulc_test | short_description | Human-readable name of the compliance check. |
| check_info | sn_vulc_test | description | Detailed information about the compliance check, including its purpose and context. |
| expected_value | sn_vulc_result | expected_values | The value expected for the configuration setting according to the compliance policy. |
| actual_value | sn_vulc_result | actual_values | The actual value found on the asset during the compliance check. |
| status | sn_vulc_result | result | Result of the compliance evaluation. Possible values (from Tenable): PASSED, FAILED. |
| see_also | sn_vulc_result | remediation | Additional references or links for remediation guidance. |
| reference.framework | sn_vulc_auth_src | short_description | Compliance framework associated with the check (e.g., CIS, NIST). |
| reference.control | sn_vulc_citation | section | Specific control or section within the compliance framework. |
| solution | sn_vulc_test | remediation | Recommended steps to remediate the compliance failure. |
| profile_name | sn_vulc_citation | section_name | Name of the compliance profile or benchmark applied. |
| db_type | sn_vulc_technology | name | Database type or technology associated with the compliance check. |
Note: Tenable does not provide a risk score for compliance test results. ServiceNow calculates risk scores using Configuration Compliance calculators and applies the default Medium risk value of 20 when no risk score is available. To ensure accurate prioritization, review and customize the risk calculator rules to reflect your organization’s priorities.
For more information, see Configuration Compliance calculators and calculator rules.
Tenable.sc asset import
Asset data imported from Tenable.sc is first loaded into the Tenable.sc Asset Import table (sn_vul_tenable_sc_asset_import). The Tenable.sc Asset Integration transform map is used to transform the imported assets information. Changes to this transform alter how data from the Tenable Asset import is Processed. To access this transform map, navigate to System Import Sets > Transform Maps. Search for the Tenable.sc Asset Transform.
The transform map writes the transformed asset records to the Discovered Items [sn_sec_cmn_src_ci] table.
| Source field | Target field | Description |
|---|---|---|
| u_uuid | id | The uuid isn’t populated from the Tenable API, so the ‘u_uniqueness’ attribute is used to create a unique uuid field for assets and map it to the Discovered Items [sn_sec_cmn_src_ci] record. |
| u_ip | source_payload | The IP address from the Tenable.sc API is stored in the source_payload field on the Discovered Items [sn_sec_cmn_src_ci] record for CI matching and lookup purposes. |
| u_macaddress | mac_address | Maps the mac address field from the API to the address field on the Discovered Items [sn_sec_cmn_src_ci] record. |
| u_dnsname | fqdn | Maps the dnsname field from the API to the fqdn field on the Discovered Items [sn_sec_cmn_src_ci] record. |
| u_netbiosname | netbios | Maps the netbios field from the API to the netbios field on the Discovered Items [sn_sec_cmn_src_ci] record. |
| u_oscpe | os | The OS information is extracted from the oscpe attribute in the payload and maps it to the os field on the Discovered Items [sn_sec_cmn_src_ci] record. |
| u_lastauthrun | last_auth_scan_date | Maps the lastauthrun field from the API to the last_auth_scan_date field on the discovered item record. |
| u_lastauthrun and u_lastunauthrun | last_scan_date | The lastauthrun is extracted from the Tenable API or lastunauthrun. The last_scan_date field on the discovered item record is populated based on the value that appears in the payload. |
There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.
| When the script is run | Purpose |
|---|---|
| onStart (when an import set has started transformation) | Initializes the values in the import_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onBefore (before an import set has completed transformation). | Updates the values in the host and verify if the host exists. Based on the results, modifies the values in an import_set. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onComplete (when an import set has completed transformation). | Sets the values of new CIs created, and CIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended. |
Tenable.sc plugins import
Plugins data imported from Tenable.sc is first loaded into the Tenable.sc Plugins Import table (sn_vul_tenable_sc_plugin_import). The Tenable.sc Plugin Transform Map is used to transform the plugins information that has been imported. Changes to this transform alter how data from the Tenable Plugin import is Processed. To access this transform map, navigate to System Import Sets > Transform Maps. Search for Tenable.sc Plugin Transform Map.
The transform map writes the transformed plugin data to the Third-Party Entry [sn_vul_third_party_entry] table.
| Source field | Target field | Description |
|---|---|---|
| u\_id | id | Maps id from source and adds the TEN-prefix. For example, if the id received is 12345, the id in the target table is TEN-12345. |
| u\_description | summary | Maps the description of the plugin to the summary column. |
| \[script\] | source | Imported TPE from this integration has Tenable.sc as the source. |
| \[script\] | source\_instance | Reference to the Tenable deployment that imports this record. |
| u\_family | category | Maps the name field in family object of plugin to the category column. |
| u\_plugin\_modification\_date | last\_modified | Maps the plugin\_modification\_date to the last modified field. |
| u\_plugin\_publication\_date | date\_published | Maps the plugin\_publication\_date to published date. |
| u\_has\_patch | Remediation\_type | Maps the remediation type from has\_patch value. |
| u\_synopsis | threat | Maps the threat information about this vulnerability. |
| u\_cvss\_base\_score | score | Maps the CVSS base score to the score column in third-party entry table. |
| u\_solution | solution | Maps the solution provided by the scanner to the solution column in the third-party entry table. |
| u\_cvss\_temporal\_score | cvss\_temporal\_score | Maps the temporal score for CVSS v2. |
| u\_cvss\_v3\_temporal\_score | v3\_temporal\_score | Maps the temporal score for CVSS v3. |
| u\_risk\_factor | source severity | Maps to the source severity in the third-party entry table. |
| u\_cvss\_v3\_base\_score | v3\_base\_score | Maps the CVSS base score in the third-party entry table. |
| u\_exploit\_available | exploit | Maps the exploitAvailable provided by the scanner to the exploit column in the third-party entry table. |
| u\_vpr\_score | source\_risk\_score | Maps VPR score from the scanner to the Source risk score in the third-party entry table. |
| \[script\] | source\_risk\_rating | Maps the vpr score to the standard risk rating based on the score ranges:- 9–10 – Critical - 7–9 – High - 4–7 – Medium - 0–4 - Low |
| u\_vpr\_context\[id=age\_of\_vuln\] | age\_of\_vuln | Maps the age of the vulnerability from the scanner to age\_of\_vuln in the third-party entry table. |
| u\_vpr\_context\[id=exploit\_code\_maturity\] | exploit\_code\_maturity | Maps exploit code maturity from the scanner to exploit\_code\_maturity in the third-party entry table. |
| u\_vpr\_context\[id=product\_coverage\] | product\_coverage | Maps product coverage from the scanner to product\_coverage in the third-party entry table. |
| u\_vpr\_context\[id=”threat\_sources\_last\_28\] | threat\_sources | Maps threat sources in the last 28 days from scanner to threat\_sources in the third-party table. |
| u\_vpr\_context\[id=”threat\_intensity\_last\_28\] | threat\_intensity | Maps threat intensity in the last 28 days from the scanner to threat\_intensity in the third-party entry table. |
| u\_vpr\_context\[id=”threat\_recency”\] | threat\_recency | Maps the threat recency information from the scanner to threat\_recency in the third-part entry table. |
| u\_vpr\_context\[id=cvssV3\_impactScore\] | v3\_impact\_subscore | Maps CVSS v3 impact score from the scanner to v3\_impact\_subscore in the third-party entry table. |
| u\_name | name | Maps the name of the plugin to the name column in the third-party entry table. |
| u\_stig\_severity | stig\_severity | Maps the stig\_severity field in the plugin to stig\_severity in the third-party entry table. |
| u\_check\_type | check\_type | Maps the check type to check\_type in the third-party entry table. |
| u\_family.id | family\_id | Maps the plugin family\_id to family\_id in the third-party entry table. |
| \[script\] | exploit\_attack\_vector | The exploit\_attack\_vector column in the third-party entry table is populated based on exploit\_available and v3\_attack\_vector of columns. |
| u\_cpe | software\_raw | Maps the raw CPE strings from the Tenable.sc plugin import to the software\_raw column in the third-party entry table, stored as a comma-separated list. |
| u\_cpe | vendor | Vendor names extracted from the CPE data are mapped to the vendor column in the third-party entry table, stored as a comma-separated list. |
| u\_cpe | product | Product names extracted from the CPE data are mapped to the product column in the third-party entry table, stored as a comma-separated list. |
In addition to the direct fields, other information is added as related lists to third-party entries.
| Source field | Description |
|---|---|
| u_cpe | The list of CPEs is added as a reference. |
| u_see_also | The list of URLs is added as a reference. |
| u_exploit_frameworks | The list of exploits for that plugin and inserts mapping for applicable exploit framework and plugin to sn_vul_m2m_framework_vul. |
There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.
| When the script is run | Purpose |
|---|---|
| onStart (when an import set has started transformation) | This transform is used to initialize the values in the import_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onBefore (before an import set has completed transformation). | Function used to update the values in the third-party entry and verify if the third-party entry exists. Based on the results, modifies the values in a third-party entry. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onComplete (when an import set has completed transformation). | This transform is used to set the values of Plugins created and ignored. This script is for internal use, and modifying or deleting them isn’t recommended. |
The TenableSCPluginsImportProcessor script include is called from the onBefore transform script. It takes the output from the Tenable.sc plugins integration and transforms it into ServiceNow third-party vulnerability entries. Any changes to this script include may alter the transformation of Tenable.sc plugins data in the third-party entry table.
Tenable.sc vulnerabilities import
The Tenable.sc Open Vulnerabilities transform map is used to transform imported data from the Tenable.sc Open Vulnerabilities integration, and the Tenable.sc and Fixed Vulnerabilities transform map is used to transform imported data from the Tenable.sc Fixed Vulnerabilities Integration.
Note: Changes to these transform maps alter how data from the Fixed/Open Tenable Vulnerabilities Import is processed.
To access the Tenable.sc Open and Fixed Vulnerabilities transform maps, navigate to Tenable Vulnerability Integration > Administration > Integration Instances > Tenable.sc Fixed/Open Vulnerabilities Integration > Data Sources > Tenable.sc Open/Fixed Vulnerabilities > Tranforms.
The transform maps write the transformed vulnerability data to the Vulnerable Item [sn_vul_vulnerable_item] table.
| Source field | Target field | Description |
|---|---|---|
| u\_pluginID | Id | Used as the identifier for the plugin. This field is mapped to the plugin Id in the third-party entry record. |
| u\_riskfactor | source\_severity | This field is mapped to source\_severity in the third-party entry record. |
| u\_severity | priority | The priority field is mapped with the severity. The default value is 5. |
| u\_hasbeenmitigated | state | Has been mitigated is mapped to the state field of vulnerability record. For the Fixed vulnerabilities integration, all the VIs are in the 'Closed' state. |
| u\_ip | ip\_address | Ip address is mapped to the host ip field of cmdb\_ci table. |
| u\_port | port | Port is mapped to the port field of the vulnerable item record. |
| u\_protocol | protocol | Protocol is mapped to the port field of the vulnerfable item record. |
| u\_firstSeen | first\_found | The first seen value is mapped to the first found field of the VI record. |
| u\_lastSeen | last\_found | The last seen value is mapped to the last found field of the VI record. |
| u\_exploitAvailable | exploit | ExploitAvailable is mapped to the exploit field in the third-party entry record. |
| u\_synopsis | threat | Synopsis is mapped to the threat field in the third-party entry record. |
| u\_description | summary | Description is mapped to the summary field in the third-party entry record. |
| u\_solution | solution | Solution is mapped to the solution field in the third-party entry record. |
| u\_basescore | score | BaseScore is mapped to the score field in the third-party entry record. |
| u\_temporalScore | temporal\_score | Temporal Score is mapped to the temporal score in the third-party entry record. |
| u\_cvssv3basescore | v3\_base\_score | Cvssv3basescore is mapped to the v3 base score in the third-party entry record. |
| u\_cvsstemporalscore | v3\_temporal\_score | Cvssv3temporal score is mapped to the v3 temporal score in the third-party entry record. |
| u\_pluginpubdate | date\_published | Plugin published date is mapped to the plugin published date in the third-party entry record. |
| u\_pluginmoddate | last\_modified | Last modified date is mapped to the plugin last modified date in the third-party entry record. |
| u\_dnsname | fqdn | DnsName is mapped to the FQDN field of the cmdb\_ci record. |
| u\_macaddress | mac\_address | MacAddress is mapped to the mac\_address field of the cmdb\_ci record. |
| u\_netbiosName | netbios | NetbiosName is mapped to the NETBIOS field of the cmdb\_ci record. |
| u\_ip | ip | IP is mapped to the IP field of cmdb\_ci record. |
| hostUniqueness | uuid | Host uniqueness is not mapped to any field but is used to determine uuid for the host. |
| u\_family | category | Maps the name field in the family object of the plugin to the category column of third-party entry record. |
| u\_plugintext | proof | Plugin text is mapped to proof in tpe record. |
| \[script\] | source | The source of the integration is populated. The vulnerable items created from this integration have Tenable.sc as the source. |
| \[script\} | integration\_instance | The integration\_instance is the name of the instance from which the vulnerable item is imported. |
| u\_vpr\_score | source\_risk\_score | Maps VPR score from the scanner to the Source risk score in the third-party entry table. |
| \[script\] | source\_risk\_rating | Maps the vpr score to the standard risk rating based on the score ranges:- 9 - 10 – Critical - 7 – 9 – High - 4–7 – Medium - 0–4 - Low |
| u\_vpr\_context\[id=age\_of\_vuln\] | age\_of\_vuln | Maps the age of the vulnerability from the scanner to age\_of\_vuln in the third-party entry table. |
| u\_vpr\_context\[id=exploit\_code\_maturity\] | exploit\_code\_maturity | Maps exploit code maturity from the scanner to exploit\_code\_maturity in the third-party entry table. |
| u\_vpr\_context\[id=product\_coverage\] | product\_coverage | Maps product coverage from the scanner to product\_coverage in the third-party entry table. |
| u\_vpr\_context\[id=”threat\_sources\_last\_28\] | threat\_sources | Maps threat sources in the last 28 days from the scanner to threat\_sources in the third-party table. |
| u\_vpr\_context\[id=”threat\_intensity\_last\_28\] | threat\_intensity | Maps threat intensity in the last 28 days from the scanner to threat\_intensity in the third-party entry table. |
| u\_vpr\_context\[id=”threat\_recency”\] | threat\_recency | Maps the threat recency information from the scanner to threat\_recency in the third-part entry table. |
| u\_vpr\_context\[id=cvssV3\_impactScore\] | v3\_impact\_subscore | Maps CVSS v3 impact score from the scanner to v3\_impact\_subscore in the third-party entry table. |
| u\_pluginname | name | Maps the name of the plugin to name column in third-party entry table. |
| u\_stigseverity | stig\_severity | Maps the stig\_severity field in the plugin to stig\_severity in third-party entry table. |
| u\_checktype | check\_type | Maps the check type to check\_type in third-party entry table. |
| u\_family.id | family\_id | Maps the plugin family.id to family\_id in the third-party entry table. |
| \[script\] | exploit\_attack\_vector | The exploit\_attack\_vector column in the third\_party\_entry table is populated based on exploit\_available and v3\_attack\_vector of columns. |
| Source field | Description |
|---|---|
| u_cve | Inserts CVE-related data into the reference table (sn_vul_nvd_entry). If the same CVE in the NVD entry table (sn_vul_nvd_entry) is found, it associates the current vulnerability to the NVD entry. The mapping is found in sn_vul_m2m_entry_cve. |
| u_bid | The list of bug traqs is added as a reference. |
| u_cpe | The list of CPEs is added as a reference. |
| u_seealso | The list of URLs is added as a reference. |
| u_xrefs | The list of X-REFs is added as a reference. |
| u_exploitframeworks | The list of exploits for that plugin and Inserts mapping for applicable exploit framework and plugin to sn_vul_m2m_framework_vul. |
There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.
| When the script is run | Purpose |
|---|---|
| onStart (when an import set has started transformation) | This transform is used to initialize the values in the import_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onBefore (before an import set has completed transformation). | Function used to update the values in the vulnerability and verify if the vulnerability exists. Based on the results, modifies the values in a vulnerable items table. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onComplete (when an import set has completed transformation). | This transform is used to set the values of new VIs created, and VIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended. |
Tenable.cs container asset import
Imported asset data is first loaded into the Tenable.cs Container Asset Import [sn_vul_tenable_cs_container_asset_import] Table.
The Tenable.cs Container Asset transform map is used to transform the imported assets information. Changes to this transform alter how data from the Tenable.cs Container Asset import is processed. To access this transform map, navigate to System Import Sets > Transform Maps. Search for Tenable.cs Container Asset Transform.
The following tables lists the transform map fields by integration.
| Source field | Target field | Description |
|---|---|---|
| u_digest | Image_id | Tenable provides a unique digest for the container assets and maps to the discovered container image and docker image record and is used for CI lookup. |
| u_digest | Image_digest | Tenable provides a unique digest for the container assets and maps to the discovered container image and docker image record and is used for CI lookup. |
| u_name | name | Maps to the name field of the docker image record. |
| u_repositoryuri | name | Maps to the container repository record |
| u_repositoryuri | repo | Maps to the discovered container image record. |
| u_virtualmachines | host_list | Maps to the discovered container image record |
| u_labels | Image_labels | Maps the labels assigned to the container image to the image_labels field of the discovered container image record. |
| u_clusters | image_cluster | Maps to the discovered container image record |
| u_imagetags | tags | Maps to the discovered container image record |
| u_cloudprovider | cloud_providers | Maps to the discovered container image record |
| u_accountid | cloud_account_ids | Maps to the discovered container image record |
| u_region | cloud_regions | Maps to the discovered container image record |
| u_operatingsystem | os | Maps to the discovered container image record |
| u_scantime | last_scan_date | Maps to the discovered container image record |
There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.
| When the script is run | Purpose |
|---|---|
| onStart \(when an import set has started transformation\) | This transform is used to initialize the values in the import\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onBefore \(before an import set has completed transformation\). | A function used to update values in the host and verify if the host exists. Based on the results, modifies the values in an import\_set. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onComplete \(when an import set has completed transformation\). | This transform is used to set the values of new CIs created, and CIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended. |
Tenable.cs container vulnerability import
Imported container vulnerability data is first loaded into the Tenable.cs Container Vulnerability Import [sn_vul_tenable_cs_container_vuln_import] Table.
The Tenable.cs Container Vuln transform map is used to transform the imported container vulnerability information. Changes to this transform alter how data from the Tenable.cs Container Vulnerability Import is processed. To access this transform map, navigate to System Import Sets > Transform Maps. Search for Tenable.cs Container Vuln Transform.
The following tables list the transform map fields by integration.
| Source field | Target field | Description |
|---|---|---|
| [script] | Image_id | Digest is extracted from the Resource.Id field from the API and mapped to image_id field of discovered container image and docker image record. |
| [script] | Image_digest | Digest is extracted from the Resource.Id field from the API and mapped to image_digest field of discovered container image and docker image record. |
| [script] | name | Repository information is extracted from name field and mapped to docker image and container repository record. |
| [script] | repo | Repository information is extracted from name field and mapped to discover container image record. |
| u_resource.Labels | Image_labels | Maps to the discovered container image record |
| u_resource.CloudProvider | cloud_providers | Maps to the discovered container image record |
| u_resource. AccountId | cloud_account_ids | Maps to the discovered container image record |
| u_resource.Region | cloud_regions | Maps to the discovered container image record |
| u_vulnerability. Id | id | Maps id from source and adds the TEN- prefix. For example, if the id received is 12345, the id in the third-party entry table is TEN-12345. |
| u_vulnerability. Description Id | summaryid | Maps to the third-party entry record. or CVE record. |
| u_vulnerability.Severity | v4_base_severity | Maps to the third-party entry record. |
| u_vulnerability.VprScore | source_risk_score | Maps to the third-party entry record. |
| u_vulnerability.VprSeverity | source_severity | Maps to the third-party entry record. |
| u_vulnerability.AttackVector | v4_attack_vector | Maps to the third-party entry record. |
| u_vulnerability.ExploitMaturity | v4_exploit_maturity | Maps to the third-party entry record. |
| [script] | source | he source for imported TPE is Tenable.cs. |
| u_vulnerability.Id | name | Maps to the vulnerability references record |
| u_vulnerability. Links | url | Maps to the vulnerability references record |
| vulnerability | Reference of TPE or CVE in vulnerability references record | |
| u_software.Name | name | Maps to the container image package record |
| u_software.Version | version | Maps to the container image package record |
| u_software.Type | package_type | Maps to the container image package record |
| u_softwarepaths | path | Maps to the container image package record |
| u_resolved | status | Maps to the container image finding record |
| u_firstscantime | first_found | Maps to the container image finding record |
| u_resource.ScanTime | last_found | Maps to the container image finding record |
| u_vulnerability.Description | proof | Maps to the container image finding record |
| u_resolved | state | Maps to the container vulnerable item record |
| u_firstscantime | first_found | Maps to the container vulnerable item record |
| u_resource.ScanTime | last_found | Maps to the container vulnerable item record |
| [script] | source | The source for container vulnerable item record is Tenable.cs. |
There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.
| When the script is run | Purpose |
|---|---|
| onStart (when an import set has started transformation) | Triggers TenableCS Container Vulnerabilities Processor which imports data from Tenable.cs using the import set and loads each record into the CMDB CI table, the Vulnerable Item table, Third-party Vulnerability Entry table, Vulnerability Reference table, Container Image Package, Container Image Finding, and Container Vulnerable Item. Modifying or deleting isn’t recommended. |
| onBefore (before an import set has completed transformation) | Checks if the third-party Entry and Image Findings exist. If not, these records are created in their respective tables. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onComplete (when an import set has completed transformation) | Updates the count of CIs, VITs, and Findings as imported from Tenable.cs. This script is for internal use, and modifying or deleting them isn’t recommended. |
Tenable.cs compute vulnerability import
Imported host vulnerability data is first loaded into the Tenable.cs Compute Vulnerability Import [sn_vul_tenable_cs_compute_vuln_import] Table.
The Tenable.cs Compute Vuln transform map is used to transform the imported host vulnerability information. Changes to this transform alter how data from the Tenable.cs Compute Vulnerability Import is processed. To access this transform map, navigate to System Import Sets > System Import Sets. Search for Tenable.cs Compute Vuln Transform.
The following table lists the transform map fields by integration.
| Source field | Target field | Description |
|---|---|---|
| u\_resource.Id | object\_id | Maps to the CMDB Ci record. |
| u\_resource.Name | name | Maps to the CMDB Ci record. |
| asset\_category | Cloud is mapped as Asset Category in discovered item record. | |
| U\_resource.CloudProvider | cloud\_service\_provider | Maps to the discovered item record |
| u\_resource.Region | cloud\_region | Maps to the discovered item record |
| u\_resource.AccountId | cloud\_account | Maps to the discovered item record |
| u\_resource. CloudProvider | cloud\_resource\_type | Maps to the discovered item record |
| u\_resource.Id | resource\_id | Maps to the discovered item record |
| u\_resource.Name | resource\_name | Maps to the discovered item record |
| u\_vulnerability.Id | id | Maps id from source and adds the TEN- prefix. For example, if the id received is 12345, the id in the third-party entry table is TEN-12345. Maps id to CVEs as well. |
| u\_vulnerability. Description | summary | Maps to the third-party entry record. |
| u\_vulnerability.Severity | v4\_base\_severity | Maps to the third-party entry record. |
| u\_vulnerability.VprScore | source\_risk\_score | Maps to the third-party entry record. |
| u\_vulnerability.VprSeverity | source\_severity | Maps to the third-party entry record. |
| u\_vulnerability.AttackVector | v4\_attack\_vector | Maps to the third-party entry record. |
| u\_vulnerability.ExploitMaturity | v4\_exploit\_maturity | Maps to the third-party entry record. |
| \[script\] | source | The source for imported TPE is Tenable.cs. |
| u\_vulnerability.Id | name | Maps to the vulnerability references record |
| u\_vulnerability.Links | url | Maps to the vulnerability references record |
| vulnerability | Reference of TPE or CVE in vulnerability references record | |
| u\_resolved | status | Maps to the vulnerable item detection record |
| u\_firstscantime | first\_found | Maps to the vulnerable item detection record |
| u\_resource.ScanTime | last\_found | Maps to the vulnerable item detection record |
| u\_softwarepaths | proof | Maps to the vulnerable item detection record |
| u\_softwareresolutionversions | solution\_summary | Maps to the vulnerable item detection record |
| u\_resolved | state | Maps to the vulnerable item record |
| u\_firstscantime | first\_found | Maps to the vulnerable item record |
| u\_resource.ScanTime | last\_found | Maps to the vulnerable item record |
| \[script\] | source | The source for vulnerable item record is Tenable.cs. |
There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.
| When the script is run | Purpose |
|---|---|
| onStart (when an import set has started transformation) | Triggers Tenable CS Compute Vulnerabilities Processor which imports data from Tenable.cs using the import set and loads each record into the CMDB CI table, the Vulnerable Items table, and the Third-party vulnerability table. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onBefore (before an import set has completed transformation). | Checks if the third-party entry and detections exist. If not, these records are created in their respective tables. This script is for internal use, and modifying or deleting them isn’t recommended. |
| onComplete (when an import set has completed transformation). | Updates the count of CIs, VITs, and detections as imported from Tenable.cs. This script is for internal use, and modifying or deleting them isn’t recommended. |
| Source field | Target field | Description |
|---|---|---|
| u_digest | Image_id | A unique digest provided by Tenable for the container assets. It maps to the discovered container image and docker image record and is used for CI lookup. |
| u_name | name | Maps to the name field of the docker image record. |
Standardized logic for calculating source_risk_score and source_risk_rating
As part of the standardized data-transformation, the Tenable integration uses a centralized business rule to populate both source_risk_score and source_risk_rating.
During the integration run, if either vprv1_risk_score or vprv2_risk_score is updated, the system automatically recalculates and populates source_risk_score and source_risk_rating using the values from the vprv2_risk_score and vprv1_risk_score fields in the Third-Party Entry table.
- If vprv2_risk_score is present, it takes precedence overvprv1_risk_score.
- If the vprv1_risk_score and vprv2_risk_score are empty, then source_risk_score will not be changed.
- source_risk_rating is derived from the finalized source_risk_score using the standardized thresholds:
- 9-10 → Critical
- 7-9 → High
- 4-7 → Medium
- 0-4 → Low
- NaN → None
Note: The before changes will be implemented as part of Tenable 5.2.1 Version.