Skip to main content
The Tenable Nessus integration helps Wirespeed identify detections that were likely triggered by Tenable Vulnerability Management scan activity. When Wirespeed evaluates a detection, it checks Tenable for overlapping scan runs and correlates the detection’s source or affected asset with Tenable scanner and target data.
This integration targets Tenable Vulnerability Management cloud APIs at cloud.tenable.com. Self-hosted Nessus scanner APIs are not supported yet.

​
Requirements

Create a Tenable API key pair with read access to scan and scanner data. The API key must be able to:
  • List scans
  • Read scan history
  • Read scan details
  • List scanners
In Tenable terms, listing scanners requires the Scan Manager role (or Administrator), or a custom role with equivalent privileges. Lower roles such as Scan Operator cannot list scanners and will fail to connect.
Tenable allows only one valid API key per user, and Tenable recommends a unique account for each integration. Create a dedicated service-account user for Wirespeed so its key does not collide with a person’s key or another tool’s.

​
Setup

  1. Log in to Tenable Vulnerability Management.
  2. In the upper-right corner, click your user profile icon.
  3. Open My Account.
  4. In the left navigation, click API Keys.
  5. Click Generate.
  6. Review Tenable’s warning, then continue generating the key pair.
  7. Copy the values shown under Access Key and Secret Key. Tenable only shows the secret when the key is generated, so store it somewhere secure before closing the page.
  8. In Wirespeed, go to Settings → Integrations.
  9. Select Tenable Nessus.
  10. Enter the Tenable Access Key and Secret Key.
  11. Save the integration.
Generating a new Tenable API key pair invalidates any existing API keys for that user account. Update other tools that use the previous key before rotating it.

​
How Matching Works

Wirespeed checks recent Tenable scan activity around the detection timestamp. A detection is marked as correlated when Wirespeed finds an overlapping scan run and either:
  • The detection source IP matches a Tenable scanner IP and that scanner is the one that ran the overlapping scan (confirmed via the scan’s reported scanner name). If the scan does not report which scanner ran it, Wirespeed falls back to target matching instead.
  • The affected endpoint IP or hostname appears in the overlapping scan’s host or target data.