> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Tenable Nessus

> Correlate detections with Tenable Vulnerability Management scan activity

The Tenable Nessus integration helps Wirespeed identify detections that were likely triggered by Tenable Vulnerability Management scan activity.

When Wirespeed evaluates a detection, it checks Tenable for overlapping scan runs and correlates the detection's source or affected asset with Tenable scanner and target data.

<Info>
  This integration targets Tenable Vulnerability Management cloud APIs at
  `cloud.tenable.com`. Self-hosted Nessus scanner APIs are not supported yet.
</Info>

## Requirements

Create a Tenable API key pair with read access to scan and scanner data.

The API key must be able to:

* List scans
* Read scan history
* Read scan details
* List scanners

In Tenable terms, listing scanners requires the **Scan Manager** role (or **Administrator**), or a custom role with equivalent privileges. Lower roles such as Scan Operator cannot list scanners and will fail to connect.

<Tip>
  Tenable allows only one valid API key per user, and Tenable recommends a
  unique account for each integration. Create a dedicated service-account user
  for Wirespeed so its key does not collide with a person's key or another
  tool's.
</Tip>

## Setup

1. Log in to [Tenable Vulnerability Management](https://cloud.tenable.com).
2. In the upper-right corner, click your user profile icon.
3. Open **My Account**.
4. In the left navigation, click **API Keys**.
5. Click **Generate**.
6. Review Tenable's warning, then continue generating the key pair.
7. Copy the values shown under **Access Key** and **Secret Key**. Tenable only shows the secret when the key is generated, so store it somewhere secure before closing the page.
8. In Wirespeed, go to [Settings → Integrations](https://app.wirespeed.co/settings/integrations).
9. Select **Tenable Nessus**.
10. Enter the Tenable **Access Key** and **Secret Key**.
11. Save the integration.

<Warning>
  Generating a new Tenable API key pair invalidates any existing API keys for
  that user account. Update other tools that use the previous key before
  rotating it.
</Warning>

## How Matching Works

Wirespeed checks recent Tenable scan activity around the detection timestamp. A detection is marked as correlated when Wirespeed finds an overlapping scan run and either:

* The detection source IP matches a Tenable scanner IP **and** that scanner is the one that ran the overlapping scan (confirmed via the scan's reported scanner name). If the scan does not report which scanner ran it, Wirespeed falls back to target matching instead.
* The affected endpoint IP or hostname appears in the overlapping scan's host or target data.