Tenable Integration with DefectDojo

Tenable Integration with DefectDojo

Tenable is a vulnerability management vendor best known for Nessus, its network vulnerability scanner. Its product line includes Tenable Vulnerability Management (formerly Tenable.io, cloud hosted), Tenable Security Center (formerly Tenable.sc, on-premises), and Tenable Web App Scanning for DAST. These products scan hosts, network services, and web applications using Tenable's plugin library, and export results as .nessus XML or CSV, including CSV exports from Vulnerability Management workbenches. Tenable also took over Terrascan, an open source infrastructure as code scanner, when it acquired Accurics in 2021; the Terrascan repository was archived and marked no longer maintained in November 2025.

Tenable Integration with DefectDojo

We scan our server fleet with Tenable, and we have other teams running SAST, SCA, and container scanners that Tenable doesn't cover. DefectDojo is where those results meet. Importing Tenable exports, or syncing them with the DefectDojo Pro connectors, turns each plugin hit into a Finding with the affected hosts as endpoints, CVEs, CVSS data, and Tenable's own solution text. Host vulnerabilities then get the same owners, SLAs, and reports as application findings on the same Asset.

Why Tenable Matters

Most organizations' largest volume of vulnerabilities comes from operating systems, network services, and third-party software on servers. Tenable is built to find them.

• Nessus plugins cover a very large set of software, configuration, and compliance checks, updated continuously.
• Authenticated scans see installed packages and patch levels, not just exposed banners.
• Exports include CVEs, CVSS vectors, Tenable's VPR, and EPSS where available, which supports risk-based prioritization.
• Tenable Web App Scanning extends coverage to application-layer issues on the same platform.
• Host findings alone don't show how a server's exposure relates to the application running on it. That needs a platform that holds both.

Advantages of This Integration

What we gained by sending Tenable data through DefectDojo:

• Deduplication on plugin, severity, and CVE. Tenable Scan findings are hashed on title, severity, vulnerability IDs, and CWE, so rescans of the same hosts update existing findings instead of duplicating them.
• Lifecycle through reimport or sync. Reimporting a new export into the same Test mitigates vulnerabilities that were patched and reopens ones that return. The Web App Scanning connector closes findings Tenable marks fixed on the next sync.
• Prioritization data kept. CSV imports store the EPSS score on the finding and copy columns such as VPR score, CVSS v3 and v4 scores, STIG severity, and exploit framework flags into the severity justification, when the export uses those column names.
• Application and host risk together. Tenable findings can sit on the same Asset as code and dependency findings, with SLAs, assignment, risk acceptance, and Jira push.
• IaC coverage alongside runtime. Terrascan results import into the same platform, so a misconfiguration in Terraform and the exposure it causes can be tracked side by side.

How This Integration Works

The row covers two scan types: Tenable Scan for Tenable and Nessus exports, and Terrascan Scan for Terrascan JSON.

Option 1: Tenable Scan file import (Community Edition and DefectDojo Pro). Export scan results from Nessus, Tenable Vulnerability Management, or Tenable Security Center as .nessus or CSV. The parser chooses its XML or CSV reader by file extension (.nessus, .xml, or .csv) and accepts Nessus WAS reports in both formats. Import in the UI with Import Scan Results, or with the API:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Tenable Scan" \
  -F "file=@weekly-servers.nessus" \
  -F "product_name=datacenter-east" \
  -F "engagement_name=Weekly Network Scan" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Tenable Scan" \
  --report-path "./weekly-servers.nessus" \
  --product-name "datacenter-east" \
  --engagement-name "Weekly Network Scan" \
  --auto-create-context

Option 2: Tenable connectors (DefectDojo Pro). Two Upstream Connectors pull from Tenable's cloud API at https://cloud.tenable.com; on-premises Tenable connectors are not available.

• Tenable.io pulls scans from the Tenable Vulnerability Management /scans endpoint. Enter the location and a valid API key.
• Tenable Web App Scanning imports DAST findings. It needs an access key and secret key for a user with Web App Scanning permissions, creates one Record per scanned web application, and can apply a minimum severity. Findings keep the severity Tenable reports (including recast severities) and carry the URL, parameter, payload, proof, CWE, CVE, CVSS, and EPSS where available. Only open or reopened findings are imported.

Option 3: Terrascan Scan. Run Terrascan against your IaC and write JSON:

terrascan scan -i terraform -d ./infra -o json > terrascan.json

Import it with scan_type=Terrascan Scan using the same API or Universal Importer commands. Because Terrascan is no longer maintained, plan a migration to a maintained IaC scanner for new work.

Data Granularity: What Gets Imported

Tenable Scan, .nessus (XML)

Tenable Scan, CSV

The CSV reader also understands Tenable Vulnerability Management exports with asset.* and definition.* columns and semicolon delimiters. Within one CSV, findings are kept separate per host and port.

Terrascan Scan

Use Cases

Weekly infrastructure scanning: A scheduled Nessus scan exports .nessus and reimports into one Test per network segment. Patched vulnerabilities close automatically, and SLA reports show which teams are behind on Critical host findings.

Cloud-first programs on DefectDojo Pro: Teams on Tenable Vulnerability Management use the connector so scans flow in on a schedule, and add the Web App Scanning connector to bring DAST findings into the same Assets.

Risk-based patching: CSV exports that include an EPSS Score column populate each finding's EPSS score, which lets a team work High findings with meaningful exploit likelihood first.

Legacy IaC coverage: Repositories still scanned with Terrascan keep reporting into DefectDojo while the team moves to another IaC tool, and the history stays with the Asset.

Operational Tips

• Choose XML or CSV and stay with it per Test. The two readers group findings differently (XML merges hosts into one finding per plugin, CSV keeps them per host), so switching formats changes the finding count.
• Remember the CVSS override in .nessus imports. A 4.x CVSS v3 score maps to Low rather than Medium, so review severity rules before tying SLAs to them.
• Filter out informational plugins with minimum_severity=Low. Nessus reports many severity 0 items that are inventory rather than vulnerabilities.
• Keep the file extension intact. The parser rejects files that don't end in .nessus, .xml, or .csv.
• Use one Engagement per scan policy or network zone so reimport doesn't close findings from hosts that simply weren't in this scan.
• Don't import the same Tenable scans through both files and the connector; their findings won't line up cleanly.