ServiceNow Tenable Integration Guide

Architecture Overview

Implementation Steps

// Flow script step for processing vulnerability data
var vulnGr = new GlideRecord('sn_vul_vulnerable_item');
vulnGr.initialize();
vulnGr.number = fd_data.plugin_id;
vulnGr.short_description = fd_data.plugin_name;
vulnGr.state = fd_data.severity >= 7 ? '1' : '2'; // Critical/High vs Medium/Low
vulnGr.cmdb_ci = findCIByIP(fd_data.asset.ipv4);
vulnGr.cvss_base_score = fd_data.cvss_base_score;
vulnGr.insert();

// CI correlation function
function findCIByIP(ipAddress) {
    var ciGr = new GlideRecord('cmdb_ci');
    ciGr.addQuery('ip_address', ipAddress);
    ciGr.query();
    if (ciGr.next()) {
        return ciGr.sys_id;
    }
    // Create new CI if not found
    var newCI = new GlideRecord('cmdb_ci_computer');
    newCI.initialize();
    newCI.name = 'Unknown-' + ipAddress;
    newCI.ip_address = ipAddress;
    return newCI.insert();
}

// Business rule for automatic task creation
(function executeRule(current, previous) {
    if (current.cvss_base_score >= 7.0 && current.state == '1') {
        var task = new GlideRecord('sc_task');
        task.initialize();
        task.short_description = 'Remediate: ' + current.short_description;
        task.description = 'CVSS Score: ' + current.cvss_base_score + '\nAffected CI: ' + current.cmdb_ci.getDisplayValue();
        task.priority = current.cvss_base_score >= 9.0 ? '1' : '2';
        task.assignment_group = current.cmdb_ci.support_group;
        task.insert();
    }
})(current, previous);

// Scheduled job script for vulnerability sync
var sm = new sn_ws.RESTMessageV2();
sm.setEndpoint('https://cloud.tenable.com/vulns/export');
sm.setHttpMethod('POST');
sm.setRequestHeader('X-ApiKeys', 'accessKey=' + accessKey + ';secretKey=' + secretKey);
var lastSync = gs.getProperty('tenable.last.sync', '2024-01-01');
var payload = '{"filters":{"last_found":{"gte":' + lastSync + '}},"format":"json"}';
sm.setRequestBody(payload);
var response = sm.execute();
gs.info('Tenable sync completed: ' + response.getStatusCode());

// Validation script for testing data integrity
var vulnCount = new GlideAggregate('sn_vul_vulnerable_item');
vulnCount.addQuery('sys_created_on', '>=', gs.daysAgoStart(1));
vulnCount.addAggregate('COUNT');
vulnCount.query();
if (vulnCount.next()) {
    gs.info('Vulnerabilities imported in last 24h: ' + vulnCount.getAggregate('COUNT'));
}
// Verify CI correlation rate
var correlatedCount = new GlideAggregate('sn_vul_vulnerable_item');
correlatedCount.addQuery('cmdb_ci', '!=', '');
correlatedCount.addAggregate('COUNT');
correlatedCount.query();
gs.info('CI correlation success rate: ' + (correlatedCount.getAggregate('COUNT') / vulnCount.getAggregate('COUNT') * 100) + '%');

Common Use Cases

Troubleshooting

Pro Tips

• →Implement delta synchronization by storing the last successful import timestamp in a system property and using Tenable's last_modified filter parameters to retrieve only changed vulnerability data, dramatically reducing API calls and import processing time. This approach also minimizes the risk of hitting Tenable's API rate limits while ensuring your ServiceNow instance stays current with the latest vulnerability findings.
• →Create custom vulnerability aging reports by combining Tenable's first_found and last_found timestamps with ServiceNow's remediation task completion data to identify vulnerabilities that persist across multiple scan cycles. This enables security teams to focus on recurring issues that may indicate systemic problems or insufficient remediation processes rather than just addressing the latest scan findings.
• →Configure conditional task assignment logic that considers both CVSS scores and affected CI business criticality by creating a weighted scoring system that multiplies technical severity with business impact ratings stored in your CMDB. This ensures that a medium-severity vulnerability on a critical production system receives higher priority than a high-severity finding on a development server, optimizing remediation resource allocation.
• →Set up automated vulnerability lifecycle management by implementing business rules that monitor Tenable scan results for previously identified vulnerabilities that are no longer detected, automatically updating ServiceNow vulnerability records to 'Resolved' status and closing associated remediation tasks. This reduces manual administrative overhead and ensures that vulnerability metrics accurately reflect current security posture.
• →Leverage ServiceNow's notification framework to create intelligent alerting that prevents notification fatigue by grouping vulnerability notifications by affected business service or CI support group, sending consolidated daily or weekly summaries instead of individual alerts for each finding. Include trending information and remediation progress metrics to make notifications more actionable for recipients.
• →Implement vulnerability exception management by creating custom fields and workflows that allow security teams to mark certain vulnerabilities as accepted risks or false positives directly in ServiceNow, then sync these decisions back to Tenable to prevent recurring alerts for approved exceptions. This creates a centralized risk acceptance process that integrates with your existing ServiceNow approval workflows.

Known Limitations

• —The Tenable API enforces strict rate limiting of 200 requests per minute for Tenable.io and 100 requests per minute for Tenable.sc, which can significantly impact large-scale vulnerability imports and may require complex batch processing logic to avoid integration failures. Organizations with extensive asset inventories may experience multi-hour import times during initial synchronization or after extended periods without data sync.
• —ServiceNow's IntegrationHub Tenable spoke requires Professional or Enterprise licensing tiers and is not available with Basic IntegrationHub licenses, potentially increasing total cost of ownership for organizations that haven't already invested in advanced IntegrationHub capabilities. The spoke also has limitations in customizing data transformation logic compared to custom REST message implementations.
• —Real-time vulnerability status updates from ServiceNow back to Tenable platforms are limited by API capabilities and may not support all desired workflow states, particularly for complex change management processes or custom remediation workflows that don't map directly to Tenable's vulnerability lifecycle model. This can result in data synchronization gaps between the two platforms.
• —The integration doesn't natively support Tenable's container security or web application scanning modules, requiring additional custom development to incorporate findings from Tenable.io Container Security or Tenable.io Web App Scanning into ServiceNow vulnerability management processes. Organizations using these advanced Tenable features may need to implement separate integration flows.
• —Large-scale deployments may experience performance impacts on ServiceNow instances during bulk vulnerability imports, particularly when processing hundreds of thousands of vulnerability records with complex CI correlation logic. Database locking and memory consumption during import operations can affect overall instance responsiveness, requiring careful scheduling and resource management planning.

Frequently Asked Questions