> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/privileged-access-manager/cloud-security/tenable-integration.md). # Tenable Integration Connect Tenable findings to Keeper Cloud Security for closed-loop remediation.
## Overview The Tenable integration sends cloud security findings into Keeper Cloud Security for remediation. It is built for issues that need credential rotation, managed onboarding, or tighter privileged access controls. ### Why Integrate Tenable With Keeper Tenable identifies exposed identities, risky access paths, and cloud misconfigurations. Keeper helps you act on those findings by turning them into managed privileged access controls. This integration helps you: * Send relevant Tenable findings directly to Keeper. * Remediate identities and resources with KeeperPAM controls. * Keep remediation status aligned across both systems. ### Remediation Workflow 1. An admin receives a finding in Tenable. 2. The admin reviews the finding and sends it to Keeper for remediation. 3. A Keeper admin receives the finding and maps the affected resource in Keeper. 4. After remediation, Keeper marks the finding in Tenable as Resolved. {% hint style="info" %} Keeper uses [Keeper Encrypter](/keeperpam/privileged-access-manager/cloud-security/keeper-encrypter.md) to preserve zero-knowledge architecture during this exchange. {% endhint %} ## Setup {% stepper %} {% step %} ### Set Up a Keeper Integration in Tenable Follow the steps below to set up a Keeper integration with Tenable Cloud Security. * Follow the steps in Tenable to [Create a Service Account and Secret](https://docs.app.tenable.com/docs/api-get-started#create-a-service-account-and-secret). Be sure to save the Secret. * Reference Tenable documentation for API Endpoints. Be sure to save the URL, for example: `https://us.app.ermetic.com/api/graph/`. * Do not attempt to create the webhook until the later step [Create a Webhook in Tenable](#create-a-webhook-in-tenable). {% endstep %} {% step %} ### Select a PAM configuration Navigate to secrets manager and select a PAM Configuration you want to link the CNAPP provider to. In your PAM Configuration: * Choose **Tenable** as the CNAPP provider. * Create a new **CNAPP Configuration Record** by clicking the "+" button. * Enter configuration values in the following step.
{% endstep %} {% step %} ### CNAPP Configuration Record Enter values into the CNAPP configuration record: * Enter the **Title**. * Enter the **Secured Note** by pasting the encryption key generated during [Encrypter key setup](/keeperpam/privileged-access-manager/cloud-security/keeper-encrypter.md#generate-a-256-bit-encryption-key). * Enter the **Encrypter Base URL**, configured during [Encrypter DNS setup](/keeperpam/privileged-access-manager/cloud-security/keeper-encrypter.md#configure-dns-ssl-tls-for-encrypter). * Enter the **Secret Key**, or use the dice icon to generate a password. * Enter the **Service Account Secret**, created above during [Keeper Integration](#set-up-a-keeper-integration-in-tenable). * Click Add button to save the new configuration record.
{% endstep %} {% step %} ### Deploy and verify Keeper Encrypter In your PAM Configuration: * Click the link to **Complete integration setup**. Use the **Verify Connection** tab to connect Keeper Encrypter to this PAM Configuration. * Click button to **Download Docker Compose** file. * Follow steps to configure and deploy [Keeper Encrypter](/keeperpam/privileged-access-manager/cloud-security/keeper-encrypter.md#configure-and-deploy-encrypter). * Click **Verify**. A green checkmark confirms that Keeper Encrypter is connected successfully.
{% endstep %} {% step %} ### Create a Webhook in Tenable From the same dialog in previous step, use the **Verify Connection** tab and scroll down to the section for **Tenable Configuration**. * Copy the value of **Webhook URL**. * Copy the value of **API Token**. * Follow the steps in Tenable to [Add a Webhook](https://docs.app.tenable.com/docs/webhooks#add-a-webhook) being sure to add an HTTP header as follows. * Set **Name** to `Authorization` . * Set **Value** to `Bearer [token]` where **\[token]** is the previously copied **API Token**. {% endstep %} {% step %} ### Authorize Tenable In the **Authorize with Tenable** tab: * Enter the **API Endpoint URL** created above during [Keeper Integration](#set-up-a-keeper-integration-in-tenable). * Click **Authorize** button.
After successful authorization, save changes to the PAM configuration. Click the **View CNAPP Queue** button to navigate to the Cloud Security Dashboard.
{% endstep %} {% endstepper %} ## User Experience ### Cloud Security Dashboard From the Tenable console, the admin pushes the findings to Keeper. Once pushed, the issues will appear in the **Cloud Security** dashboard, complete with full context from the CNAPP provider.
### Vulnerability Details A CNAPP provider has identified an issue. In order to start the remediation, hover over the issue and click on it.
You can then view a detailed description from the CNAPP provider and start remediation by selecting **Remediate Actions.**
### Selecting a Remediation Once a resource is successfully onboarded, you can choose between four different remediations: * Rotate Credential * Manage Access * Enable JIT Access * Remove Standing Privilege Select the appropriate remediations and click **Next**.
### Onboarding a Resource Select the appropriate record type for the resource you wish to onboard. Then follow their configuration documentation and click **Add**. The Cloud Security Dashboard currently supports onboarding of five record types for resources: * [PAM Database](/keeperpam/privileged-access-manager/getting-started/pam-resources/pam-database.md) * [PAM Machine](/keeperpam/privileged-access-manager/getting-started/pam-resources/pam-machine.md) * [PAM Directory](/keeperpam/privileged-access-manager/getting-started/pam-resources/pam-directory.md) * [PAM Remote Browser](/keeperpam/privileged-access-manager/getting-started/pam-resources/pam-remote-browser.md) * [PAM Cloud](/keeperpam/privileged-access-manager/getting-started/pam-resources/pam-cloud.md)
First select the PAM configuration you would like to perform the remediation with. You can create a new PAM configuration if needed.
Then you can onboard a resource if Enable JIT Access or Manage Access remediations were selected.
Once a resource is onboarded, you can onboard a [PAM User](/keeperpam/privileged-access-manager/getting-started/pam-resources/pam-user.md) record to link to that resource. In cases where the CNAPP provider finds a compromised cloud identity, a PAM User record can directly be onboarded without a PAM Database, PAM Machine, PAM Directory or PAM Remote Browser being onboarded. Click **Add** and then click **Start Remediation**.
### Starting Remediation If **Rotate Credential** was selected for remediation actions, edit the [rotation settings](/keeperpam/privileged-access-manager/password-rotation/rotation-overview.md#configure-rotation-settings) and customize the newly generated password. Once you have the rotation configured, click **Update** and then click **Save and Continue**.
If **Manage Access** was selected for remediation actions, edit the [connection configuration settings](/keeperpam/privileged-access-manager/connections.md) and manage the access to the onboarded resource though a zero trust interactive session. Once you have the connection configured, click **Update** and then click **Save and Continue**.
If **Enable JIT** was selected for remediation actions, edit the [JIT configuration settings](/keeperpam/privileged-access-manager/just-in-time-access-jit/ephemeral-accounts-and-privilege-elevation.md) and set up Just-in-Time access for the record.
Then select **Workflow** to edit the [workflow configuration settings](/keeperpam/privileged-access-manager/just-in-time-access-jit.md#pages-in-this-section), limit access time to a resource, add required approvers, enable record check-in, and require MFA. Once you have your [JIT rollout](/keeperpam/privileged-access-manager/just-in-time-access-jit.md#recommended-rollout) configured, click **Update** and then click **Save and Continue**.
If **Remove Standing Privilege** was selected for remediation actions, remove groups and roles associated with the onboarded user. All the current groups and roles of onboarded user are populated automatically. Once the appropriate groups and roles are selected to be removed, click **Remove.**
Once all remediation actions have been processed, Keeper then automatically notifies Tenable that the issue has been addressed. The finding moves to the **Resolved** tab in the **Cloud Security** dashboard, and the Tenable team sees the updated status on their end without any manual follow-up.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.keeper.io/keeperpam/privileged-access-manager/cloud-security/tenable-integration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.