Tenable Exposure Management Integration

The Bright integration with Tenable Exposure Management (Tenable One) allows you to bring Bright DAST findings into Tenable and manage them alongside other assets and security findings.

The integration is unidirectional, with Bright data ingested into Tenable Exposure Management.

How the integration works

The Tenable Bright connector uses Bright APIs to ingest Bright assets and findings.

Bright projects are represented in Tenable Exposure Management as web application assets, while Bright issues are represented as findings.

The integration supports Bright Core and the latest SaaS version of Tenable Exposure Management.

What you can do

With the Bright integration, you can:

• View Bright web application assets alongside other assets in Tenable One.
• Analyze Bright DAST findings using Tenable's exposure and vulnerability views.
• Filter Bright-originated assets and findings.
• Include Bright findings in Tenable dashboards and reports.
• Use existing Tenable workflows to track Bright-originated issues.
• Keep finding statuses updated based on changes in Bright.

Prerequisites

Before configuring the integration, create a Bright API key.

The API key requires the following scopes:

• groups:read
• projects:read
• issues:read

The Bright user creating the API key must have access to all projects that you want to ingest into Tenable Exposure Management.

Tenable recommends creating the API key without an expiration date.

You will need the Bright User ID and API key when configuring the connector in Tenable.

Configure the integration

The integration is configured from Tenable Exposure Management.

1. In Bright, navigate to Settings > API Keys.
2. Create an API key with the required scopes.
3. Copy the User ID and API key.
4. In Tenable Exposure Management, navigate to Connectors.
5. Select Add new connector.
6. Find the Bright connector and select Connect.
7. Enter the Bright API key.
8. Configure the data pulling options as needed.
9. Use Test Connectivity to verify the connection.
10. Configure the connector synchronization schedule.
11. Create the connector.

Tenable begins synchronizing data from Bright after the connector is created.

For complete configuration instructions, data mappings, synchronization behavior, and troubleshooting information, see the Tenable Bright Connector documentation.

Data synchronization

Tenable Exposure Management synchronizes with Bright to retrieve new and updated assets and findings.

Changes made in Bright are reflected in Tenable after the next scheduled synchronization.

You can also configure:

• Fetch unconfirmed issues - Include Bright issues that have not yet been confirmed.
• Asset Retention - Define how long assets that are no longer detected or updated should remain in Tenable Exposure Management.
• Connector scheduling - Define when connector synchronization should occur.

Finding status mapping

Bright finding statuses are mapped to Tenable Exposure Management as follows:

If a finding is resolved in Bright, its status is updated to Fixed in Tenable after the next synchronization.

Severity mapping

Bright findings are mapped according to their CVSS score:

View Bright data in Tenable

After synchronization, Bright data can be viewed from the Assets, Weaknesses, and Findings areas in Tenable Exposure Management.

Use the 3rd Party Connectors filter and select the Bright connector to view data originating from Bright.