Tenable Tables
The Tenable integration uses the following tables
Tables
TenableActivityLogs
| Name | Type | Description |
|---|---|---|
| ConfigID | integer | A unique identifier for the configuration associated with the activity log entry |
| ID | string | A unique identifier for the activity log entry itself, typically alphanumeric |
| Action | string | The specific action or event that was performed (e.g., "login", "create", "update") |
| Crud | string | Represents the type of database operation related to the activity (Create, Read, Update, or Delete) |
| IsFailure | bit | A boolean flag indicating whether the action resulted in failure (1 for failure, 0 for success) |
| Received | datetime | The timestamp when the activity log was received, with precision including date and time |
| Description | string | A textual description providing more details about the activity or event logged |
| ActorID | string | A unique identifier for the individual or system that performed the action |
| ActorName | string | The name of the individual or system that performed the action |
| IsAnonymous | bit | A boolean flag indicating whether the actor was anonymous (1 for anonymous, 0 for not anonymous) |
| TargetID | string | A unique identifier for the target entity that the action was performed on |
| TargetName | string | The name of the target entity that the action was performed on |
| TargetType | string | The type or category of the target entity (e.g., "user", "device", "file") |
| BatchDate | datetime | The date and time when the activity logs were batch-processed or recorded |
TenableAgentGroups
| Name | Type | Description |
|---|---|---|
| ConfigID | integer | A unique identifier for the configuration associated with the agent group |
| ID | integer | A unique identifier for the agent group itself, typically an integer value |
| Uuid | uniqueidentifier | A globally unique identifier (GUID) for the agent group |
| Name | string | The name of the agent group |
| CreationDate | bigint | The creation date of the agent group, stored as a bigint value representing a timestamp |
| LastModificationDate | bigint | The last modification date of the agent group, stored as a bigint value representing a timestamp |
| Timestamp | bigint | A timestamp indicating when the agent group entry was last updated, stored as a bigint value |
| Shared | integer | A flag indicating whether the agent group is shared, stored as an integer |
| Owner | string | The owner of the agent group, represented as a string (string) |
| OwnerId | integer | The unique identifier for the owner, typically an integer |
| OwnerName | string | The name of the owner of the agent group, represented as a string (string) |
| OwnerUuid | uniqueidentifier | A globally unique identifier (GUID) for the owner |
| UserPermissions | integer | The user permissions associated with the agent group, stored as an integer |
| AgentCount | integer | The number of agents in the agent group |
| BatchDate | datetime | The date and time when the agent group record was batch-processed or recorded, stored in datetime format |
TenableAgents
| Name | Type | Description |
|---|---|---|
| ConfigID | integer | A unique identifier for the configuration associated with the agent |
| ID | integer | A unique identifier for the agent itself, typically an integer value |
| Uuid | uniqueidentifier | A globally unique identifier (GUID) for the agent |
| Name | string | The name of the agent |
| Platform | string | The platform the agent is running on (e.g., Windows, Linux, etc.) |
| Distro | string | The distribution (distro) of the platform, typically used for Linux agents |
| Ip | string | The IP address of the agent |
| LastScanned | bigint | The last time the agent was scanned, stored as a bigint value representing a timestamp |
| PluginFeedId | string | The ID for the plugin feed associated with the agent |
| CoreBuild | string | The core build version of the agent |
| CoreVersion | string | The core version of the agent |
| LinkedOn | bigint | The timestamp indicating when the agent was linked, stored as a bigint value |
| LastConnect | bigint | The timestamp indicating the last time the agent connected, stored as a bigint value |
| Status | string | The current status of the agent (e.g., active, inactive, etc.) |
| Supports_Remote_Logs | bit | A boolean flag indicating whether the agent supports remote logs (1 for yes, 0 for no) |
| NetworkUuid | uniqueidentifier | A globally unique identifier (GUID) for the network associated with the agent |
| NetworkName | string | The name of the network associated with the agent |
| ProfileUuid | uniqueidentifier | A globally unique identifier (GUID) for the profile associated with the agent |
| ProfileName | string | The name of the profile associated with the agent |
| Support_Remote_Settings | bit | A boolean flag indicating whether the agent supports remote settings (1 for yes, 0 for no) |
| BatchDate | datetime | The date and time when the agent record was batch-processed or recorded, stored in datetime format |
TenableAssets
| Name | Type | Description |
|---|---|---|
| ConfigID | integer | A unique identifier for the configuration associated with the asset |
| Id | uniqueidentifier | A globally unique identifier (GUID) for the asset |
| HasAgent | bit | A boolean flag indicating whether the asset has an agent installed (1 for yes, 0 for no) |
| LastSeen | datetime | The timestamp when the asset was last seen, stored in datetime format |
| LastScanTarget | string | The last scan target associated with the asset, stored as a string (string) |
| AcrScore | integer | The Asset Criticality Rating (ACR) score for the asset, typically an integer value |
| AcrDrivers | string | The drivers associated with the asset, stored as a string (string) |
| ExposureScore | integer | The exposure score for the asset, typically an integer value |
| ScanFrequency | string | The scan frequency for the asset, stored as a string (string) |
| Ipv4 | string | The IPv4 address of the asset, stored as a string (string) |
| Ipv6 | string | The IPv6 address of the asset, stored as a string (string) |
| Fqdn | string | The Fully Qualified Domain Name (FQDN) of the asset, stored as a string (string) |
| MacAddress | string | The MAC address of the asset, stored as a string (string) |
| NetbiosName | string | The NetBIOS name of the asset, stored as a string (string) |
| OperatingSystem | string | The operating system of the asset, stored as a string (string) |
| Hostname | string | The hostname of the asset, stored as a string (string) |
| AgentName | string | The agent name associated with the asset, stored as a string (string) |
| SecurityProtectionLevel | integer | The security protection level for the asset, typically an integer value |
| ExposureConfidenceValue | float | The exposure confidence value for the asset, stored as a floating-point value |
| BatchDate | datetime | The date and time when the asset record was batch-processed or recorded, stored in datetime format |
TenableGroups
| Name | Type | Description |
|---|---|---|
| ConfigID | integer | A unique identifier for the configuration associated with the group |
| Uuid | uniqueidentifier | A globally unique identifier (GUID) for the group |
| Immutable | bit | A boolean flag indicating whether the group is immutable (1 for yes, 0 for no) |
| MembershipFixed | bit | A boolean flag indicating whether the group's membership is fixed (1 for yes, 0 for no) |
| Name | string | The name of the group |
| UserCount | integer | The number of users in the group, stored as an integer value |
| ID | integer | A unique identifier for the group, typically an integer value |
| ContainerUuid | uniqueidentifier | A globally unique identifier (GUID) for the container associated with the group |
| BatchDate | datetime | The date and time when the group record was batch-processed or recorded, stored in datetime format |
TenablePlugins
| Name | Type | Description |
|---|---|---|
| ConfigID | integer | A unique identifier for the configuration associated with the plugin |
| Id | integer | A unique identifier for the plugin itself, typically an integer value |
| Name | string | The name of the plugin |
| IntelType | string | The intelligence type associated with the plugin (e.g., vulnerability, compliance) |
| Synopsis | string | A brief synopsis of the plugin’s purpose or function |
| Description | string | A detailed description of the plugin |
| Solution | string | A solution provided by the plugin for the vulnerability or issue identified |
| PluginPublicationDate | datetime | The date the plugin was published, stored in datetime format |
| VulnPublicationDate | datetime | The date the vulnerability related to the plugin was published, stored in datetime format |
| PatchPublicationDate | datetime | The date the patch related to the plugin was published, stored in datetime format |
| HasPatch | bit | A boolean flag indicating whether the plugin has an associated patch (1 for yes, 0 for no) |
| ExploitAvailable | bit | A boolean flag indicating whether an exploit is available for the vulnerability (1 for yes, 0 for no) |
| RiskFactor | string | The risk factor associated with the plugin (e.g., high, medium, low) |
| PluginModificationDate | datetime | The date the plugin was last modified, stored in datetime format |
| AlwaysRun | bit | A boolean flag indicating whether the plugin should always run (1 for yes, 0 for no) |
| Compliance | bit | A boolean flag indicating whether the plugin is related to compliance (1 for yes, 0 for no) |
| Cvss_Vector_Raw | string | The raw CVSS (Common Vulnerability Scoring System) vector for the plugin |
| Cvss_Vector_AccessVector | string | The CVSS access vector (e.g., network, local, adjacent network) |
| Cvss_Vector_AccessComplexity | string | The CVSS access complexity (e.g., low, medium, high) |
| Cvss_Vector_Authentication | string | The CVSS authentication requirements (e.g., none, single, multiple) |
| Cvss_Vector_ConfidentialityImpact | string | The CVSS confidentiality impact (e.g., none, low, high) |
| Cvss_Vector_IntegrityImpact | string | The CVSS integrity impact (e.g., none, low, high) |
| Cvss_Vector_AvailabilityImpact | string | The CVSS availability impact (e.g., none, low, high) |
| CvssTemporalScore | float | The temporal CVSS score for the plugin, typically a floating-point value |
| Cvss3_Vector_Raw | string | The raw CVSS3 vector for the plugin (version 3) |
| Cvss3_Vector_AttackVector | string | The CVSS3 attack vector (e.g., network, local, adjacent network) |
| Cvss3_Vector_AttackComplexity | string | The CVSS3 attack complexity (e.g., low, medium, high) |
| Cvss3_Vector_PrivilegesRequired | string | The CVSS3 privileges required (e.g., none, low, high) |
| Cvss3_Vector_UserInteraction | string | The CVSS3 user interaction requirements (e.g., none, required) |
| Cvss3_Vector_Scope | string | The CVSS3 scope (e.g., unchanged, changed) |
| Cvss3_Vector_ConfidentialityImpact | string | The CVSS3 confidentiality impact (e.g., none, low, high) |
| Cvss3_Vector_IntegrityImpact | string | The CVSS3 integrity impact (e.g., none, low, high) |
| Cvss3_Vector_AvailabilityImpact | string | The CVSS3 availability impact (e.g., none, low, high) |
| Cvss3TemporalScore | float | The temporal CVSS3 score for the plugin, typically a floating-point value |
| Cvss3BaseScore | float | The base CVSS3 score for the plugin, typically a floating-point value |
| Cve | string | The CVE (Common Vulnerabilities and Exposures) identifier for the plugin |
| Bid | string | The BID (Bugtraq ID) associated with the plugin |
| Vpr_Score | float | The VPR (Vulnerability Priority Rating) score for the plugin, typically a floating-point value |
| Vpr_Drivers_AgeOfVuln_LowerBound | integer | The age of the vulnerability in the plugin (lower bound) as an integer |
| Vpr_Drivers_ExploitCodeMaturity | string | The exploit code maturity for the vulnerability in the plugin (e.g., proof of concept, functional) |
| Vpr_Drivers_CvssImpactScorePredicted | bit | A boolean flag indicating whether the CVSS impact score is predicted for the vulnerability (1 for yes, 0 for no) |
| Vpr_Drivers_ThreatIntensityLast28 | string | The threat intensity of the vulnerability in the last 28 days, stored as a string |
| Vpr_Vpr_Drivers_ThreatSourcesLast28 | string | The sources of threat information for the vulnerability in the last 28 days, stored as a string |
| Vpr_Drivers_ProductCoverage | string | The product coverage related to the vulnerability, stored as a string |
| Vpr_Updated | datetime | The date the VPR was last updated, stored in datetime format |
| BatchDate | datetime | The date and time when the plugin record was batch-processed or recorded, stored in datetime format |
TenableScanCompliances
| Name | Type | Description |
|---|---|---|
| ConfigID | integer | A unique identifier for the configuration associated with the scan compliance |
| ScanID | integer | A unique identifier for the scan associated with the compliance |
| Count | integer | The count of findings or issues related to the compliance in the scan |
| Hostname | string | The hostname of the asset being scanned for compliance |
| PluginFamily | string | The plugin family associated with the scan compliance |
| PluginId | string | The unique identifier for the plugin related to the compliance |
| PluginName | string | The name of the plugin related to the compliance |
| Severity | integer | The severity level of the compliance finding, typically represented as an integer (e.g., 1 = low, 5 = high) |
| SeverityIndex | integer | The index value representing the severity of the compliance issue |
| ScanConfigID | integer | The unique identifier for the scan configuration associated with the compliance |
| BatchDate | datetime | The date and time when the scan compliance record was batch-processed or recorded, stored in datetime format |
| ID | integer | A unique identifier for the scan compliance entry |
TenableScanHistories
| Name | Type | Description |
|---|---|---|
| ConfigID | integer | A unique identifier for the configuration associated with the scan history |
| ID | integer | A unique identifier for the scan history entry itself, typically an integer value |
| ScanUUID | uniqueidentifier | A globally unique identifier (GUID) for the scan history |
| ScanID | integer | A unique identifier for the scan associated with the history entry |
| IsArchived | bit | A boolean flag indicating whether the scan history is archived (1 for yes, 0 for no) |
| TimeStart | datetime | The start time of the scan, stored in datetime format |
| TimeEnd | datetime | The end time of the scan, stored in datetime format |
| Visibility | string | The visibility status of the scan (e.g., public, private) |
| Status | string | The status of the scan (e.g., completed, in progress, failed) |
| Custom | bit | A boolean flag indicating whether the scan is custom (1 for yes, 0 for no) |
| Default | bit | A boolean flag indicating whether the scan is the default scan (1 for yes, 0 for no) |
| BatchDate | datetime | The date and time when the scan history record was batch-processed or recorded, stored in datetime format |
TenableScanHistoryDetails
| Name | Type | Description |
|---|---|---|
| ConfigID | integer | A unique identifier for the configuration associated with the scan history details |
| ID | integer | A unique identifier for the scan history detail entry, typically an integer value |
| OwnerID | integer | The identifier for the owner of the scan history detail |
| ScanID | integer | A unique identifier for the scan associated with the scan history detail |
| ScanHistoryID | integer | A unique identifier for the scan history entry associated with the detail |
| ScheduleUUID | string | A globally unique identifier (GUID) for the schedule associated with the scan history detail |
| Status | string | The status of the scan history detail (e.g., completed, in progress, failed) |
| IsArchived | bit | A boolean flag indicating whether the scan history detail is archived (1 for yes, 0 for no) |
| ScanStart | datetime | The start time of the scan history detail, stored in datetime format |
| OwnerUUID | string | A globally unique identifier (GUID) for the owner of the scan history detail |
| Owner | string | The name of the owner associated with the scan history detail |
| Targets | string | A list of targets associated with the scan history detail, typically stored as a string |
| UUID | string | A globally unique identifier (GUID) for the scan history detail |
| ScanEnd | datetime | The end time of the scan history detail, stored in datetime format |
| ScanType | string | The type of the scan (e.g., manual, scheduled, etc.) |
| Name | string | The name of the scan associated with the scan history detail |
| BatchDate | datetime | The date and time when the scan history detail record was batch-processed or recorded, stored in datetime format |
TenableScans
| Name | Type | Description |
|---|---|---|
| ConfigID | integer | A unique identifier for the configuration associated with the scan |
| Id | integer | A unique identifier for the scan itself, typically an integer value |
| AgentScanLaunchType | string | The type of agent scan launch (e.g., manual, scheduled) |
| Control | bit | A boolean flag indicating whether the scan is controlled (1 for yes, 0 for no) |
| Enabled | bit | A boolean flag indicating whether the scan is enabled (1 for yes, 0 for no) |
| Legacy | bit | A boolean flag indicating whether the scan is a legacy scan (1 for yes, 0 for no) |
| Name | string | The name of the scan |
| Owner | string | The name of the owner of the scan |
| PolicyId | integer | The unique identifier for the policy associated with the scan |
| Read | bit | A boolean flag indicating whether the scan is read-only (1 for yes, 0 for no) |
| Rrules | string | The recurring schedule rules for the scan, typically stored as a string |
| ScheduleUuid | string | A globally unique identifier (GUID) for the schedule associated with the scan |
| Shared | bit | A boolean flag indicating whether the scan is shared (1 for yes, 0 for no) |
| StartTime | string | The start time for the scan, stored as a string (e.g., "2025-03-14 10:00") |
| Status | string | The status of the scan (e.g., completed, in progress, failed) |
| TemplateUuid | string | A globally unique identifier (GUID) for the template associated with the scan |
| Timezone | string | The timezone in which the scan is scheduled, typically stored as a string |
| HasTriggers | bit | A boolean flag indicating whether the scan has triggers (1 for yes, 0 for no) |
| Type | string | The type of scan (e.g., vulnerability, compliance, etc.) |
| Permissions | integer | The permissions for the scan, typically represented as an integer value |
| UserPermissions | integer | The user-specific permissions for the scan, typically represented as an integer value |
| Uuid | uniqueidentifier | A globally unique identifier (GUID) for the scan |
| WizardUUID | string | A globally unique identifier (GUID) for the wizard associated with the scan |
| StatusTimes_Initializing | integer | The time the scan was in the "Initializing" status, represented as an integer value |
| StatusTimes_Pending | integer | The time the scan was in the "Pending" status, represented as an integer value |
| StatusTimes_Processing | integer | The time the scan was in the "Processing" status, represented as an integer value |
| StatusTimes_Running | integer | The time the scan was in the "Running" status, represented as an integer value |
| StatusTimes_Publishing | integer | The time the scan was in the "Publishing" status, represented as an integer value |
| Progress | integer | The progress percentage of the scan, represented as an integer value |
| TotalTargets | integer | The total number of targets in the scan |
| BatchDate | datetime | The date and time when the scan record was batch-processed or recorded, stored in datetime format |
| LastModificationDate | datetime | The date and time when the scan was last modified, stored in datetime format |
| CreationDate | datetime | The date and time when the scan was created, stored in datetime format |
TenableScanVulnerabilities
| Name | Type | Description |
|---|---|---|
| ConfigID | integer | A unique identifier for the configuration associated with the scan vulnerability |
| ID | integer | A unique identifier for the vulnerability entry, typically an integer value |
| ScanID | integer | A unique identifier for the scan associated with the vulnerability |
| Count | integer | The count of vulnerabilities found in the scan |
| PluginId | integer | The unique identifier for the plugin associated with the vulnerability |
| PluginName | string | The name of the plugin associated with the vulnerability |
| Severity | integer | The severity level of the vulnerability, typically represented as an integer (e.g., 1 = low, 5 = high) |
| PluginFamily | string | The plugin family to which the vulnerability belongs (e.g., Web Servers, Databases, etc.) |
| VulnIndex | integer | The vulnerability index, typically used to rank vulnerabilities in a scan |
| ScanConfigID | integer | The unique identifier for the scan configuration associated with the vulnerability |
| BatchDate | datetime | The date and time when the vulnerability data was batch-processed or recorded, stored in datetime format |
TenableUsers
| Name | Type | Description |
|---|---|---|
| ConfigID | integer | A unique identifier for the configuration associated with the user |
| UUID | uniqueidentifier | A globally unique identifier (GUID) for the user |
| ID | integer | A unique identifier for the user, typically an integer value |
| User_Name | string | The display name of the user |
| Username | string | The username of the user |
| string | The email address associated with the user | |
| Name | string | The full name of the user |
| Type | string | The type or role of the user (e.g., admin, user, etc.) |
| Permissions | integer | The permissions granted to the user, typically represented as an integer value |
| UIPermitted | bit | A boolean flag indicating whether the user is permitted to use the UI (1 for yes, 0 for no) |
| UISamlOnly | bit | A boolean flag indicating whether the user is allowed to use only SAML for authentication (1 for yes) |
| APIPermitted | bit | A boolean flag indicating whether the user is permitted to use the API (1 for yes, 0 for no) |
| LastLoginAttempt | bigint | The timestamp of the last login attempt, stored as a bigint value |
| LoginFailCount | integer | The number of failed login attempts for the user |
| LoginFailTotal | integer | The total number of failed login attempts for the user |
| Enabled | bit | A boolean flag indicating whether the user account is enabled (1 for yes, 0 for no) |
| Undeletable | bit | A boolean flag indicating whether the user account is undeletable (1 for yes, 0 for no) |
| Lockout | integer | The lockout status of the user (e.g., locked out after several failed login attempts) |
| ContainerUUID | uniqueidentifier | A globally unique identifier (GUID) for the container to which the user belongs |
| LastLogin | bigint | The timestamp of the user's last successful login, stored as a bigint value |
| BatchDate | datetime | The date and time when the user record was batch-processed or recorded, stored in datetime format |
| Roles | string | The roles assigned to the user, typically stored as a string |
| TwoFactorEmailEnabled | integer | An integer flag indicating whether two-factor authentication via email is enabled for the user |
| TwoFactorSMSEnabled | integer | An integer flag indicating whether two-factor authentication via SMS is enabled for the user |
| TwoFactorSMSPhone | string | The phone number associated with the user's SMS-based two-factor authentication |
Updated over 1 year ago
Learn more...
Did this page help you?