Security / SIEM
Tenable / Qualys / Rapid7
One vulnerability-management adapter covers Tenable.io, Qualys VMDR, and Rapid7 InsightVM. Scanner findings become CVEs on the matched CMDB CI, and a closing Change pushes a non-destructive remediation status back to the scanner.
BidirectionalData residency: US
Request a demoWhat it does
- One adapter, three vendor parsers: Tenable.io, Qualys VMDR, and Rapid7 InsightVM normalize to the same asset/finding shape
- Scanner assets reconcile to a CMDB CI by FQDN, then DNS short name, then MAC address (strongest key wins)
- Open findings with a CVE record onto the matched CI; a CVSS ≥ 7.0 finding on a critical-function CI fires the DORA Art. 10 critical-vulnerability detection
- A tenant-configurable CVSS floor decides which findings get recorded at all (default: every CVE-bearing finding)
- The one non-destructive outbound path: marking a finding remediated when a closing Change ships, so the next scan reconciles — no isolate, no revert, no delete
- 6-hour default poll cadence (vulnerability scans are typically daily)
Data residency
All three vendors' primary SaaS pods default to US residency. A tenant on an EU pod or an on-prem console overrides this in config to acknowledge the actual location.
Event mappings
| External event | Maps to | What happens |
|---|---|---|
| asset.discovered | ci | Scanner asset reconciled to a CMDB CI by FQDN / DNS name / MAC |
| vulnerability.open | ci | Open finding with a CVE → CVE recorded on the matched CI; CVSS ≥ 7.0 on a critical-function CI fires the DORA Art. 10 detection |
| vulnerability.fixed | ci | Closing Change → non-destructive remediation status pushed to the scanner; next scan reconciles the CVE toward mitigated |
What you configure
- Vendor: Tenable, Qualys, or Rapid7
- API base URL (defaults to the vendor's public SaaS endpoint; override for an on-prem console or a per-tenant Qualys/Rapid7 URL)
- Credential reference (stored as a secret)
- Data-residency override (for an EU pod or on-prem console)
- Minimum CVSS to record a finding (default: 0, records everything)
- TLS verification (default on)
Setup overview
Pick your scanner vendor and store its API credential as a secret. Override the base URL if you're on an on-prem console or a non-default regional pod.
Related features
See TENSOR running on your own estate.
30 minutes, screen-shared, no slides. Bring the process you are least sure we handle and we will start there.