Skip to main content

Tenable step configuration



You can scan your container images and application instances using Tenable and then ingest the results from Harness.

Workflow descriptions​

Orchestration/extraction workflows

This workflow applies to scanner integrations that support orchestratedScan or dataLoad scan modes.

  1. Add a Build or Security stage to your pipeline.

  2. If you're scanning a code repository, set up your codebase.

  3. Add a Custom Scan step.

  4. Review the Important notes for Custom Scan steps for additional requirements and relevant information.

    If you're setting up a scan on a Kubernetes or Docker build infrastructure, you need to add a Docker-in-Docker background step to the stage.

  5. Add the relevant key:value pairs to Settings.

Ingestion workflows

This workflow applies to scanner integrations that support Ingestion mode.

  1. Add a Build or Security stage to your pipeline.

  2. Add a Run step and set it up to save your scan results to a shared folder.

    For more information, go to Run an ingestion scan in an STO Pipeline.

  3. Add a Custom Scan step.

  4. Review the Important notes for Custom Scan steps for additional requirements and relevant information.

  5. Add the relevant key:value pairs to Settings.

Custom Scan step settings for Tenable scans in STO​

The recommended workflow is to add a Custom Scan step to a Security or Build stage and then configure it as described below.

Scanner settings​

These settings are all required.

Product name​

Key​
product_name
Value​
tenableio

Scan type​

The target type to scan.

Key​
scan_type
Value​

Must be one of the following.

instance

Policy type​

The scan mode to use.

Key​
policy_type
Value​
orchestratedScan
dataLoad
ingestionOnly

Product config name​

Key​
product_config_name
Value​

Use the legacy Nessus scan inside tenableIO:

legacy-web-application-scan

Target and variant​

Every Custom Scan step needs a target and baseline.

Target name​

Key​
target_name
Value​

A user-defined label for the code repository, container, application, or configuration to scan. Specify a unique, descriptive name. This makes it much easier to navigate your scan results in the STO UI.

Target variant​

Key​
target_variant
Value​

A user-defined label for the branch, tag, or other target variant to scan.

Instance​

These settings apply to Custom Scan steps when both of these conditions are true:

  1. The policy_type is orchestratedScan or dataLoad.
  2. The scan_type is instance.

Instance domain​

Key​
instance_domain
Value​

Domain of the application instance to scan. You can include the full path to the app in this field, or split the full path between the instance_domain and the instance_path settings. Example: https://myapp.io/portal/us

Instance path​

Key​
instance_path
Value​

Path to append to the application instance domain, if you're splitting the full path between the instance_domain and the instance_path settings. For example, you might specify the domain as https://myapp.io and the path as /portal/us.

Instance protocol​

Key​
instance_protocol
Value​

One of the following: HTTPS is the default.

HTTPS
HTTP

Instance port​

Key​
instance_port
Value​

The TCP port used by the scanned app.

Instance username​

Key​
instance_username
Value​

The username for authenticating with the scanned app.

Instance password​

Key​
instance_password
Value​

You should create a Harness text secret with your encrypted password and reference the secret using the format <+secrets.getValue("container-access-id")>. For more information, go to Add and reference text secrets.

Product access​

These settings are available to access your Tenable instance when policy_type is orchestratedScan.

You should create Harness text secrets for your encrypted passwords/tokens and reference them using the format <+secrets.getValue("my-access-token")>.

Product access keys​

product_domain
product_access_id
product_access_token
product_policy_id
product_scanner_id
product_template_uuid

Ingestion file​

This setting applies to Custom Scan steps when the policy_type is ingestionOnly.

Key​
ingestion_file
Value​

The path to your scan results when running an Ingestion scan, for example /shared/scan_results/myscan.latest.sarif.

  • The data file must be in a supported format for the scanner.

  • The data file must be accessible to the scan step. It's good practice to save your scan results to a shared path in your stage. In the visual editor, go to the stage where you're running the scan. Then go to Overview > Shared Paths. You can also add the path to the YAML stage definition like this:

        - stage:
          spec:
            sharedPaths:
              - /shared/scan_results

Fail on Severity​

If the scan finds any vulnerability with the specified severity level or higher, the pipeline fails automatically. NONE means do not fail on severity.

For more information, go to:

Key​
fail_on_severity
Value​
CRITICAL
MEDIUM
LOW
INFO
NONE