Purpose
This guide explains how to generate an API access key and secret key in Tenable Security Center and how to use them in Logsign USO to ingest vulnerability scan data for security analytics and vulnerability management purposes.
Tenable Security Center (formerly SecurityCenter, sometimes abbreviated Tenable.sc) is Tenable's on-premises vulnerability management console. It is a separate product from Tenable Nessus Pro, which is a standalone scanner product with its own Logsign integration and its own setup document. Tenable Security Center aggregates results from one or more Nessus scanners (and other Tenable sensors) into a central, customer-hosted appliance; this poller talks to that customer-hosted appliance directly, not to any Tenable-hosted cloud service. There is no shared cloud region or Tenable-hosted endpoint to configure; the Base URL you provide is always your organization's own Security Center server.
Tenable Security Center exposes vulnerability data through a REST API rather than syslog. This API poller is the supported way to bring vulnerability data into Logsign USO.
Prerequisites
An administrator must enable API key authentication on the Security Center appliance before any user can authenticate with an API key. This is a one-time, appliance-wide setting.
The account used to generate the API key determines what the key can see: Tenable Security Center attributes every API request to the user account associated with the key, and the key can only perform actions the user account itself is permitted to perform. The user account used for the Logsign integration should have read access to the repositories/assets whose vulnerability data you want ingested.
Step 1: Enable API Key Authentication (administrator, one time)
- Sign in to Tenable Security Center with an administrator account.
- Go to System > Configuration, then open the Security tile.
- In Authentication Settings, turn on Allow API Keys.
- Click Submit.
This step only needs to be done once per Security Center appliance. If it is skipped, API key requests (including the ones Logsign sends) will be rejected regardless of whether the key itself is valid.
Step 2: Generate an Access Key and Secret Key
- Go to Users > Users.
- Select the checkbox for the user account that Logsign will authenticate as (create a dedicated service account first if you prefer not to reuse a personal account).
- From the actions that appear above the table, choose API Keys > Generate API Key.
- Confirm by clicking Generate.
- The Your API Key window displays the Access Key and Secret Key. Copy both immediately and store them somewhere safe; Tenable Security Center does not display the secret key again after you close this window. If it is lost, you must generate a new key pair.
Step 3: Configure the Integration in Logsign USO
After enabling API keys and generating a key pair, log in to Logsign USO and add a new Tenable Security Center data source. You will be asked for:
| Field | Value |
|---|---|
| api_host | The hostname or IP address of your Security Center appliance (for example sc.yourcompany.local), without a URL scheme |
| api_key | The Access Key generated in Step 2 |
| secret_key | The Secret Key generated in Step 2 |
Logsign sends the access key and secret key together in a single x-apikey request header on every call; there is no separate token exchange step and no token to refresh. Logsign then periodically queries the Security Center Analysis API (POST /rest/analysis, cumulative vulnerability details) for vulnerabilities whose lastSeen timestamp is newer than the last successfully processed record, and normalizes each result into a Logsign event with its plugin/signature information, affected host, severity, CVSS/VPR scoring, and remediation details.
Notes and Limits
- This integration only covers vulnerability scan results (the Analysis API's
vuln/vulndetailsdata). Security Center audit logs, user activity, and scan-job management are not part of this integration and would require a separate connector. - Because most Security Center appliances use a self-signed certificate, the poller does not validate the TLS certificate presented by your appliance. Make sure the appliance is only reachable from your internal network and from the Logsign collector; it should not be exposed to the public internet.
- The poller looks back at most 30 days from the current time on every poll cycle to find new or updated vulnerabilities. If polling is interrupted for longer than 30 days (for example, due to an outage or a misconfiguration), vulnerabilities that were last seen more than 30 days ago but were never synced to Logsign will fall outside this window and will not be automatically backfilled. If you expect a polling gap longer than 30 days, contact Logsign support to arrange a manual backfill.
- Make sure the account used to generate the API key has read access to every repository whose vulnerability data you want Logsign to ingest; the key inherits the account's own permissions exactly, nothing more.
- Do not confuse this integration with Tenable Nessus Pro. Nessus Pro is a standalone scanner product with its own API and its own Logsign setup document. Tenable Security Center is the on-premises console that aggregates results from Nessus scanners (and other sensors) across an organization; if your organization only runs standalone Nessus Pro scanners without a Security Center appliance, use the Nessus Pro integration instead.