--- title: Data transformation for the Tenable Vulnerability Integration description: After you identify the data to import, it’s retrieved from the Tenable product and processed through a set of data sources and transforms in your instance. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/tenable-data-transformref.html release: australia product: Vulnerability Response classification: vulnerability-response topic_type: reference last_updated: "2026-05-21" reading_time_minutes: 37 breadcrumb: [REST messages for the Tenable Vulnerability Integration, Understanding the Tenable Vulnerability Integration, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations] --- # Data transformation for the Tenable Vulnerability Integration After you identify the data to import, it’s retrieved from the Tenable product and processed through a set of data sources and transforms in your instance. During installation, normalized severity maps are installed in the Normalized Severity Mapping module. These maps transform imported Tenable severity levels to standard severity levels for processing in your instance. For information about creating severity maps, see Create a Vulnerability Response severity map in the Vulnerability Response documentation. ## Tenable.io asset import Imported asset data is first loaded into the Tenable.io Asset Import \[sn\_vul\_tenable\_io\_asset\_import\] Table. The transform map writes the transformed asset records to the Discovered Items \[sn\_sec\_cmn\_src\_ci\] table. The Tenable.io Asset Integration transform map is used to transform the imported assets information. Changes to this transform alter how data from the Tenable Asset import is processed. To access this transform map, navigate to **System Import Sets** > **Transform Maps**. Search for `Tenable.io Asset Transform`. The following table lists the transform map fields by integration. |Source field|Target field|Description| |------------|------------|-----------| |u\_id|source\_id|Tenable provides a unique id for assets and maps to the discovered item record and is used for CI lookup.| |u\_ipv4s|ip\_address|Maps the first ip value to the ip\_address field on the discovered item record.| |u\_mac\_addresses|mac\_address|Maps the first mac\_address value to the mac address field on the discovered item record.| |u\_fqdns|fqdn|Maps the first fqdn value to the fqdn field on the discovered item record.| |u\_netbios\_names|netbios|Maps the first netbios value to the netbios field on the discovered item record.| |u\_plugin.cvss4\_base\_score|v4\_base\_score|CVSS v4 base score is mapped to the v4 base score in third-party entry record.| |u\_plugin.cvss4\_threat\_score|v4\_threat\_score|CVSS v4 threat score is mapped to the v4 threat score in third-party entry record.| |u\_operating\_systems|os|Maps the first OS value to the os field on the discovered item record.| |\(Prior to v14.0 Vulnerability Response and v2.2 of the Tenable Vulnerability Integration\)u\_last\_scan\_time|last\_scan\_date|Maps to the last\_scan\_date field on the discovered item record.| |u\_last\_authenticated\_scan\_date|last\_auth\_scan\_date|Maps to the last\_auth\_scan\_date field on the discovered item record.| |\[script\]|name|Maps the host name using the script's logic.| |u\_tags| |The Tags are saved in sn\_sec\_cmn\_host\_tag. The mapping from tags to assets is saved in sn\_sec\_cmn\_m2m\_src\_ci\_tag.| |u\_serial\_number|source\_payload|The serial number from the Tenable.io asset data is included in the source\_payload field on the Discovered Items \[sn\_sec\_cmn\_src\_ci\] record. The source\_payload stores the raw source data and is used for CI matching.| There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose. ## Tenable.io asset transform map script timing and purpose |When the script is run|Purpose| |----------------------|-------| |onStart \(when an import set has started transformation\)|Initializes the values in the import\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.| |onBefore \(before an import set has completed transformation\).|Updates values in the host and verify if the host exists. Based on the results, modifies the values in an import\_set. This script is for internal use, and modifying or deleting them isn’t recommended.| |onComplete \(when an import set has completed transformation\).|Sets the values of new CIs created, and CIs that have been updated and ignored.This script is for internal use, and modifying or deleting them isn’t recommended.| ## Tenable.io plugins integration The Tenable.io plugins transform map is used to transform plugins imported from Tenable.io. **Note:** Changes to this transform map alters how data received from the Tenable plugins is processed. To access this transform map, navigate to **System Import Sets** > **Transform Maps**. Search for the Tenable.io Plugin Transform. The tenable.io plugins payload contains all the fields in the u\_attributes column of the sn\_vul\_tenable\_io\_plugin\_import table. The attributes field is parsed and mapped to the third-party entry table records as listed in the following table. The transform map writes the transformed plugin data to the Third-Party Entry \[sn\_vul\_third\_party\_entry\] table.
Source field Target field Description
id id Maps id from source and adds the TEN-prefix to it. For example, if the id received is 12345, the id in the target table is TEN-12345.
Description summary Maps the description of the plugin to the summary column.
\[script\] source The source for imported third-party entry \(TPE\) is Tenable.io.
\[script\] source\_instance Reference to the Tenable deployment that imports this record.
family category Maps the family of plugin to the category column.
plugin\_modification\_date last\_modified Maps the plugin\_modification\_date to the last modified field.
plugin\_publication\_date date\_published Maps the plugin\_publication\_date to the published date.
has\_patch remediation\_type Maps the remediation type from has\_patch value.
synopsis threat Maps the threat information about this vulnerability.
cvss\_base\_\_score score Maps the Common Vulnerability Scoring System \(CVSS\) base score to the score column in third-party entry table.
solution solution Maps the solution provided by scanner to the solution column in the third-party entry table.
exploit\_available exploit Maps the exploit\_available provided by scanner to the exploit column in the third-party entry table.
vpr.score source\_risk\_score Maps the vpr score provided by scanner to the source\_risk\_score in the third-party entry table.
\[script\] source\_risk\_rating Maps the vpr score to the standard risk rating based on the score ranges: - 9–10 – Critical - 7–9 – High - 4–7 – Medium - 0–4 - Low
vpr.drivers.age\_of\_vuln age\_of\_vuln Maps the age of the vulnerability from the scanner to the age\_of\_vuln column in the third-party entry table.
vpr.drivers.exploit\_code\_maturity exploit\_code\_maturity Maps exploit code maturity from the scanner to exploit\_code\_maturity in the third-party entry table.
vpr.drivers.product\_coverage product\_coverage Maps product coverage from the scanner to product\_coverage in the third-party entry table.
vpr.drivers.threat\_sources\_last28 threat\_sources Maps threat sources in the last 28 days from the scanner to the threat\_sources in the third-party table.
vpr.drivers.threat\_intensity\_last28 threat\_intensity Maps threat intensity in the last 28 days from the scanner to threat\_intensity in the third-party entry table.
vpr.drivers.threat\_recency threat\_recency Maps the threat recency information from scanner to threat\_recency in the third-party entry table.
vpr.drivers.cvss3\_impact\_score v3\_impact\_subscore Maps cvss3 impact score to v3\_impact\_subscore column in the third-party entry table.
cvss\_temporal\_score cvss\_temporal\_score Maps the temporal score for CVSS v2.
cvss\_v3\_temporal\_score v3\_temporal\_score Maps the temporal score for CVSS v3.
risk\_factor source\_severity Maps to the source severity in the third-party entry table.
name name Maps the name of the plugin to name in third-party entry table.
stig\_severity stig\_severity Maps the vpr score provided by the scanner to the source\_risk\_score in the third-party entry table.
plugin\_type check\_type Maps the plugin type to check\_type in third-party entry table.
unsupported\_by\_vendor unsupported\_by\_vendor Maps the unsupported\_by\_vendor field to the unsupported\_by\_vendor column.
\[script\] exploit\_attack\_vector The exploit\_attack\_vector column in the third-party entry table is populated based on exploit\_available and v3\_attack\_vector of columns.
cpe software\_raw Maps the raw CPE strings from the plugin payload to the software\_raw column in the third-party entry table, stored as a comma-separated list.
cpe vendor Vendor names extracted from the CPE data are mapped to the vendor column in the third-party entry table, stored as a comma-separated list.
cpe product Product names extracted from the CPE data are mapped to the product column in the third-party entry table, stored as a comma-separated list.
In addition to the direct fields, other information is added as related lists to third-party entries. |Source field|Description| |------------|-----------| |cve|Inserts CVE-related data into the reference table \(sn\_vul\_nvd\_entry\). If the same Common Vulnerabilities and Exposures \(CVE\) in the NVD entry table \(sn\_vul\_nvd\_entry\) is found, it associates the current vulnerability to the NVD entry. The mapping can be found in sn\_vul\_m2m\_entry\_cve.| |bid|The list of bug traqs is added as a reference.| |cpe|CPE entries are added as individual related list entries on the third-party entry record, containing vendor, product, version, update, edition, and other CPE attributes.| |see\_also|The list of URLs is added as a reference.| |xrefs|The list of X-REF is added as a reference.| |\[script\]|The list of exploits for that plugin and inserts mapping for applicable exploit framework and plugin to sn\_vul\_m2m\_framework\_vul.| There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose. |When the script is run|Purpose| |----------------------|-------| |onStart \(when an import set has started transformation\)|Initializes the values in the import\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.| |onBefore \(before an import set has completed transformation\).|Updates the values in the third-party entry, and verify if the third-party entry exists. Based on the results, modifies the values in a third-party entry. This script is for internal use, and modifying or deleting them isn’t recommended.| |onComplete \(when an import set has completed transformation\).|Sets the values of new CIs created, and CIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.| The TenableIOPluginsImportProcessor script include is called from the onBefore transform script. It takes the output from Tenable.io plugins integration and transforms it into ServiceNow AI Platform third-party vulnerability entries. Any changes to this script include may alter the transformation of Tenable.io plugins data in the third-party entry table. ## Tenable.io vulnerabilities import The Tenable.io Vulnerable Item transform map is used to transform open and fixed vulnerabilities information imported from Tenable.io. **Note:** Changes to this transform map alter how data from the Tenable Vulnerabilities Import is processed. The same transform map is used for both the Tenable.io Fixed Vulnerabilities Integration and the Tenable.io Open Vulnerabilities Integration. To access this transform map, navigate to **System Import Sets** > **Transform Maps**. Search for the `Tenable.io Vulnerable Item transform map`. The transform map writes the transformed vulnerability data to the Vulnerable Item \[sn\_vul\_vulnerable\_item\] table.
Source field Target field Description
u\_asset.uuid id Uuid is mapped to the id field of the cmdb\_ci record.
u\_asset.ipv4 ip\_address The ipv4 field is mapped to the ip address field of the cmdb\_ci record.
u\_asset.last\_authenticated\_results last\_auth\_scan\_date The last authenticated scan date is mapped to the last auth scan date of the cmdb\_ci record.
u\_asset.mac\_addess mac\_address Mac address is mapped to the host mac address field of the cmdb\_ci record.
u\_asset.netbios\_name netbios Netbios is mapped to the netbios field of cmdb\_ci record.
u.\_plugin.cvss3\_base\_score v3\_base\_score CVSS v3 base score is mapped to the v3 base score of the third-party entry record. These changes will be implemented as part of Tenable 5.2.1 Version.
u.\_plugin.cvss3\_temporal\_score v3\_temporal\_score CVSS v3 temporal score is mapped to the v3 temporal score in the third-party entry record. These changes will be implemented as part of Tenable 5.2.1 Version.
u.\_plugin.cvss\_base\_score score CVSS base score is mapped to the score field of the third-party entry record.
u.\_plugin.cvss\_temporal\_score temporal\_score Temporal Score is mapped to the temporal score in the third-party entry record.
u\_plugin.description summary Description is mapped to the summary field in the third-party entry record.
u\_plugin.family category Maps the family of plugin to the category column of the third-party entry record.
u\_plugin.modification\_date last\_modified Last modified date is mapped to the plugin last modified date in the third-party entry record.
u\_plugin.publication\_date date\_published Publication date is mapped to the date published field of the third-party entry record.
u\_plugin.risk\_factor source\_severity Risk factor is mapped to the source\_severity field of the third-party entry record.
u\_plugin.solution solution Solution is mapped to the solution field of the third-party entry record.
u\_plugin.synopsis threat Synopsis is mapped to the threat field of the third-party entry record.
u\_severity\_id priority Priority is mapped to the severity id from the payload. The default value is 5.
u\_plugin.exploit\_available exploit Maps the exploit\_available provided by the scanner to the exploit column in the third-party entry table.
vpr.score source\_risk\_score Maps the vpr score provided by the scanner to the source\_risk\_score in the third-party entry table.
\[script\] source\_risk\_rating Maps the vpr score to the standard risk rating based on the score ranges:- 9–10 – Critical - 7–9 – High - 4–7 – Medium - 0–4 - Low
u\_plugin.vpr.drivers.age\_of\_vuln age\_of\_vuln Maps the age of vulnerability from the scanner to age\_of\_vuln in the third-party entry table.
u\_plugin.vpr.drivers.exploit\_code\_maturity exploit\_code\_maturity Maps exploit code maturity from the scanner to exploit\_code\_maturity in the third-party entry table.
u\_plugin.vpr.drivers.product\_coverage product\_coverage Maps product coverage from the scanner to product\_coverage in the third-party entry table.
u\_plugin.vpr.drivers.threat\_sources\_last28 threat\_sources Maps threat sources in the last 28 days from the scanner to threat\_sources in the third-party entry table.
u\_plugin.vpr.drivers.threat\_intensity\_last28 threat\_intensity Maps threat intensity in the last 28 days from the scanner to threat\_intensity in the third-party entry table.
u\_plugin.vpr.drivers.threat\_recency threat\_recency Maps the threat recency information from the scanner to threat\_recency in the third-party entry table.
u\_plugin.vpr.drivers.cvss3\_impact\_score v3\_impact\_subscore Maps CVSS3 v3 impact score to v3\_impact\_subscore column in the third-party entry table.
u\_plugin.type check\_type Maps the plugin type to check\_type in third-party entry table.
u\_plugin.unsupported\_by\_vendor unsupported\_by\_vendor Maps the unsupported\_by\_vendor field in plugin to the unsupported\_by\_vendor column.
\[script\] exploit\_attack\_vector The exploit\_attack\_vector column in the third-party entry table is populated based on exploit\_available and v3\_attack\_vector of columns.
U\_plugin.on\_cisa\_kev cisa\_exists Maps on\_cisa\_kev field with cisa\_exists in third-party entry table.
u\_plugin.family\_id Family\_id Maps the plugin Family id to family\_id column in third-party entry table.
port port Port is mapped to the port field of the vulnerable item record.
protocol protocol Protocol is mapped to the protocol field of the vulnerable item record.
u\_first\_found first\_found First found is mapped to the first found field of the vulnerable item record.
u\_last\_found last\_found Last found is mapped to the last found field of the vulnerable item record.
u\_state state State is mapped to the State field in the vulnerable item record
\[script\] source The source of the integration is populated. The vulnerable items created from this integration have Tenable.io as the source.
\[script\] integration\_instance The integration\_instance is the name of the instance from which the vulnerable item is imported.
u\_plugin.name name Maps the name of the plugin to name in third-party entry table.
u\_plugin.stig\_severity stig\_severity Maps the stig severity of the plugin to stig severity column in third-party entry table
u\_plugin.vpr\_v2.malware\_observations\_intensity\_last30 vprv2\_malware\_observations\_intensity Maps the VPRv2 malware\_observations\_intensity\_last30 value to the vprv2\_malware\_observations\_intensity field in the Tenable TPE Additional Attributes table.
u\_plugin.vpr\_v2.targeted\_industries vprv2\_targeted\_industries Maps the VPRv2 targeted\_industries value to the vprv2\_targeted\_industries field in the Tenable TPE Additional Attributes table.
u\_plugin.vpr\_v2.targeted\_regions vprv2\_targeted\_regions Maps the VPRv2 targeted\_regions value to the vprv2\_targeted\_regions field in the Tenable TPE Additional Attributes table.
u\_plugin.vpr\_v2.threat\_summary vprv2\_threat\_summary Maps the VPRv2 threat\_summary value to the vprv2\_threat\_summary field in the Tenable TPE Additional Attributes table.
u\_plugin.vpr\_v2.remediation vprv2\_remediation Maps the VPRv2 remediation value to the vprv2\_remediation field in the Tenable TPE Additional Attributes table.
u\_plugin.d2\_elliot\_name d2\_elliot\_name Maps the d2\_elliot\_name value to the d2\_elliot\_name field in the Tenable TPE Additional Attributes table.
u\_plugin.canvas\_package canvas\_package Maps the canvas\_package value to the canvas\_package field in the Tenable TPE Additional Attributes table.
u\_plugin. checks\_for\_default\_account checks\_for\_default\_account Maps the checks\_for\_default\_account value to the checks\_for\_default\_account field in the Tenable TPE Additional Attributes table.
u\_plugin.checks\_for\_malware checks\_for\_malware Maps the checks\_for\_malware value to the checks\_for\_malware field in the Tenable TPE Additional Attributes table.
u\_plugin.exploitability\_ease exploitability\_ease Maps the exploitability\_ease value to the exploitability\_ease field in the Tenable TPE Additional Attributes table.
u\_plugin.exploithub\_sku exploithub\_sku Maps the exploithub\_sku value to the exploithub\_sku field in the Tenable TPE Additional Attributes table.
u\_plugin.in\_the\_news in\_the\_news Maps the in\_the\_news value to the in\_the\_news field in the Tenable TPE Additional Attributes table.
u\_plugin.metasploit\_name metasploit\_name Maps the metasploit\_name value to the metasploit\_name field in the Tenable TPE Additional Attributes table.
u\_plugin.ms\_bulletin ms\_bulletin Maps the ms\_bulletin value to the ms\_bulletin field in the Tenable TPE Additional Attributes table.
u\_plugin.usn usn Maps the usn value to the usn field in the Tenable TPE Additional Attributes table.
u\_plugin.version version Maps the version value to the version field in the Tenable TPE Additional Attributes table.
u\_plugin.vuln\_publication\_date vuln\_publication\_date Maps the vuln\_publication\_date value to the vuln\_publication\_date field in the Tenable TPE Additional Attributes table.
u\_plugin.workaround workaround Maps the workaround value to the workaround field in the Tenable TPE Additional Attributes table.
u\_plugin.workaround\_type workaround\_type Maps the workaround\_type value to the workaround\_type field in the Tenable TPE Additional Attributes table.
u\_plugin.workaround\_published workaround\_published Maps the workaround\_published value to the workaround\_published field in the Tenable TPE Additional Attributes table.
u\_plugin.vendor\_unpatched vendor\_unpatched Maps the vendor\_unpatched value to the vendor\_unpatched field in the Tenable TPE Additional Attributes table.
u\_plugin.has\_workaround has\_workaround Maps the has\_workaround value to the has\_workaround field in the Tenable TPE Additional Attributes table.
u\_plugin.vendor\_severity vendor\_severity Maps the vendor\_severity value to the vendor\_severity field in the Tenable TPE Additional Attributes table.
u\_plugin.vpr\_v2.cve\_id vprv2\_cve\_id Maps the VPRv2 cve\_id value to the vprv2\_cve\_id field in the Tenable TPE Additional Attributes table.
u\_plugin.epss\_score epss\_score Maps the epss\_score value to the epss\_score field in the Tenable TPE Additional Attributes table.
In addition to the direct fields, other information is added as related lists to third-party entries. |Source field|Description| |------------|-----------| |cve|Inserts CVE-related data into the reference table \(sn\_vul\_nvd\_entry\). If the same CVE in the NVD entry table \(sn\_vul\_nvd\_entry\) is found, it associates the current vulnerability to the NVD entry. The mapping can be found in sn\_vul\_m2m\_entry\_cve.| |bid|The list of bug traqs is added as a reference.| |see\_also|The list of URLs is added as a reference.| |xrefs|The list of X-REF is added as a reference.| |\[script\]|The list of exploits for that plugin and Inserts mapping for applicable exploit framework and plugin to sn\_vul\_m2m\_framework\_vul.| There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose. |When the script is run|Purpose| |----------------------|-------| |onStart \(when an import set has started transformation\)|TTriggers Tenable IO Vulnerabilities Processor which imports data from Tenable.io using the import set and loads each record into the CMDB CI table, the Vulnerable Items table, and the Third-party vulnerability table. This script is for internal use, and modifying or deleting them isn’t recommended.| |onBefore \(before an import set has completed transformation\).|Checks if the Third-Party Entry and Detections exist. If not, these records are created in their respective tables. isn’tThis script is for internal use, and modifying or deleting them is not recommended.| |onComplete \(when an import set has completed transformation\).|Updates the count of CIs, VITs, and Detections as imported from Tenable.io. This script is for internal use, and modifying or deleting them isn’t recommended.| ## Tenable.io compliance results integration Tenable.io Compliance Results transform map enables you to import secure configuration assessment findings from Tenable.io into ServiceNow. This integration leverages Tenable’s compliance export APIs to retrieve test results on assets, supporting regular differential imports to keep data up to date. Imported data is first loaded into the Tenable.io Test Results Import \[sn\_vul\_tenable\_io\_tr\_import\] table. To access the transform map, navigate to **System Import Sets** > **Transform Maps**. Search for Tenable.io Compliance Results Transform. The following table lists the transform map fields by integration. |Source field|Table|Target field|Description| |------------|-----|------------|-----------| |asset\_uuid|sn\_vulc\_result|sn\_sec\_cmn\_src\_ci -> source\_id|Unique identifier for the asset in Tenable.io, mapped to the corresponding CMDB CI in ServiceNow after transformation.| |first\_seen|sn\_vulc\_result|first\_seen|Date and time when the compliance check was first observed on the asset.| |last\_seen|sn\_vulc\_result|last\_seen|Date and time when the compliance check was last observed on the asset.| |audit\_file|sn\_vulc\_policy|short\_description|Name or identifier of the audit file used for the compliance check.| |check\_id|sn\_vulc\_test|source\_id|Unique identifier for the compliance check within Tenable.io.| |check\_name|sn\_vulc\_test|short\_description|Human-readable name of the compliance check.| |check\_info|sn\_vulc\_test|description|Detailed information about the compliance check, including its purpose and context.| |expected\_value|sn\_vulc\_result|expected\_values|The value expected for the configuration setting according to the compliance policy.| |actual\_value|sn\_vulc\_result|actual\_values|The actual value found on the asset during the compliance check.| |status|sn\_vulc\_result|result|Result of the compliance evaluation. Possible values \(from Tenable\): PASSED, FAILED.| |see\_also|sn\_vulc\_result|remediation|Additional references or links for remediation guidance.| |reference.framework|sn\_vulc\_auth\_src|short\_description|Compliance framework associated with the check \(e.g., CIS, NIST\).| |reference.control|sn\_vulc\_citation|section|Specific control or section within the compliance framework.| |solution|sn\_vulc\_test|remediation|Recommended steps to remediate the compliance failure.| |profile\_name|sn\_vulc\_citation|section\_name|Name of the compliance profile or benchmark applied.| |db\_type|sn\_vulc\_technology|name|Database type or technology associated with the compliance check.| **Note:** Tenable does not provide a risk score for compliance test results. ServiceNow calculates risk scores using Configuration Compliance calculators and applies the default Medium risk value of 20 when no risk score is available. To ensure accurate prioritization, review and customize the risk calculator rules to reflect your organization’s priorities. For more information, see [Configuration Compliance calculators and calculator rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/configuration-compliance/config-compliance-calculator-rules.md). ## Tenable.sc asset import Asset data imported from Tenable.sc is first loaded into the Tenable.sc Asset Import table \(sn\_vul\_tenable\_sc\_asset\_import\). The Tenable.sc Asset Integration transform map is used to transform the imported assets information. Changes to this transform alter how data from the Tenable Asset import is Processed. To access this transform map, navigate to **System Import Sets** > **Transform Maps**. Search for the `Tenable.sc Asset Transform`. The transform map writes the transformed asset records to the Discovered Items \[sn\_sec\_cmn\_src\_ci\] table. |Source field|Target field|Description| |------------|------------|-----------| |u\_uuid|id|The uuid isn’t populated from the Tenable API, so the ‘u\_uniqueness’ attribute is used to create a unique uuid field for assets and map it to the Discovered Items \[sn\_sec\_cmn\_src\_ci\] record.| |u\_ip|source\_payload|The IP address from the Tenable.sc API is stored in the source\_payload field on the Discovered Items \[sn\_sec\_cmn\_src\_ci\] record for CI matching and lookup purposes.| |u\_macaddress|mac\_address|Maps the mac address field from the API to the address field on the Discovered Items \[sn\_sec\_cmn\_src\_ci\] record.| |u\_dnsname|fqdn|Maps the dnsname field from the API to the fqdn field on the Discovered Items \[sn\_sec\_cmn\_src\_ci\] record.| |u\_netbiosname|netbios|Maps the netbios field from the API to the netbios field on the Discovered Items \[sn\_sec\_cmn\_src\_ci\] record.| |u\_oscpe|os|The OS information is extracted from the oscpe attribute in the payload and maps it to the os field on the Discovered Items \[sn\_sec\_cmn\_src\_ci\] record.| |u\_lastauthrun|last\_auth\_scan\_date|Maps the lastauthrun field from the API to the last\_auth\_scan\_date field on the discovered item record.| |u\_lastauthrun and u\_lastunauthrun|last\_scan\_date|The lastauthrun is extracted from the Tenable API or lastunauthrun. The last\_scan\_date field on the discovered item record is populated based on the value that appears in the payload.| There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose. |When the script is run|Purpose| |----------------------|-------| |onStart \(when an import set has started transformation\)|Initializes the values in the import\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.| |onBefore \(before an import set has completed transformation\).|Updates the values in the host and verify if the host exists. Based on the results, modifies the values in an import\_set. This script is for internal use, and modifying or deleting them isn’t recommended.| |onComplete \(when an import set has completed transformation\).|Sets the values of new CIs created, and CIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.| ## Tenable.sc plugins import Plugins data imported from Tenable.sc is first loaded into the Tenable.sc Plugins Import table \(sn\_vul\_tenable\_sc\_plugin\_import\). The Tenable.sc Plugin Transform Map is used to transform the plugins information that has been imported. Changes to this transform alter how data from the Tenable Plugin import is Processed. To access this transform map, navigate to **System Import Sets** > **Transform Maps**. Search for `Tenable.sc Plugin Transform Map`. The transform map writes the transformed plugin data to the Third-Party Entry \[sn\_vul\_third\_party\_entry\] table.
Source field Target field Description
u\_id id Maps id from source and adds the TEN-prefix. For example, if the id received is 12345, the id in the target table is TEN-12345.
u\_description summary Maps the description of the plugin to the summary column.
\[script\] source Imported TPE from this integration has Tenable.sc as the source.
\[script\] source\_instance Reference to the Tenable deployment that imports this record.
u\_family category Maps the name field in family object of plugin to the category column.
u\_plugin\_modification\_date last\_modified Maps the plugin\_modification\_date to the last modified field.
u\_plugin\_publication\_date date\_published Maps the plugin\_publication\_date to published date.
u\_has\_patch Remediation\_type Maps the remediation type from has\_patch value.
u\_synopsis threat Maps the threat information about this vulnerability.
u\_cvss\_base\_score score Maps the CVSS base score to the score column in third-party entry table.
u\_solution solution Maps the solution provided by the scanner to the solution column in the third-party entry table.
u\_cvss\_temporal\_score cvss\_temporal\_score Maps the temporal score for CVSS v2.
u\_cvss\_v3\_temporal\_score v3\_temporal\_score Maps the temporal score for CVSS v3.
u\_risk\_factor source severity Maps to the source severity in the third-party entry table.
u\_cvss\_v3\_base\_score v3\_base\_score Maps the CVSS base score in the third-party entry table.
u\_exploit\_available exploit Maps the exploitAvailable provided by the scanner to the exploit column in the third-party entry table.
u\_vpr\_score source\_risk\_score Maps VPR score from the scanner to the Source risk score in the third-party entry table.
\[script\] source\_risk\_rating Maps the vpr score to the standard risk rating based on the score ranges:- 9–10 – Critical - 7–9 – High - 4–7 – Medium - 0–4 - Low
u\_vpr\_context\[id=age\_of\_vuln\] age\_of\_vuln Maps the age of the vulnerability from the scanner to age\_of\_vuln in the third-party entry table.
u\_vpr\_context\[id=exploit\_code\_maturity\] exploit\_code\_maturity Maps exploit code maturity from the scanner to exploit\_code\_maturity in the third-party entry table.
u\_vpr\_context\[id=product\_coverage\] product\_coverage Maps product coverage from the scanner to product\_coverage in the third-party entry table.
u\_vpr\_context\[id=”threat\_sources\_last\_28\] threat\_sources Maps threat sources in the last 28 days from scanner to threat\_sources in the third-party table.
u\_vpr\_context\[id=”threat\_intensity\_last\_28\] threat\_intensity Maps threat intensity in the last 28 days from the scanner to threat\_intensity in the third-party entry table.
u\_vpr\_context\[id=”threat\_recency”\] threat\_recency Maps the threat recency information from the scanner to threat\_recency in the third-part entry table.
u\_vpr\_context\[id=cvssV3\_impactScore\] v3\_impact\_subscore Maps CVSS v3 impact score from the scanner to v3\_impact\_subscore in the third-party entry table.
u\_name name Maps the name of the plugin to the name column in the third-party entry table.
u\_stig\_severity stig\_severity Maps the stig\_severity field in the plugin to stig\_severity in the third-party entry table.
u\_check\_type check\_type Maps the check type to check\_type in the third-party entry table.
u\_family.id family\_id Maps the plugin family\_id to family\_id in the third-party entry table.
\[script\] exploit\_attack\_vector The exploit\_attack\_vector column in the third-party entry table is populated based on exploit\_available and v3\_attack\_vector of columns.
u\_cpe software\_raw Maps the raw CPE strings from the Tenable.sc plugin import to the software\_raw column in the third-party entry table, stored as a comma-separated list.
u\_cpe vendor Vendor names extracted from the CPE data are mapped to the vendor column in the third-party entry table, stored as a comma-separated list.
u\_cpe product Product names extracted from the CPE data are mapped to the product column in the third-party entry table, stored as a comma-separated list.
In addition to the direct fields, other information is added as related lists to third-party entries. |Source field|Description| |------------|-----------| |u\_cpe|The list of CPEs is added as a reference.| |u\_see\_also|The list of URLs is added as a reference.| |u\_exploit\_frameworks|The list of exploits for that plugin and inserts mapping for applicable exploit framework and plugin to sn\_vul\_m2m\_framework\_vul.| There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose. |When the script is run|Purpose| |----------------------|-------| |onStart \(when an import set has started transformation\)|This transform is used to initialize the values in the import\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.| |onBefore \(before an import set has completed transformation\).|Function used to update the values in the third-party entry and verify if the third-party entry exists. Based on the results, modifies the values in a third-party entry. This script is for internal use, and modifying or deleting them isn’t recommended.| |onComplete \(when an import set has completed transformation\).|This transform is used to set the values of Plugins created and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.| The TenableSCPluginsImportProcessor script include is called from the onBefore transform script. It takes the output from the Tenable.sc plugins integration and transforms it into ServiceNow third-party vulnerability entries. Any changes to this script include may alter the transformation of Tenable.sc plugins data in the third-party entry table. ## Tenable.sc vulnerabilities import The Tenable.sc Open Vulnerabilities transform map is used to transform imported data from the Tenable.sc Open Vulnerabilities integration, and the Tenable.sc and Fixed Vulnerabilities transform map is used to transform imported data from the Tenable.sc Fixed Vulnerabilities Integration. **Note:** Changes to these transform maps alter how data from the Fixed/Open Tenable Vulnerabilities Import is processed. To access the Tenable.sc Open and Fixed Vulnerabilities transform maps, navigate to **Tenable Vulnerability Integration** > **Administration** > **Integration Instances** > **Tenable.sc Fixed/Open Vulnerabilities Integration** > **Data Sources** > **Tenable.sc Open/Fixed Vulnerabilities** > **Tranforms**. The transform maps write the transformed vulnerability data to the Vulnerable Item \[sn\_vul\_vulnerable\_item\] table.
Source field Target field Description
u\_pluginID Id Used as the identifier for the plugin. This field is mapped to the plugin Id in the third-party entry record.
u\_riskfactor source\_severity This field is mapped to source\_severity in the third-party entry record.
u\_severity priority The priority field is mapped with the severity. The default value is 5.
u\_hasbeenmitigated state Has been mitigated is mapped to the state field of vulnerability record. For the Fixed vulnerabilities integration, all the VIs are in the 'Closed' state.
u\_ip ip\_address Ip address is mapped to the host ip field of cmdb\_ci table.
u\_port port Port is mapped to the port field of the vulnerable item record.
u\_protocol protocol Protocol is mapped to the port field of the vulnerfable item record.
u\_firstSeen first\_found The first seen value is mapped to the first found field of the VI record.
u\_lastSeen last\_found The last seen value is mapped to the last found field of the VI record.
u\_exploitAvailable exploit ExploitAvailable is mapped to the exploit field in the third-party entry record.
u\_synopsis threat Synopsis is mapped to the threat field in the third-party entry record.
u\_description summary Description is mapped to the summary field in the third-party entry record.
u\_solution solution Solution is mapped to the solution field in the third-party entry record.
u\_basescore score BaseScore is mapped to the score field in the third-party entry record.
u\_temporalScore temporal\_score Temporal Score is mapped to the temporal score in the third-party entry record.
u\_cvssv3basescore v3\_base\_score Cvssv3basescore is mapped to the v3 base score in the third-party entry record.
u\_cvsstemporalscore v3\_temporal\_score Cvssv3temporal score is mapped to the v3 temporal score in the third-party entry record.
u\_pluginpubdate date\_published Plugin published date is mapped to the plugin published date in the third-party entry record.
u\_pluginmoddate last\_modified Last modified date is mapped to the plugin last modified date in the third-party entry record.
u\_dnsname fqdn DnsName is mapped to the FQDN field of the cmdb\_ci record.
u\_macaddress mac\_address MacAddress is mapped to the mac\_address field of the cmdb\_ci record.
u\_netbiosName netbios NetbiosName is mapped to the NETBIOS field of the cmdb\_ci record.
u\_ip ip IP is mapped to the IP field of cmdb\_ci record.
hostUniqueness uuid Host uniqueness is not mapped to any field but is used to determine uuid for the host.
u\_family category Maps the name field in the family object of the plugin to the category column of third-party entry record.
u\_plugintext proof Plugin text is mapped to proof in tpe record.
\[script\] source The source of the integration is populated. The vulnerable items created from this integration have Tenable.sc as the source.
\[script\} integration\_instance The integration\_instance is the name of the instance from which the vulnerable item is imported.
u\_vpr\_score source\_risk\_score Maps VPR score from the scanner to the Source risk score in the third-party entry table.
\[script\] source\_risk\_rating Maps the vpr score to the standard risk rating based on the score ranges:- 9 - 10 – Critical - 7 – 9 – High - 4–7 – Medium - 0–4 - Low
u\_vpr\_context\[id=age\_of\_vuln\] age\_of\_vuln Maps the age of the vulnerability from the scanner to age\_of\_vuln in the third-party entry table.
u\_vpr\_context\[id=exploit\_code\_maturity\] exploit\_code\_maturity Maps exploit code maturity from the scanner to exploit\_code\_maturity in the third-party entry table.
u\_vpr\_context\[id=product\_coverage\] product\_coverage Maps product coverage from the scanner to product\_coverage in the third-party entry table.
u\_vpr\_context\[id=”threat\_sources\_last\_28\] threat\_sources Maps threat sources in the last 28 days from the scanner to threat\_sources in the third-party table.
u\_vpr\_context\[id=”threat\_intensity\_last\_28\] threat\_intensity Maps threat intensity in the last 28 days from the scanner to threat\_intensity in the third-party entry table.
u\_vpr\_context\[id=”threat\_recency”\] threat\_recency Maps the threat recency information from the scanner to threat\_recency in the third-part entry table.
u\_vpr\_context\[id=cvssV3\_impactScore\] v3\_impact\_subscore Maps CVSS v3 impact score from the scanner to v3\_impact\_subscore in the third-party entry table.
u\_pluginname name Maps the name of the plugin to name column in third-party entry table.
u\_stigseverity stig\_severity Maps the stig\_severity field in the plugin to stig\_severity in third-party entry table.
u\_checktype check\_type Maps the check type to check\_type in third-party entry table.
u\_family.id family\_id Maps the plugin family.id to family\_id in the third-party entry table.
\[script\] exploit\_attack\_vector The exploit\_attack\_vector column in the third\_party\_entry table is populated based on exploit\_available and v3\_attack\_vector of columns.
|Source field|Description| |------------|-----------| |u\_cve|Inserts CVE-related data into the reference table \(sn\_vul\_nvd\_entry\). If the same CVE in the NVD entry table \(sn\_vul\_nvd\_entry\) is found, it associates the current vulnerability to the NVD entry. The mapping is found in sn\_vul\_m2m\_entry\_cve.| |u\_bid|The list of bug traqs is added as a reference.| |u\_cpe|The list of CPEs is added as a reference.| |u\_seealso|The list of URLs is added as a reference.| |u\_xrefs|The list of X-REFs is added as a reference.| |u\_exploitframeworks|The list of exploits for that plugin and Inserts mapping for applicable exploit framework and plugin to sn\_vul\_m2m\_framework\_vul.| There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose. |When the script is run|Purpose| |----------------------|-------| |onStart \(when an import set has started transformation\)|This transform is used to initialize the values in the import\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.| |onBefore \(before an import set has completed transformation\).|Function used to update the values in the vulnerability and verify if the vulnerability exists. Based on the results, modifies the values in a vulnerable items table. This script is for internal use, and modifying or deleting them isn’t recommended.| |onComplete \(when an import set has completed transformation\).|This transform is used to set the values of new VIs created, and VIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.| ## Tenable.cs container asset import Imported asset data is first loaded into the Tenable.cs Container Asset Import \[sn\_vul\_tenable\_cs\_container\_asset\_import\] Table. The Tenable.cs Container Asset transform map is used to transform the imported assets information. Changes to this transform alter how data from the Tenable.cs Container Asset import is processed. To access this transform map, navigate to System Import Sets > Transform Maps. Search for Tenable.cs Container Asset Transform. The following tables lists the transform map fields by integration. |Source field|Target field|Description| |------------|------------|-----------| |u\_digest|Image\_id|Tenable provides a unique digest for the container assets and maps to the discovered container image and docker image record and is used for CI lookup.| |u\_digest|Image\_digest|Tenable provides a unique digest for the container assets and maps to the discovered container image and docker image record and is used for CI lookup.| |u\_name|name|Maps to the name field of the docker image record.| |u\_repositoryuri|name|Maps to the container repository record| |u\_repositoryuri|repo|Maps to the discovered container image record.| |u\_virtualmachines|host\_list|Maps to the discovered container image record| |u\_labels|Image\_labels|Maps the labels assigned to the container image to the image\_labels field of the discovered container image record.| |u\_clusters|image\_cluster|Maps to the discovered container image record| |u\_imagetags|tags|Maps to the discovered container image record| |u\_cloudprovider|cloud\_providers|Maps to the discovered container image record| |u\_accountid|cloud\_account\_ids|Maps to the discovered container image record| |u\_region|cloud\_regions|Maps to the discovered container image record| |u\_operatingsystem|os|Maps to the discovered container image record| |u\_scantime|last\_scan\_date|Maps to the discovered container image record| There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.
When the script is run Purpose
onStart \(when an import set has started transformation\) This transform is used to initialize the values in the import\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.
onBefore \(before an import set has completed transformation\). A function used to update values in the host and verify if the host exists. Based on the results, modifies the values in an import\_set. This script is for internal use, and modifying or deleting them isn’t recommended.
onComplete \(when an import set has completed transformation\). This transform is used to set the values of new CIs created, and CIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.
## Tenable.cs container vulnerability import Imported container vulnerability data is first loaded into the Tenable.cs Container Vulnerability Import \[sn\_vul\_tenable\_cs\_container\_vuln\_import\] Table. The Tenable.cs Container Vuln transform map is used to transform the imported container vulnerability information. Changes to this transform alter how data from the Tenable.cs Container Vulnerability Import is processed. To access this transform map, navigate to **System Import Sets** > **Transform Maps**. Search for Tenable.cs Container Vuln Transform. The following tables list the transform map fields by integration. |Source field|Target field|Description| |------------|------------|-----------| |\[script\]|Image\_id|Digest is extracted from the Resource.Id field from the API and mapped to image\_id field of discovered container image and docker image record.| |\[script\]|Image\_digest|Digest is extracted from the Resource.Id field from the API and mapped to image\_digest field of discovered container image and docker image record.| |\[script\]|name|Repository information is extracted from name field and mapped to docker image and container repository record.| |\[script\]|repo|Repository information is extracted from name field and mapped to discover container image record.| |u\_resource.Labels|Image\_labels|Maps to the discovered container image record| |u\_resource.CloudProvider|cloud\_providers|Maps to the discovered container image record| |u\_resource. AccountId|cloud\_account\_ids|Maps to the discovered container image record| |u\_resource.Region|cloud\_regions|Maps to the discovered container image record| |u\_vulnerability. Id|id|Maps id from source and adds the TEN- prefix. For example, if the id received is 12345, the id in the third-party entry table is TEN-12345.| |u\_vulnerability. Description Id|summaryid|Maps to the third-party entry record. or CVE record.| |u\_vulnerability.Severity|v4\_base\_severity|Maps to the third-party entry record.| |u\_vulnerability.VprScore|source\_risk\_score|Maps to the third-party entry record.| |u\_vulnerability.VprSeverity|source\_severity|Maps to the third-party entry record.| |u\_vulnerability.AttackVector|v4\_attack\_vector|Maps to the third-party entry record.| |u\_vulnerability.ExploitMaturity|v4\_exploit\_maturity|Maps to the third-party entry record.| |\[script\]|source|he source for imported TPE is Tenable.cs.| |u\_vulnerability.Id|name|Maps to the vulnerability references record| |u\_vulnerability. Links|url|Maps to the vulnerability references record| | |vulnerability|Reference of TPE or CVE in vulnerability references record| |u\_software.Name|name|Maps to the container image package record| |u\_software.Version|version|Maps to the container image package record| |u\_software.Type|package\_type|Maps to the container image package record| |u\_softwarepaths|path|Maps to the container image package record| |u\_resolved|status|Maps to the container image finding record| |u\_firstscantime|first\_found|Maps to the container image finding record| |u\_resource.ScanTime|last\_found|Maps to the container image finding record| |u\_vulnerability.Description|proof|Maps to the container image finding record| |u\_resolved|state|Maps to the container vulnerable item record| |u\_firstscantime|first\_found|Maps to the container vulnerable item record| |u\_resource.ScanTime|last\_found|Maps to the container vulnerable item record| |\[script\]|source|The source for container vulnerable item record is Tenable.cs.| There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose. |When the script is run|Purpose| |----------------------|-------| |onStart \(when an import set has started transformation\)|Triggers TenableCS Container Vulnerabilities Processor which imports data from Tenable.cs using the import set and loads each record into the CMDB CI table, the Vulnerable Item table, Third-party Vulnerability Entry table, Vulnerability Reference table, Container Image Package, Container Image Finding, and Container Vulnerable Item. Modifying or deleting isn’t recommended.| |onBefore \(before an import set has completed transformation\)|Checks if the third-party Entry and Image Findings exist. If not, these records are created in their respective tables. This script is for internal use, and modifying or deleting them isn’t recommended.| |onComplete \(when an import set has completed transformation\)|Updates the count of CIs, VITs, and Findings as imported from Tenable.cs. This script is for internal use, and modifying or deleting them isn’t recommended.| ## Tenable.cs compute vulnerability import Imported host vulnerability data is first loaded into the Tenable.cs Compute Vulnerability Import \[sn\_vul\_tenable\_cs\_compute\_vuln\_import\] Table. The Tenable.cs Compute Vuln transform map is used to transform the imported host vulnerability information. Changes to this transform alter how data from the Tenable.cs Compute Vulnerability Import is processed. To access this transform map, navigate to **System Import Sets** > **System Import Sets**. Search for Tenable.cs Compute Vuln Transform. The following table lists the transform map fields by integration.
Source field Target field Description
u\_resource.Id object\_id Maps to the CMDB Ci record.
u\_resource.Name name Maps to the CMDB Ci record.
  asset\_category Cloud is mapped as Asset Category in discovered item record.
U\_resource.CloudProvider cloud\_service\_provider Maps to the discovered item record
u\_resource.Region cloud\_region Maps to the discovered item record
u\_resource.AccountId cloud\_account Maps to the discovered item record
u\_resource. CloudProvider cloud\_resource\_type Maps to the discovered item record
u\_resource.Id resource\_id Maps to the discovered item record
u\_resource.Name resource\_name Maps to the discovered item record
u\_vulnerability.Id id Maps id from source and adds the TEN- prefix. For example, if the id received is 12345, the id in the third-party entry table is TEN-12345. Maps id to CVEs as well.
u\_vulnerability. Description summary Maps to the third-party entry record.
u\_vulnerability.Severity v4\_base\_severity Maps to the third-party entry record.
u\_vulnerability.VprScore source\_risk\_score Maps to the third-party entry record.
u\_vulnerability.VprSeverity source\_severity Maps to the third-party entry record.
u\_vulnerability.AttackVector v4\_attack\_vector Maps to the third-party entry record.
u\_vulnerability.ExploitMaturity v4\_exploit\_maturity Maps to the third-party entry record.
\[script\] source The source for imported TPE is Tenable.cs.
u\_vulnerability.Id name Maps to the vulnerability references record
u\_vulnerability.Links url Maps to the vulnerability references record
  vulnerability Reference of TPE or CVE in vulnerability references record
u\_resolved status Maps to the vulnerable item detection record
u\_firstscantime first\_found Maps to the vulnerable item detection record
u\_resource.ScanTime last\_found Maps to the vulnerable item detection record
u\_softwarepaths proof Maps to the vulnerable item detection record
u\_softwareresolutionversions solution\_summary Maps to the vulnerable item detection record
u\_resolved state Maps to the vulnerable item record
u\_firstscantime first\_found Maps to the vulnerable item record
u\_resource.ScanTime last\_found Maps to the vulnerable item record
\[script\] source The source for vulnerable item record is Tenable.cs.
There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose. |When the script is run|Purpose| |----------------------|-------| |onStart \(when an import set has started transformation\)|Triggers Tenable CS Compute Vulnerabilities Processor which imports data from Tenable.cs using the import set and loads each record into the CMDB CI table, the Vulnerable Items table, and the Third-party vulnerability table. This script is for internal use, and modifying or deleting them isn’t recommended.| |onBefore \(before an import set has completed transformation\).|Checks if the third-party entry and detections exist. If not, these records are created in their respective tables. This script is for internal use, and modifying or deleting them isn’t recommended.| |onComplete \(when an import set has completed transformation\).|Updates the count of CIs, VITs, and detections as imported from Tenable.cs. This script is for internal use, and modifying or deleting them isn’t recommended.| |Source field|Target field|Description| |------------|------------|-----------| |u\_digest|Image\_id|A unique digest provided by Tenable for the container assets. It maps to the discovered container image and docker image record and is used for CI lookup.| |u\_name|name|Maps to the name field of the docker image record.| ## Standardized logic for calculating source\_risk\_score and source\_risk\_rating As part of the standardized data-transformation, the Tenable integration uses a centralized business rule to populate both **source\_risk\_score** and **source\_risk\_rating**. During the integration run, if either **vprv1\_risk\_score** or **vprv2\_risk\_score** is updated, the system automatically recalculates and populates **source\_risk\_score** and **source\_risk\_rating** using the values from the **vprv2\_risk\_score** and **vprv1\_risk\_score** fields in the Third-Party Entry table. - If **vprv2\_risk\_score** is present, it takes precedence over**vprv1\_risk\_score**. - If the **vprv1\_risk\_score** and **vprv2\_risk\_score** are empty, then source\_risk\_score will not be changed. - **source\_risk\_rating** is derived from the finalized **source\_risk\_score** using the standardized thresholds: - 9-10 → **Critical** - 7-9 → **High** - 4-7 → **Medium** - 0-4 → **Low** - NaN → **None** **Note:** The before changes will be implemented as part of Tenable 5.2.1 Version.