Asimily Connector

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

Asimily is an asset inventory and risk management solution for connected IT, OT, Internet of Things (IoT), and medical devices.

The following steps allow you to configure this connector for use with Tenable Exposure Management from start to finish.

Tip: For more information on how third-party integrations work, see Connectors.

Connector Details

Tenable Exposure Management ingests Asimily devices, common vulnerabilities and exposures (CVEs), and anomalies through API.

Details Description

Supported products

Asimily Insight

Category

Asset Inventory

Vulnerability Management

OT
Ingested data Assets and Findings

Ingested Asset Classes

Device

Integration type

UNI directional (data is transferred from the connector to Tenable Exposure Management in one direction)

Supported version and type

SaaS (latest)

Prerequisites and User Permissions

Before you begin configuring the connector, make sure to:

  1. Confirm that you have administrator access to your Asimily portal.

  2. Note your Asimily portal domain, for example, your-org.asimily.com. You need it to configure the connector.

  3. Generate Asimily API Credentials.

Generate Asimily API Credentials

The connector authenticates to Asimily with the username and password of a dedicated API user. Tenable recommends that you create a user for the connector instead of reusing a personal account.

To generate Asimily API credentials:

  1. Log in to your Asimily portal as an administrator.

  2. In the left navigation menu, click Settings > User Management > Users.

    The Users page appears.

  3. Create a user and assign it a username and password.

  4. Grant the user read access to Visibility, Vulnerabilities, and Anomaly Detection.

  5. Copy the username and password to a safe location. You need them to configure the connector.

    Note: Asimily API credentials do not expire. If you change the password in Asimily, the connector stops syncing until you update the password in Tenable Exposure Management.

Add a Connector

To add a new connector:

  1. In the left navigation menu, click Connectors.

    The Connectors page appears.

  2. In the upper-right corner, click Add new connector.

    The Connector Library page appears.

  3. In the search box, type the name of the connector.

  4. On the tile for the connector, click Connect.

    The connector configuration options appear.

Configure the Connector

To configure the connector:

  1. (Optional) In the Connector's Name text box, type a descriptive name for the connector.

  2. In the Tenant Domain text box, type your Asimily portal domain, for example, your-org.asimily.com. Type the host name only, without https://.

  3. In the Username text box, type the username of your Asimily API user.

  4. In the Password text box, type the password of your Asimily API user.

  5. Data pulling configuration: This configuration has dynamic settings tailored to the specific connector and integration type. Below are the configurations relevant to this connector.

    • Select the Fetch Anomalies checkbox to ingest Asimily anomalies as misconfiguration findings. This checkbox is selected by default. Clear it to ingest CVEs only.

    • Select the Include Deactivated Devices checkbox to ingest devices that are deactivated in Asimily. This checkbox is cleared by default.

    • In the Asset Retention text box, type the number of days after which you want assets to be removed from Tenable Exposure Management. If an asset has not been detected or updated within the specified number of days, it is automatically removed from the application, ensuring your asset inventory is current and relevant.

      Tip: For more information, see Asset Retention.

  6. In the Test connectivity section, click the Test Connectivity button to verify that Tenable Exposure Management can connect to your connector instance.

    • A successful connectivity test confirms that the platform can connect to the connector instance. It does not, however, guarantee that the synchronization process will succeed, as additional syncing or processing issues may arise.

    • If the connectivity test fails, an error message with details about the issue appears. Click Show tests for more information about the exact error.

  7. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

    Tip: For more information, see Connector Scheduling.

  8. Click Create & Sync. Tenable Exposure Management begins syncing the connector. The sync can take some time to complete.

  9. To confirm the sync is complete, do the following:

Asimily in Tenable Exposure Management

Locate Connector Assets in Tenable Exposure Management

As the connector discovers assets, Tenable Exposure Management ingests those devices for reporting.

To view assets by connector:

  1. In Tenable Exposure Management, navigate to the Assets page.

  2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view assets.

    The asset list updates to show only assets from the selected connector.

  3. Click on any asset to view Asset Details.

Locate Connector Weaknesses in Tenable Exposure Management

As the connector discovers weaknesses, Tenable Exposure Management ingests those weaknesses for reporting.

To view weaknesses by connector: 

  1. In Tenable Exposure Management, navigate to the Weaknesses page.

  2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view weaknesses.

    The weaknesses list updates to show only weaknesses from the selected connector.

  3. Click on any weakness to view Weakness Details.

Locate Connector Findings in Tenable Exposure Management

As the connector discovers individual findings, Tenable Exposure Management ingests those findings for reporting.

To view findings by connector:

  1. In Tenable Exposure Management, navigate to the Findings page.

  2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view findings.

    The findings list updates to show only assets from the selected connector.

  3. Click on any asset to view Finding Details.

Data Mapping

Tenable Exposure Management integrates with the connector via API to retrieve relevant weakness and asset data, which is then mapped into the Tenable Exposure Management system. The following tables outline how fields and their values are mapped from the connector to Tenable Exposure Management.

Device Mapping

Tenable Exposure Management UI Field

Asimily Field
Unique Identifier deviceID

Name

hostName

macAddr

deviceID
Hostname hostName
System Type deviceType
Manufacturer manufacturer
OT Model deviceModel
OT Serial Number serialNumber
OT Family deviceMasterFamily
OT Firmware softwareVersion
MAC Addresses macAddr
IPv4 Addresses v4IpAddrs
IPv6 Addresses v6IpAddrs
Operating System

os

osVersion
OT Category

deviceMasterFamily

deviceFamilies

isNetworkingDevice
Owners department
External Tags

deviceTag

department

deviceFamilies
Last Seen (Observed) lastDiscoveredAt
Discovery Scan Type discoverySourceValue
Asset Custom Attributes

deviceId

riskScore

impact

likelihood

patientImpact

businessImpact

dataImpact

isCrownJewel

anomalyPresent

recallPresent

highRiskVulnerabilityPresent

storesEphi

transmitEphi

isWireless

lastUsedSsid

managedBy

cmmsId

region

isUsingEndpointSecurity

isNetworkingDevice

discoverySource

isConnected

isCurrentlyInUse

uptime

utilizationPercent

avgUtilizationPercent

mds2

nasIP

securityGroupTag

Finding Mapping

Asimily CVEs create vulnerability findings, and Asimily anomalies create misconfiguration findings.

Tenable Exposure Management UI Field

Asimily Field (CVEs)

Asimily Field (Anomalies)
Unique Identifier

deviceId

cveName

deviceId

alertId
Finding Name

cveName

cveTitle

anomaly

alertId
Description description

description

anomaly
CVEs cveName

—
Severity Driver cvssBaseScore criticality
CVSSv3 Base Score

cvssBaseScore

cvssVersion

—
Published Date nvdPublishDate

—
First Seen openDate

earliestTriggerTime

firstReportedTime
Last Seen (Observed) fixedDate latestTriggerTime
Resolved Date fixedDate

—
State fixedDate fixActionTaken
Finding Custom Attributes

productType

productName

score

oemPatched

isCveMuted

exploitableInWild

cveTitle

alertId

criticality

criticalityScore

anomalyScore

anomalyCategory

mitreTactic

mitreTechnique

domainDeviceOrIpDevice

fixActionTaken

Note: Tenable Exposure Management does not ingest Asimily remediation or recommendation text. Asimily derives this text from the National Vulnerability Database (NVD), and medical device patches require certification before you can apply them.

Finding Status Mapping

Tenable Exposure Management Status

Asimily Status (CVEs)

Asimily Status (Anomalies)

Active

fixedDate is empty

fixActionTaken is empty

Fixed

fixedDate has a value

fixActionTaken has a value

Finding Severity Mapping

Tenable Exposure Management Severity

Asimily Score

Critical

CVSS: 9.0 - 10.0

High

CVSS: 7.0 - 8.9

Criticality: High

Medium

CVSS: 4.0 - 6.9

Criticality: Medium

Low

CVSS: 0.1 - 3.9

Criticality: Low

None

CVSS: 0

Criticality: empty

Note: For Asimily CVEs, Tenable uses the cvssBaseScore field to determine severity. For Asimily anomalies, Tenable Exposure Management displays the Asimily criticality value (High, Medium, or Low) as is. Tenable Exposure Management also ingests the Asimily anomaly scores and overrides them with Tenable scores. A CVE scored with CVSS version 2 has no cvssBaseScore value, so its severity is None.

Status Update Mechanisms

Every day, Tenable Exposure Management syncs with the vendor's platform to receive updates on existing findings and assets and to retrieve new ones (if any were added).

The table below describes how the status update mechanism works in the connector for findings and assets ingested into Tenable Exposure Management.

Update Type in Tenable Exposure Management

Mechanism (When?)

Archiving Assets

  • Asset that appears in Tenable Exposure Management and isn't returned on the next connector's sync.

  • Device that is deactivated in Asimily, when the Include Deactivated Devices checkbox is cleared.

Change a Finding status from "Active" to "Fixed"

  • A CVE receives a value in the fixedDate field on the Asimily side.

  • An anomaly receives a value in the fixActionTaken field on the Asimily side.
Note: Updates on the vendor side are reflected in Tenable Exposure Management only when the next scheduled connector sync time is complete (once a day).

Uniqueness Criteria

Tenable Exposure Management uses defined uniqueness criteria to determine whether an ingested asset or finding should be recognized as a distinct record. These criteria help define how assets and findings are identified and counted from each connector.

Tip: To learn more about data deduplication and uniqueness criteria, See Third-Party Data Deduplication in Tenable Exposure Management.

The uniqueness criteria for this connector are as follows:

Data

Uniqueness Criteria

Asset

deviceID (uniquely identifies the device)

Vulnerability

cveName (uniquely identifies the CVE)

alertId (uniquely identifies the Asimily detection rule)

Finding

cveName with deviceId (uniquely identifies a CVE on a device)

alertId with deviceId (uniquely identifies an anomaly on a device)

Support and Expected Behavior

Support Limitations and Expected Behavior

This section outlines any irregularities, expected behaviors, or limitations related to integration of the connector and Tenable Exposure Management. It also highlights details about ingested and non-ingested data to clarify data handling and functionality within this integration.

By default, the connector does not ingest devices that are deactivated in Asimily. To ingest them, select the Include Deactivated Devices checkbox in the data pulling configuration.

The connector ingests CVEs that are muted in Asimily. Tenable Exposure Management stores the muted state as the isCveMuted finding custom attribute. As a result, the number of findings in Tenable Exposure Management can exceed the number that the Asimily default view shows.

Asimily returns no base score for a CVE that is scored with CVSS version 2. Tenable Exposure Management maps no CVSS score for these CVEs and sets their severity to None.

Tenable Exposure Management does not ingest the following Asimily data:

  • Remediation and recommendation text.

  • Food and Drug Administration (FDA) recall details. The connector ingests only the recallPresent asset custom attribute.

  • Exploit Prediction Scoring System (EPSS) scores, which the Asimily API does not provide.

  • Common Weakness Enumeration (CWE) identifiers. The connector ingests the weakness name as the cveTitle finding custom attribute.

The connector ingests the MITRE tactic and technique of an anomaly as the mitreTactic and mitreTechnique finding custom attributes. Tenable Exposure Management does not display MITRE data for third-party findings.

API Endpoints in Use

API

Use in Tenable Exposure Management

Permissions required

GET /api/extapi/assets

Retrieves Asimily devices and creates assets.

Read access to Visibility

POST /api/extapi/assets/device-cves

Retrieves the CVEs of each device and creates vulnerability findings.

Read access to Vulnerabilities

POST /api/extapi/assets/anomalies

Retrieves the anomalies of each device and creates misconfiguration findings.

Read access to Anomaly Detection

Data Validation

This section shows how to validate and compare data between Tenable Exposure Management and the Asimily portal.

Asset Data Validation

For each unique deviceID in Asimily, the connector creates an asset in Tenable Exposure Management.

Objective: Ensure the number of devices in Asimily aligns with the number of devices displayed in Tenable Exposure Management.

In Asimily:

  1. Click Visibility > Assets.

    Note the total number of devices in the table header.

In Tenable Exposure Management:

  1. Locate your connector assets.

  2. Compare the total number of assets between Asimily and Tenable Exposure Management.

Expected outcome: The total numbers returned in Asimily and Tenable Exposure Management should match.

If an asset is not visible in Tenable Exposure Management, check the following conditions:

  • The device is deactivated in Asimily and the Include Deactivated Devices checkbox is cleared.

  • The device was created in Asimily after the last connector sync.

  • The Assets page filters out unlicensed assets by default. Clear the licensed assets filter to show them.

  • The asset was archived because it did not return in the connector's last sync.

    Tip: To learn more on how assets are archived and findings change status, see Status Update Mechanisms.

Finding Data Validation

Objective: Ensure the number of CVEs and anomalies on an Asimily device aligns with the number of findings on the matching asset in Tenable Exposure Management.

Note: Validate findings one device at a time. A mismatch then points to a single set of records.

In Asimily:

  1. Click Visibility > Assets, and then click the device you want to validate.

  2. Click Vulnerabilities > CVEs.

  3. Clear the default filters on the CVEs page.

    Note the total number of CVEs.

    Note: The CVEs page opens with a CVE score, fixed state, and muted state filter applied. These filters hide most of the CVEs that the connector ingests.

  4. Click Anomaly Detection > Asimily Detections, and then select the Include Fixed checkbox.

    Note the total number of anomalies.

In Tenable Exposure Management:

  1. Locate your connector findings.

  2. Filter the findings by the asset you want to validate.

  3. Compare the total number of findings between Asimily and Tenable Exposure Management. Asimily CVEs appear as vulnerabilities, and Asimily anomalies appear as misconfigurations.

Expected outcome: The total numbers returned in Asimily and Tenable Exposure Management should match.

If a finding is missing from Tenable Exposure Management or no longer active, check the following conditions:

  • The Fetch Anomalies checkbox is cleared, so the connector does not ingest anomalies.

  • Two Asimily records share the same CVE or detection rule on the same device. Tenable Exposure Management counts them as one finding.

  • The CVE or anomaly was created in Asimily after the last connector sync.

  • The finding is marked as Fixed and appears under the Fixed state on the Findings screen.

  • The finding no longer appears because its related asset was archived.

    Tip: To learn more on how assets are archived and findings change status, see Status Update Mechanisms.