Black Duck SCA in Tenable One Open Connector

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

You are leveraging the Tenable One Open Connector to ingest Black Duck Software Composition Analysis (SCA) findings into Tenable Exposure Management. Black Duck SCA scans the open-source and third-party code used in your applications and containers to identify security, quality, and license-compliance risk in the software supply chain.

This purpose-built path normalizes your open-source component risk alongside the rest of your attack surface, so you can prioritize, track remediation, and score exposure consistently.

Note: The Tenable One Open Connector performs every initial synchronization as a Full Fetch to pull the entire dataset and establish a baseline for future incremental updates.

Connector Details

The following table describes the Tenable One Open Connector as configured for Black Duck SCA data.

Attribute Specification
Supported source

Black Duck SCA (Software Composition Analysis, formerly Synopsys Black Duck), exported through the Black Duck web interface or the Black Duck REST API.
Primary use cases

  • Consolidate open-source and third-party component vulnerabilities alongside other sources on your attack surface.

  • Track remediation of vulnerable components with the same workflows you use for other exposures.

  • Import Black Duck SCA findings for a proof-of-concept (POC) evaluation of open-source component risk in Tenable Exposure Management.
Supported Data Sources

  • Static file upload

  • Automated/Scheduled pull from a supported cloud storage
Supported Cloud Storage Providers

Automated pull from cloud storage supports the following providers:

  • Amazon S3
  • Azure Blob Storage
  • Google Cloud Storage (GCS)
Supported file formats

  • CSV

  • Excel (.xlsx)

  • ZIP files containing a single source file
Maximum file size 2 GB per file.
Supported asset types

Code Repository
Synchronization modes
  • Full Fetch: Replaces the existing dataset with each new file sync.
  • Incremental Fetch: Updates the established baseline based on your selected Delta Sync mode.
Support limitations

  • Supports English-language columns only.

  • Does not support direct API-based integration with Black Duck. You export the findings to a file, then upload the file or pull it from a supported cloud storage.

  • Reports the vulnerability score from the Black Duck overallScore field. Validate this value against your Black Duck instance before you rely on it for prioritization.

  • Does not support Identity Exposure.

Prerequisites

Before you begin, make sure you have the following:

Requirement Details
Tenable Exposure Management access A user account with the Connector Manager or Administrator role.
Black Duck access A Black Duck user with the Global Code Scanner role. To export through the REST API, you also need an API token generated for that user with Read Access enabled.
Export format A CSV or Excel (.xlsx) file that contains your Black Duck project, version, component, and vulnerability data. For more information, see Export Your Black Duck SCA Findings.
Asset type decision Use Code Repository. This asset type matches Black Duck code projects and exposes the component-level finding fields, such as Source Code Package Name and Source Code Package Version. You cannot change the asset type after you set up the connector.
Asset naming decision Decide how you want Black Duck projects to appear as assets in Tenable Exposure Management before you export. Tenable recommends combining the project name and the version name into a single value. For more information, see Deduplication and Aggregation Settings.

Export Your Black Duck SCA Findings

To bring Black Duck SCA findings into Tenable Exposure Management, export your project, version, component, and vulnerability data from Black Duck at the project level, and then upload the resulting file or pull it from a supported cloud storage.

Note: The connector accepts CSV, Excel (.xlsx), or ZIP files. If you export through the REST API, save the results as one of these formats before you upload.

Export Findings from Black Duck

To export SCA findings from the Black Duck web interface:

  1. Log in to your Black Duck server.

  2. Navigate to the project and the project version you want to export.

  3. Open the Reports tab, and then generate a report that includes the vulnerable components for that version.

  4. Download the report as a CSV file.

  5. Repeat these steps for each project version you want to ingest, and then combine the results into a single file.

To export SCA findings through the Black Duck REST API:

  1. Authenticate with your API token to obtain a bearer token:

    POST /api/tokens/authenticate

  2. List your projects, and then list the versions of each project:

    GET /api/projects
    GET /api/projects/{projectId}/versions

  3. For each project version, retrieve the vulnerable components:

    GET /api/projects/{projectId}/versions/{versionId}/vulnerable-bom-components

  4. Save the combined results as a CSV or Excel (.xlsx) file.

  5. Make sure the file includes a column for the asset name and a column for the code repository URL. Tenable Exposure Management requires these values for the Code Repository asset.

    Important: The Black Duck project and version API responses do not return a ready-made link to the Black Duck user interface. Construct the code repository URL from your Black Duck server URL and the project or version identifier, and add it to your export as a column before you upload.

Tip: For ongoing ingestion, you can configure the Tenable One Open Connector to pull from a cloud storage continuously, which removes the need for manual exports.

Fields Included in a Black Duck SCA Export

The following table lists the key Black Duck fields used in the mapping.

Black Duck Field Description
Project Name Name of the Black Duck project. Primary asset identifier.
Active Indicates whether the project is active in Black Duck.
Version Name Name of the scanned project version.
Project Tags Vendor-defined tags applied to the project.
Component Name Name of the open-source or third-party component.
Component Version Name Version of the component in use.
Component Origin Name Package origin or ecosystem for the component, for example, npm or Maven.
Vulnerability Name Unique identifier for the vulnerability, either a Black Duck Security Advisory (BDSA) identifier or a CVE identifier.
Overall Score Common Vulnerability Scoring System (CVSS) based severity score on a 0 to 10 scale.
Description Detailed explanation of the vulnerability.
CWE ID Common Weakness Enumeration (CWE) identifier.
CVSS3 Vector CVSS v3 attack vector string.
CVSS2 Vector CVSS v2 attack vector string (legacy).
Source Vulnerability feed that reported the finding, for example, the National Vulnerability Database (NVD) or BDSA.
Published Date Date the vulnerability was first published.
Vendor Fix Date Date a vendor-supplied fix became available.
Solution Black Duck remediation guidance for the vulnerability.
Status Remediation status of the finding, for example, NEW or IGNORED.

Tip: For the mapping to work cleanly, keep the asset name column consistent across exports and matched to how assets appear in your inventory. Include the code repository URL, because the Code Repository asset requires it.

Add a Connector

To add a new connector:

  1. In the left navigation menu, click Connectors.

    The Connectors page appears.

  2. In the upper-right corner, click Add new connector.

    The Connector Library page appears.

  3. In the search box, type the name of the connector (i.e.,Open Connector). Alternatively, locate the connector in the Custom section.

  4. On the Tenable One Open Connector tile, click Connect.

    The connector configuration options appear.

Configure the Connector

On the Connector Details page, configure the connector to upload your Black Duck SCA export or to pull it from a supported cloud storage.

  1. (Optional) In the Connector's Name box, type a descriptive name that identifies the source, for example, Black Duck SCA – [Program Name].

  2. (Optional) In the Description box, type a description that reflects the source data, for example, Open-source component findings from Black Duck.

  3. From the Asset Type drop-down, select Code Repository.

    Important: You cannot change the asset type after you save the connector. If you ingest more than one asset type from Black Duck, create a separate connector for each asset type.

  4. In the Data pulling configuration section, select a data source option:

    • Static File Upload: Select this option to manually upload a single CSV, Excel, or ZIP file. This option is recommended for initial setup.

    • Automated Pull from Cloud Storage: Select this option to establish a continuous data pipeline from your cloud storage. This option is recommended for ongoing sync.

Static File Upload

To upload the export file manually:

  1. In the Data pulling configuration section, select Static file upload.

  2. Click Upload file, and then select the CSV or Excel (.xlsx) file that you built from the Black Duck export.

  3. Wait for the file preview to load.

  4. Continue to Set the Data Update Mode and Retention.

Automated Pull from Cloud Storage

For automated pulls, grant Tenable Exposure Management read access to the cloud storage that holds your Black Duck export file.

The Tenable One Open Connector supports the following cloud storage providers:

Note: You select the cloud provider in the Data pulling configuration section, and then enter that provider's credentials and file location. The discovery, change detection, and synchronization logic are the same for all three providers.

You can use one of two authentication methods.

To configure the automated Amazon S3 pull:

  1. In the Data pulling configuration section, select Automated Pull from Cloud Storage, and then select Amazon S3.

  2. In the Authentication method section, select ARN & External ID or Access Key & Secret Key.

    • If you select the ARN & External ID method, complete the following configurations in your Amazon S3 console:

      1. Navigate to IAM > Policies > Create Policy > Visual Editor.

      2. From the Service drop-down, select S3.

      3. From the Actions allowed drop-down, select the following permissions:

        • ListBucket

        • GetObject

      4. In the Resources section:

        1. For ListBucket, add the Amazon Resource Name (ARN) for the bucket: arn:aws:s3:::YOUR_BUCKET_NAME

        2. For GetObject, add the ARN for the objects: arn:aws:s3:::YOUR_BUCKET_NAME/*

      5. Click Next.

      6. On the Review policy page, type a Name, for example, S3ConnectorReadAccess, and a Description for the policy.

      7. Review the Summary.

      8. Click Create Policy.

      9. Navigate to IAM > Roles > Create Role > AWS account.

      10. In the Account ID field, type the following Tenable account identifier:

        012615275169

      11. Select the Require External ID check box.

      12. In the text box, type the value of your external identifier.

        Important: The external identifier must follow the AWS AssumeRole API constraints: a length of 2 to 1224 characters, and only alphanumeric characters (A-Z, a-z, 0-9) and the following characters: = , . @ : / - _. Unsupported characters can cause the AssumeRole call to fail.

      13. Paste this value into the Connector text box.

      14. Make sure the Require MFA check box is cleared.

      15. Click Next: Permissions.

      16. Attach the policy you created, for example, S3ConnectorReadAccess.

      17. Continue through the wizard and review the settings.

      18. Create the role.

      19. Copy the ARN and External ID to a safe location. You need them to configure the connector.

    • If you select the Access Key & Secret Key method, complete the following configurations in your Amazon S3 console:

      1. Log in to the AWS console with the target account credentials.

      2. Navigate to IAM > Users.

      3. Select the IAM user with the appropriate permissions.

      4. Navigate to the Security Credentials tab.

      5. In the Access Keys section, click Create access key.

        The Create access key wizard appears.

      6. In the Use case section, select the Third-party service radio button.

      7. Click Next.

      8. In the Description tag value text box, type a descriptive tag for the key.

      9. Click Create access key.

      10. Copy the Access Key and Secret Key to a safe location. You need them to configure the connector.

  3. After you generate the required authentication values, complete the connector configuration in Tenable Exposure Management:

    • For the ARN & External ID method, fill in the External ID, Role ARN, Region, and S3 URI path, for example, s3://bucket-name/folder/.

    • For the Access Key & Secret Key method, fill in the Access Key, Secret Key, Region, and S3 URI path, for example, s3://bucket-name/folder/.

    • (Optional) Fill in the File Pattern, for example, *.csv or blackduck_findings_*.csv.

    • Configure a scheduled Black Duck export process to write new exports to the same Amazon S3 bucket path.

The connector authenticates to Azure through Microsoft Entra ID with a service principal, and reads your Black Duck SCA export file from a container in your Azure Blob Storage account.

To configure the automated Azure Blob Storage pull:

  1. In the Data pulling configuration section, select Automated Pull from Cloud Storage, and then select Azure Blob Storage.

  2. In your Azure environment, create a service principal with read-only access to the storage:

    1. In the Azure portal, open Microsoft Entra ID, and then register a new application. Azure creates a service principal for the application.

    2. Record the Directory (tenant) ID and the Application (client) ID.

    3. Under the application's Certificates & secrets, create a client secret, and then copy its value.

    4. On the target storage account or container, assign the application the Storage Blob Data Reader role.

    5. Copy the tenant ID, client ID, and client secret to a safe location. You need them to configure the connector.

  3. After you generate the required authentication values, complete the connector configuration in Tenable Exposure Management:

    • In the Tenant ID, Client ID, and Client Secret boxes, type the values from your service principal.

    • In the Storage account box, type the name of your Azure storage account.

    • In the File Path box, type the location of your data in the form <container>/<prefix-to-file>, for example, blackduck-container/exports/.

    • (Optional) In the File Pattern box, type a pattern, for example, *.csv or blackduck_findings_*.csv.

    Note: The connector searches for the file only in the folder that the File Path points to. It does not search nested folders. Azure Blob Storage does not require a region.

  4. Configure a scheduled Black Duck export process to write new exports to the same container path.

The connector authenticates to Google Cloud Storage (GCS) with a service account key in JSON format, and reads your Black Duck SCA export file from a bucket in GCS.

To configure the automated Google Cloud Storage pull:

  1. In the Data pulling configuration section, select Automated Pull from Cloud Storage, and then select Google Cloud Storage.

  2. In your Google Cloud environment, create a service account key with read-only access:

    1. In the Google Cloud console, create a service account.

    2. Grant the service account read-only access to the target bucket, for example, the Storage Object Viewer role.

    3. Create a key for the service account, select the JSON key type, and then download the key file.

    4. Store the JSON key file in a safe location. You need it to configure the connector.

  3. After you download the key, complete the connector configuration in Tenable Exposure Management:

    • In the Service Account Key box, upload the JSON key file you downloaded.

    • In the File Path box, type the location of your data in the form <bucket>/<prefix-to-file>, for example, blackduck-bucket/exports/.

    • (Optional) In the File Pattern box, type a pattern, for example, *.csv or blackduck_findings_*.csv.

    Note: The connector searches for the file only in the folder that the File Path points to. It does not search nested folders. Google Cloud Storage does not require a region.

  4. Configure a scheduled Black Duck export process to write new exports to the same bucket path.

Set the Data Update Mode and Retention

To complete the data configuration:

  1. In the Asset Retention box, type the number of days after which Tenable Exposure Management removes assets. The default is 460 days.

    Tip: To learn more, see How does Asset Retention work in the Tenable One Open Connector?.

  2. In the Data Update Mode section, select Override data (Full Fetch). This mode treats each upload as the complete source of truth.

    Tip: With Override data (Full Fetch), any vulnerability that is absent from the latest export transitions to Fixed in Tenable Exposure Management automatically, for example, when you remediate or remove the affected component. To learn more about sync modes, see Manage Data Sources and Update Modes in Tenable One Open Connector.

  3. In the Test connectivity section, click Test Connectivity. Tenable Exposure Management validates the credentials and the accessibility of the file path. You must pass this test before you can create the connector.

    Important: If you change the credentials or remap a file, you must test the connectivity again before you can save the connector.

  4. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

    Tip: For more information, see Connector Scheduling.

  5. Click File Preview to view the first 100 rows of the file.

  6. Click Next to proceed to asset type selection and field mapping.

Map Black Duck SCA Fields to Tenable Exposure Management

After you upload the file, Tenable Exposure Management displays a field mapping screen with a preview of your data. Use the following table as a reference for the recommended mappings.

Note: Tenable Exposure Management requires Asset Name and Code Repository URL to create an asset, and Finding Name and Finding Score to create a weakness. Make sure your export includes these fields before you map.

Recommended Field Mapping

Black Duck Field Black Duck API Path Tenable Exposure Management Field Required Notes
Project Name name Assets > Asset Name Yes Primary asset identifier. Keep it consistent across exports. Tenable recommends combining the Black Duck project name and version name into a single value in this column, for example, PaymentService - 1.2.0, so that each project version resolves to its own asset. For more information, see Deduplication and Aggregation Settings.
Project URL Constructed from the server URL and the projectId or versionId Assets > Code Repository URL Yes The Black Duck project and version API responses do not return a ready-made link to the user interface. Construct one from your server URL and the project or version identifier, and include it as a column in your export.
Active active Assets > Asset Status No Distinguishes active projects from archived projects.
Version Name versionName Assets > External Tags No Multi-value field. Appends the project version to the asset tags.
Component Name componentName Assets > External Tags No Component associated with the asset. Multi-value field.
Component Version Name componentVersionName Assets > External Tags No Component or library version associated with the asset. Multi-value field.
Vulnerability Name vulnerabilityName Findings > Finding Name Yes Unique vulnerability identifier, for example, BDSA-2024-1234 or a CVE identifier.
Overall Score vulnerabilityWithRemediation.overallScore Findings > Score Yes CVSS-aligned score on a 0 to 10 scale. See Severity Mapping Reference.
Description description Findings > Description No Full vulnerability description.
CWE ID vulnerabilityWithRemediation.cweId Findings > CWEs No Prefix with CWE- if the export omits it, for example, CWE-79. Multi-value field.
CVSS3 Vector cvss3.vector Findings > CVSS3 Base Vector No CVSS v3 attack vector string.
CVSS2 Vector cvss2.vector Findings > Custom Attributes No Legacy CVSS v2 vector. Map this field when a CVSS v3 vector is unavailable.
Source source Findings > Custom Attributes No Vulnerability feed source, for example, NVD or BDSA.
Published Date publishedDate Findings > Vulnerability Published At No Date the vulnerability was first published.
Vendor Fix Date vendorFixDate Findings > Custom Attributes No Date a vendor-supplied patch became available.
Solution solution Findings > Solution No Black Duck remediation guidance.
Status status Findings > State No See Status Mapping Reference.
Component Origin Name componentVersionOriginName Findings > Source Code Package Manager No Package ecosystem and external identifier, useful for cross-referencing back to Black Duck.

Severity Mapping Reference

Black Duck reports vulnerability severity through the overallScore field on a CVSS-aligned 0 to 10 scale. Tenable Exposure Management maps that score to its own severity levels as follows.

Black Duck overallScore (numeric) Tenable Exposure Management Severity
9.0 – 10.0 Critical
7.0 – 8.9 High
4.0 – 6.9 Medium
0.1 – 3.9 Low
0.0 Informational

Status Mapping Reference

Black Duck Status Tenable Exposure Management State Notes
Active Active/Vulnerable Default state for any finding that the sync still returns.
Vulnerability no longer returned on the sync Fixed The component or the vulnerability is absent from the latest Black Duck export.

Deduplication and Aggregation Settings

In the deduplication section, set the asset unique identifier to the field mapped to Asset Name (name). This setting tells Tenable Exposure Management how to match incoming Black Duck projects against existing Code Repository assets instead of creating duplicate records.

How you populate the Asset Name column determines how many assets the connector creates and how large each one becomes. Choose one of the following strategies, depending on the granularity you want in Tenable Exposure Management.

Strategy Asset Name source Example value Result in Tenable Exposure Management
Project only Black Duck project name PaymentService One asset represents the entire project across every scanned version. This strategy creates fewer assets, but each one aggregates all component findings from all versions, which can produce a single very large asset that is harder to prioritize and remediate.
Project + Version (recommended) Black Duck project name combined with the version name PaymentService - 1.2.0 Each project version becomes its own, appropriately sized asset. Findings stay scoped to the version that introduced them, so remediation tracking and exposure scoring reflect the release your teams actually work on.

The following three rows from a Black Duck export illustrate the difference:

Project Name Version Name Component Name Vulnerability Name
PaymentService 1.2.0 log4j-core CVE-2021-44228
PaymentService 1.3.0 log4j-core CVE-2021-44228
PaymentService 2.0.0 jackson-databind CVE-2020-36518

  • With the Project only strategy, all three findings attach to a single asset named PaymentService.

  • With the Project + Version strategy, the export produces three assets — PaymentService - 1.2.0, PaymentService - 1.3.0, and PaymentService - 2.0.0 — and each asset carries only its own findings.

Note: The connector cannot construct or concatenate the Asset Name value for you. Before you upload, confirm that the column you map to Asset Name already reflects the strategy you chose, either the project name alone or the project and version combined into one string. If you use the Project + Version strategy, add that combined column to your Black Duck export, or build it in your export script or spreadsheet first, because field mapping uses only the values already present in the file.

For the finding, Black Duck uniquely identifies a component and vulnerability pairing with componentName, componentVersionName, componentVersionOriginName (or externalNamespace), componentVersionOriginId (or externalId), and version_name. For the unique vulnerability itself, use vulnerabilityName or vulnerabilityId.

Tip: To learn about the expected behavior and logic rules for how Tenable Exposure Management maps source file columns, see Tenable One Open Connector Mapping .

Review and Save

To review and save the connector:

  1. Review the field mapping preview to confirm that the data parses correctly.

  2. Spot-check two or three rows to verify that the asset name resolves to a recognizable value in the naming strategy you chose, and that the Code Repository URL field is populated.

  3. Confirm that the Finding CWEs field is populating. This field is important for the Tenable Exposure Management risk scoring.

  4. Click Save & Sync.

    Tenable Exposure Management begins processing the file. Depending on the file size, ingestion can take a few minutes. The connector appears in the Connectors list with a Connecting status during initial ingestion.

Validate the Data in Tenable Exposure Management

After the sync completes, confirm that Tenable Exposure Management ingested your Black Duck SCA data correctly.

To validate the data:

  1. In Tenable Exposure Management, navigate to the Assets page, and search for one of the project names from your Black Duck export.

  2. Confirm that the asset appears under the Code Repository asset type and that findings are attached to it.

  3. Confirm that the asset names follow the naming strategy you chose. If you used Project + Version, verify that each scanned version appears as its own asset.

  4. Navigate to the Findings page, and filter by the connector name to view all imported findings.

  5. Open a finding, and verify that the component-level fields are populated, including the component name and the component version.

  6. Verify that the severity levels, CWE identifiers, and vulnerability names match your expectations against the Black Duck source data.

Common Discrepancies to Expect

  • New asset created: If the asset name in your export does not match an existing Code Repository asset in Tenable Exposure Management, the connector creates a new asset. Normalize your project naming, and keep your naming strategy consistent between exports, before you export.

  • Asset naming strategy changed between syncs: Switching from project-only naming to project-and-version naming, or back, changes the asset unique identifier, so the connector creates a new set of assets instead of updating the existing ones. Decide on one strategy before your first sync, and keep it stable.

  • Code Repository URL missing: The Code Repository asset requires this field, and the Black Duck API does not return a ready-made link to the user interface. Construct one from your server URL and the project or version identifier before you export.

  • Instance count inflation: Tenable Exposure Management creates a finding for every version that the sync returns. If your export includes multiple versions for each project and you named assets by project only, sum the instance counts across all versions when you validate against the Black Duck dashboard.

Keep Your Data Current

Choose the method that fits your operational needs.

Method Cadence How
Manual re-upload As needed Rebuild the export from the Black Duck web interface or REST API, and re-upload the file through the connector.
Cloud storage automation Scheduled A scheduled script writes the combined export to a supported cloud storage, and Tenable Exposure Management pulls the file on your sync schedule. Make sure the script applies the same asset naming strategy on every run.

Note: Export active findings only from Black Duck before you upload, and select Override data (Full Fetch) as your sync mode. Any vulnerability that is absent from the latest export (remediated in Black Duck) transitions to Fixed in Tenable Exposure Management automatically. This approach keeps your open-source exposure posture accurate without manual cleanup.