Claude Code Security in Tenable One Open Connector

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

You are leveraging the Tenable One Open Connector to ingest Claude Code Security findings into Tenable Exposure Management, without waiting for a native connector.

This purpose-built path normalizes AI-driven code risk alongside the rest of your attack surface, so you can prioritize, track remediation, and score exposure consistently.

Prerequisites

Before you begin, make sure you have the following:

Requirement	Details
Tenable Exposure Management access	A user account with the Connector Manager or Administrator role.
Claude Code Security access	An active Claude Code Security account with access to the scan interface.
Target repository	A code repository that Claude Code Security can access. You select the branch to scan at scan time.
Export format	A CSV export downloaded from the Claude Code Security scan results screen. For more information, see Export Your Claude Code Security Findings.

Export Your Claude Code Security Findings

To bring Claude Code Security findings into Tenable Exposure Management, run a scan, export the findings to a CSV file, and then upload the file or pull it from Amazon S3.

Run the Security Scan

To run a scan:

1. In the Claude Code Security interface, click New Scan, and then connect your target repository.

2. Select the branch you want to scan, for example, main.

3. Select the AI model and effort level that fit your review. A higher-capability model and a higher effort level produce a more thorough analysis.

   Note: Scan duration and cost scale with the model, the effort level, and the repository complexity.

4. Start the scan and wait for the results to appear.

Export the Findings

To export the findings:

1. After the scan completes, on the scan results screen, click Export all findings.

2. Select Download CSV.

Fields Included in a Claude Code Security CSV Export

The following table lists the fields included in a Claude Code Security CSV export.

Claude Code Security Field	Description
Name	Short title that identifies the vulnerability type or weakness.
Description	Human-readable explanation of the finding, including context and impact.
Severity	Risk level assigned by Claude Code Security: Critical, High, Medium, or Low.
Status	Current state of the finding: Open or Resolved.
CWE	Common Weakness Enumeration identifier associated with the finding.
Repository	Name of the scanned code repository.
File path	Location of the vulnerable code within the repository.
Line	Location of the vulnerable code within the repository.
Finding URL	Direct link to the finding detail in the Claude Code Security interface.
Date created	Timestamp of when Claude Code Security first identified the finding.

Add a Connector

To add a new connector:

1. In the left navigation menu, click Connectors.

   The Connectors page appears.

   

2. In the upper-right corner, click Add new connector.

   The Connector Library page appears.

3. In the search box, type the name of the connector (i.e.,Open Connector). Alternatively, locate the connector in the Custom section.

   

4. On the Tenable One Open Connector tile, click Connect.

   The connector configuration options appear.

Configure the Connector

On the Connector Details page, configure the connector to upload your Claude Code Security export or to pull it from Amazon S3.

1. (Optional) In the Connector's Name box, type a descriptive name that identifies the source and repository, for example, Claude Code Security – [Repository Name].

2. (Optional) In the Description box, type a description that reflects the source data, for example, AI-driven code findings from Claude Code Security.

3. From the Asset Type drop-down, select Code Repository.

   Important: You cannot change the asset type after you save the connector. If you scan multiple repositories, you can use a single connector and upload a combined CSV, or create one connector for each repository for cleaner attribution.

4. In the Data pulling configuration section, select a data source option:

   • Static file upload: Select this option to manually upload a single CSV, Excel, or ZIP file. This option is recommended for initial setup.

   • Automated Pull from Cloud Storage (S3): Select this option to establish a continuous data pipeline from your Amazon S3 buckets. This option is recommended for ongoing sync.

Option A: Static File Upload

To upload the export file manually:

1. In the Data pulling configuration section, select Static file upload.

2. Click Upload file, and then select the CSV file that you exported from Claude Code Security.

3. Wait for the file preview to load.

4. Continue to Set the Data Update Mode and Retention.

Option B: Automated Pull from Cloud Storage (S3)

For automated pulls, grant Tenable Exposure Management read access to the Amazon S3 bucket that holds your Claude Code Security export file. You can use one of two authentication methods.

To configure the automated Amazon S3 pull:

1. In the Data pulling configuration section, select Automated Pull from Cloud Storage (S3).

2. In the Authentication method section, select ARN & External ID or Access Key & Secret Key.

   • If you select the ARN & External ID method, complete the following configurations in your Amazon S3 console:

     1. Navigate to IAM > Policies > Create Policy > Visual Editor.

     2. From the Service drop-down, select S3.

     3. From the Actions allowed drop-down, select the following permissions:

        • ListBucket

        • GetObject

     4. In the Resources section:

        1. For ListBucket, add the Amazon Resource Name (ARN) for the bucket: arn:aws:s3:::YOUR_BUCKET_NAME

        2. For GetObject, add the ARN for the objects: arn:aws:s3:::YOUR_BUCKET_NAME/*

     5. Click Next.

     6. On the Review policy page, type a Name, for example, S3ConnectorReadAccess, and a Description for the policy.

     7. Review the Summary.

     8. Click Create Policy.

     9. Navigate to IAM > Roles > Create Role > AWS account.

     10. In the Account ID field, type the following Tenable account identifier:

         012615275169

     11. Select the Require External ID check box.

     12. In the text box, type the value of your external identifier.

         Important: The external identifier must follow the AWS AssumeRole API constraints: a length of 2 to 1224 characters, and only alphanumeric characters (A-Z, a-z, 0-9) and the following characters: = , . @ : / - _. Unsupported characters can cause the AssumeRole call to fail.

     13. Paste this value into the Connector text box.

     14. Make sure the Require MFA check box is cleared.

     15. Click Next: Permissions.

     16. Attach the policy you created, for example, S3ConnectorReadAccess.

     17. Continue through the wizard and review the settings.

     18. Create the role.

     19. Copy the ARN and External ID to a safe location. You need them to configure the connector.

   • If you select the Access Key & Secret Key method, complete the following configurations in your Amazon S3 console:

     1. Log in to the AWS console with the target account credentials.

     2. Navigate to IAM > Users.

     3. Select the IAM user with the appropriate permissions.

     4. Navigate to the Security Credentials tab.

     5. In the Access Keys section, click Create access key.

        The Create access key wizard appears.

     6. In the Use case section, select the Third-party service radio button.

     7. Click Next.

     8. In the Description tag value text box, type a descriptive tag for the key.

     9. Click Create access key.

     10. Copy the Access Key and Secret Key to a safe location. You need them to configure the connector.

3. After you generate the required authentication values, complete the connector configuration in Tenable Exposure Management:

   • For the ARN & External ID method, fill in the External ID, Role ARN, Region, and S3 URI path, for example, s3://bucket-name/folder/.

   • For the Access Key & Secret Key method, fill in the Access Key, Secret Key, Region, and S3 URI path, for example, s3://bucket-name/folder/.

   • (Optional) Fill in the File Pattern, for example, *.csv or claude_findings_*.csv.

   • Configure the Claude Code Security scheduled scans.

Set the Data Update Mode and Retention

To complete the data configuration:

1. In the Asset Retention box, type the number of days after which Tenable Exposure Management removes assets. The default is 460 days.

   Tip: To learn more, see How does Asset Retention work in the Tenable One Open Connector?.

2. In the Data Update Mode section, select Override data (Full Fetch). This mode treats each upload as the complete source of truth.

   Tip: With Override data (Full Fetch), any remediated finding that is absent from the latest export transitions to Fixed in Tenable Exposure Management automatically. To learn more about sync modes, see Manage Data Sources and Update Modes in Tenable One Open Connector.

3. In the Test connectivity section, click Test Connectivity. Tenable Exposure Management validates the credentials and the accessibility of the file path. You must pass this test before you can create the connector.

   Important: If you change the credentials or remap a file, you must test the connectivity again before you can save the connector.

4. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

   Tip: For more information, see Connector Scheduling.

5. Click File Preview to view the first 100 rows of the file.

6. Click Next to proceed to asset type selection and field mapping.

Map Claude Code Security Fields to Tenable Exposure Management

After you upload the file, Tenable Exposure Management displays a field mapping screen with a preview of your data. Use the following table as a reference for the recommended mappings.

Recommended Field Mapping

Claude Code Security Field	Tenable Exposure Management Field	Notes
Repository	Assets > Asset Name	The repository name becomes the asset identifier in Tenable Exposure Management.
Date created	Assets > Created Date	Timestamp of when the finding was first created.
Name	Findings > Finding Name	Short vulnerability title used as the finding identifier.
Description	Findings > Description	Full human-readable explanation from the Claude Code Security analysis.
Severity	Findings > Severity	For more information, see Severity Mapping Reference.
CWE	Findings > CWEs	Maps directly to the Tenable Exposure Management Findings > CWEs field.
Status	Findings > State	Open maps to Vulnerable, and Resolved maps to Fixed.
File path	Findings > Custom Attributes	Specific file location of the vulnerable code, stored as a custom attribute on the finding.
Line	Findings > Custom Attributes	Specific file location of the vulnerable code, stored as a custom attribute on the finding.
Finding URL	Findings > Custom Attributes	Link back to the finding in Claude Code Security, stored as a custom attribute on the finding.

Severity Mapping Reference

Claude Code Security Severity	Tenable Exposure Management Severity
Critical	Critical
High	High
Medium	Medium
Low	Low

Deduplication and Aggregation Settings

In the deduplication section, set the unique identifier to Finding Name. This setting groups all instances of the same vulnerability type into a single finding entry, even when the same weakness appears across multiple files. Without it, a weakness detected in dozens of files appears as dozens of separate findings, which inflates your Asset Exposure Score (AES).

The deep-logic analysis in Claude Code Security can surface the same root-cause weakness across many files in a large codebase. Deduplicating on Finding Name lets Tenable Exposure Management treat these as one consolidated exposure. Your team can then focus on the root cause rather than triage hundreds of identical alerts.

Tip: To learn about the expected behavior and logic rules for how Tenable Exposure Management maps source file columns, see Tenable One Open Connector Mapping .

Review and Save

To review and save the connector:

1. Review the field mapping preview to confirm that the data parses correctly.

2. Spot-check two or three rows to verify that the Repository field resolves to the expected asset name.

3. Confirm that the CWE field is populating. This field is critical for the Tenable Exposure Management risk scoring.

4. Click Save & Sync.

   Tenable Exposure Management begins processing the file. Depending on the file size, ingestion can take a few minutes. The connector appears in the Connectors list with a Connecting status during initial ingestion.

Validate the Data in Tenable Exposure Management

After the sync completes, confirm that Tenable Exposure Management ingested your Claude Code Security data correctly.

To validate the data:

1. In Tenable Exposure Management, navigate to the Assets page, and search for the repository name from your Claude Code Security export.

2. Confirm that the asset appears under the Code Repository asset type and that findings are attached to it.

3. Navigate to the Findings page, and filter by the connector name to view all imported findings.

   

4. Verify that the severity levels, CWE identifiers, and finding names match your expectations.

5. Confirm that Tenable Exposure Management consolidated multi-file instances of the same vulnerability into a single finding entry.

Common Discrepancies to Expect

• Repository appears as a new asset: If the repository name does not match an existing asset in Tenable Exposure Management, the connector creates a new Code Repository asset. This behavior is expected for first-time imports.

• File path and line in custom attributes: These fields appear in the finding's custom attributes panel, not in the main finding fields. Your team can use them for triage, but they do not factor into automated scoring.

• Resolved findings do not transition to Fixed: This transition works only when you select Override data (Full Fetch). If you use Incremental Fetch, Tenable Exposure Management does not close previously ingested findings automatically.

Keep Your Data Current

Choose the method that fits your operational needs.

Method	Cadence	How
Manual re-upload	As needed	Run a scan in Claude Code Security again, export a fresh CSV, and re-upload it through the connector.
Amazon S3 automation	Scheduled	Configure the Claude Code Security scheduled scans.

Note: Export open findings only from Claude Code Security before you upload, and select Override data (Full Fetch) as your sync mode. Any finding that is absent from the latest export (remediated in the codebase) transitions to Fixed in Tenable Exposure Management automatically. This approach keeps your code exposure posture accurate without manual cleanup.

Related topics: