Automated Pull from Cloud Storage in Tenable One Open Connector

To configure the automated S3 ingestion:

1. In the Data pulling configuration section, select Automated Pull from Cloud Storage (S3).
2. In the Authentication method section, select the relevant authentication method: ARN & External ID or Access Key & Secret Key.
   • If you select the ARN & External ID method, complete the following configurations in your S3 console:
     

     1. Navigate to IAM > Policies > Create Policy > Visual Editor.

     2. From the Service drop-down, select S3.

     3. From the Actions allowed drop-down, select the following permissions:

        • ListBucket

        • GetObject

     4. In the Resources section:

        1. For ListBucket, add ARN for the bucket: arn:aws:s3:::YOUR_BUCKET_NAME

        2. For GetObject, add ARN for the objects: arn:aws:s3:::YOUR_BUCKET_NAME/*

     5. Click Next.

     6. On the Review policy page, type a Name (e.g., S3ConnectorReadAccess) and Description for the policy.

     7. Review the Summary.

     8. Click Create Policy.

     9. Navigate to IAM > Roles > Create Role > AWS account.

     10. In the Account ID field, paste the following Tenable account ID:

         012615275169

     11. Select the Require External ID check box.

     12. In the text box, type the value of your external ID.

         Important: External ID must follow AWS AssumeRole API constraints:

         • Length: 2–1224 characters

         • Allowed characters: alphanumeric (A-Z, a-z, 0-9) and the following: = , . @ : / - _

         Using unsupported characters may cause the AssumeRole call to fail.

     13. Paste this value into the Connector text box.

     14. Ensure the Require MFA check box is deselected.

     15. Click Next: Permissions.

     16. Attach the policy you created (e.g., S3ConnectorReadAccess).

     17. Continue through the wizard and review the settings.

     18. Create the role.

     19. Copy the ARN and External ID to a safe location. You need them to configure the connector.

   • If you select the Access Key & Secret Key method, complete the following configurations in your S3 console:
     

     1. Login with the target account credentials to the AWS platform.

     2. Navigate to IAM > Users.

     3. Select the user with the appropriate permissions.

        

     4. Navigate to the Security Credentials tab.

     5. In the Access Keys section, click Create access key.

        The Create access key wizard appears.

     6. In the Use case section, select the Third-party service radio button.

     7. Click Next.

     8. In the Description tag value text box, type a descriptive tag for the key.

     9. Click Create access key.

     10. Copy the Access Key and Secret Key to a safe location. You need them to configure the connector.

3. After generating the required authentication values, complete the configuration of the connector in Tenable Exposure Management.
   • For the ARN & External ID method: Fill in the External ID, Role ARN, Region, and S3 URI path (e.g., s3://bucket-name/folder/).
     • (Optional): Fill in the File Pattern (e.g., *.csv or assets_*.xls).
   • For the Access Key & Secret Key method: Fill in the Access Key, Secret Key, Region, and S3 URI path (e.g., s3://bucket-name/folder/).
     • (Optional): Fill in the File Pattern (e.g., *.csv or assets_*.xls).

4. In the Asset Retention box, type the number of days after which Tenable Exposure Management removes assets. The default is 460 days. Tenable Exposure Management determines the removal date based on the data available in your uploaded file.

   Tip: To learn more, see How Asset Retention works for the Tenable One Open Connector.

5. In the Data Update Mode section, select how the connector should process future data syncs:

   • Override data (Full Fetch): Every new file sync fully overrides the data ingested from the previous sync. Use this mode to replace all existing asset records and findings for the connector on each sync.

   • Update data (Incremental Fetch): Every new file sync updates the existing set of data in Tenable Exposure Management after an initial full sync. This mode optimizes for bandwidth by processing only the assets and findings updated since the previous sync.

     For files containing both assets and findings, you must select one of the following reconciliation modes:

     • Additive Only Mode: Keeps all existing assets and findings active in the platform. Tenable Exposure Management only processes new or updated data; no records are removed or archived.
     • Strict Inventory Mode: Archives assets missing from the file to maintain a clean inventory. Existing findings for these missing assets remain until the asset is fully decommissioned.
     • Dynamic Remediation Mode: Automatically marks findings missing from the file as Resolved if the asset is still detected. Assets not mentioned in the file remain active to preserve historical context.

     Note: If your file contains only asset data (inventory-only), the platform defaults to Stable Inventory Mode. This mode keeps existing assets active even if they are missing from the new file, and the Incremental Sync Mode Selection window does not appear.

     Tip: You can switch between data update modes at any time by editing the connector configuration. For more information, see Manage Data Sources and Update Modes in Tenable One Open Connector.

6. In the Test connectivity section, click Test Connectivity. Tenable Exposure Management validates the credentials and accessibility of the file path. You must pass this test before you can create the connector.

   If successful, Tenable Exposure Management displays the name of the file pulled by auto-discovery (for example, Recent File: abc.csv 2026-01-27).

   Important: If you change the credentials or remap a file, you must test the connectivity before you can save the connector.

7. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

   Tip: For more information, see Connector Scheduling.
8. Click File Preview to view the first 100 rows of the file.
9. Click Next to proceed to asset type selection and field mapping.

10. From the Asset type drop-down box, select the category that matches your data (e.g., Devices).

11. Click Next.

    Note: This selection defines the tenable mapping attributes available in the next step.

    The mapping page appears.

12. Define how the connector interprets and aligns your source data with Tenable Exposure Management standardized data model:

    Note: This mapping process ensures that Tenable Exposure Management normalizes and uses the asset and finding data you import.

    1. Review the auto-suggested mappings and consider to manually adjust the mapping as needed. You must map the mandatory fields (like Asset Name or Finding ID) to continue.

    2. (Optional) Use the + button to add new mappings.

       TIP: To learn about the expected behavior and logic rules of how Tenable Exposure Management maps the source file columns, see .

    3. Click Save and continue.

       The Data Aggregation and Uniqueness page appears.

       Note: Tenable One Open Connector lets you define custom uniqueness criteria. You can tailor the Data Aggregation and Uniqueness settings to ensure Tenable Exposure Management correctly identifies your specific assets and findings as new records or updates.

13. On the Data Aggregation and Uniqueness page, fill in the answers for the required questions:

    Question	Description
    Which fields uniquely identify a single asset?	Define what constitutes a unique device or resource in your file (e.g., using Asset ID alone, or a composite key like Asset Name + IP Address). This ensures that Tenable Exposure Management consolidates multiple rows referencing the same device into a single asset record for deduplication.
    Which fields uniquely define a weakness?	Define which fields determines a unique security issue (the 'vulnerability'). This ensures a correct aggregation of all instances of that weakness across your entire asset inventory.
    Which fields uniquely define a finding?	A finding is the combination of a unique asset and a unique weakness, plus any extra context. This key defines the single instance of a detection (e.g., CVE-123 on Server-A, Port 80).This field is automatically pre-populated with the unique key fields selected in Question 1 (Asset) and Question 2 (Weakness). You can then add fields like Port or Protocol to make the Finding more granular. If you want to change the foundational keys, you must change your answers to Question 1 or 2 first.
    Which Tenable Exposure Category best describes the data in this file?	Tenable Exposure Management calculates the Asset Exposure Score (AES) using specialized risk models designed for Vulnerability Management (VM), Cloud Security Posture (CSP), Web Applications or Operational Technologies (OT). Select the category that best fits your data to ensure Tenable Exposure Management calculates risk accurately according to the established scoring methodology. Note: If your data does not align with one of the available categories,Tenable Exposure Management cannot calculate the specific AES for those assets.

14. Click Save.

    The main setup page appears.

15. If you selected Incremental Fetch and mapped findings, the Incremental Sync Mode Selection window appears. Select a mode for handling missing data:

    • Additive Only Mode: Keep all existing assets and findings active in the platform. Only new or updated data from your file will be processed. No data will be removed or archived.
    • Dynamic Remediation Mode: Findings missing from the file will be automatically marked as "Resolved." Assets not mentioned in the file will remain active to preserve their historical context.
    • Strict Inventory Mode: Assets missing from the file will be archived to keep your inventory clean. Existing findings for those assets will be retained until the asset is fully decommissioned.
    Note: If an asset-only file is used, Tenable Exposure Management defaults to Stable Inventory Mode and the pop-up does not appear.

16. Click Create & Sync (or Save & Sync).

17. (Optional) On the main connector setup page, view the Connector Logs to review any changes.