Manage Data Sources and Update Modes in Tenable One Open Connector
The Tenable One Open Connector supports two data source options, Static and Automatic. Each source supports two sync modes: Full Fetch and Incremental Fetch. With these modes, you can optimize for data hygiene or resource efficiency. The connector maintains a reliable source of truth for your asset and finding lifecycles.
Data Sources
The Tenable One Open Connector supports two data source options:
- Static: You manually upload a data file for each sync. You control when each sync runs and which file the connector ingests.
- Automatic: Tenable Exposure Management pulls the data file automatically from your Amazon S3 bucket. You do not upload files manually.
Sync Modes
Each data source supports two sync modes. The sync mode controls how Tenable Exposure Management reconciles each new file with the data it already stores for the connector.
Full Fetch
In Full Fetch mode, each sync fetches all data from the source and overrides the existing connector data. Tenable Exposure Management treats every file as the complete source of truth and applies the following logic:
- Creates any asset or finding that the file adds.
- Archives any asset that the previous file included but the current file omits.
- Marks as Fixed any finding that the previous file included but the current file omits.
Use Full Fetch when each file contains your complete asset and finding inventory. This mode keeps your data clean but uses more bandwidth and resources.
Incremental Fetch
In Incremental Fetch mode, each sync fetches only the assets and findings that changed since the previous sync. This mode is faster and uses fewer resources than Full Fetch.
Note: The initial sync always runs as a Full Fetch, even when you select Incremental Fetch. Tenable Exposure Management must ingest the complete file once to establish a baseline. Incremental Fetch applies to every sync after the first.
The way Tenable Exposure Management handles records that are missing from an incremental file depends on the file content and the incremental sync mode. Tenable Exposure Management applies Stable Inventory Mode automatically for an asset inventory file, and you cannot select it manually. For a file that contains both assets and findings, you select one of the other three modes. The following table describes each mode:
| Incremental Sync Mode | Behavior | Missing Asset | Missing Finding |
|---|---|---|---|
| Stable Inventory Mode (default for asset inventory files; not available for manual selection) | Keeps your existing inventory stable. Use this mode when your files contain only new or updated assets. If an asset is missing from your new file, Tenable Exposure Management keeps it in your inventory. This prevents "flickering" data when your source export is incomplete. | Kept | Not applicable |
| Additive Only Mode | Tenable Exposure Management keeps all existing assets and findings active. It processes only new or updated records from the file. | Kept | Kept |
| Strict Inventory Mode | Tenable Exposure Management archives assets that are missing from the file to keep your inventory clean. It retains findings for assets that remain active. | Archived | Kept |
| Dynamic Remediation Mode | If an asset appears in the file but one of its findings does not, Tenable Exposure Management marks that finding as Fixed. If an asset does not appear in the file, Tenable Exposure Management keeps the asset and its findings. | Kept | Fixed when the asset appears in the file, otherwise kept |
Data Source and Sync Mode Combinations
The data source and sync mode combine into four configurations. The following table describes how Tenable Exposure Management processes data in each one.
| Configuration | Description |
|---|---|
| Static (Full) | You manually upload a complete file for each sync. Tenable Exposure Management overrides all existing connector data with the file content. It archives missing assets and marks missing findings as Fixed. |
| Automatic (Full) | Tenable Exposure Management pulls a complete file from your Amazon S3 bucket for each sync and overrides all existing connector data. The reconciliation logic matches Static (Full). Only the source is automated. |
| Static (Incremental) | You manually upload files that contain only changed assets and findings. The first upload runs as a Full Fetch to set the baseline. Each later upload updates only the changed records. The selected incremental sync mode controls how Tenable Exposure Management handles missing records. |
| Automatic (Incremental) | Tenable Exposure Management pulls incremental files from your Amazon S3 bucket. The logic matches Static (Incremental). Only the source is automated. |
Change the Data Source or Update Mode
You can modify your connector setup to adapt to changes in your data pipeline or security requirements. You can switch between data sources (Automatic and Static), update authentication details, toggle between Full Fetch and Incremental Fetch modes, or switch data update modes.
Note: You cannot change the Asset Type after the initial connector setup. Each connector instance supports only one asset type. To ingest data for a different asset type, create a new connector instance.
- On the Connectors page, click the Tenable One Open Connector you want to edit.
- In the connector setup page, select the new data source (Static or Automatic) or update your Data Update Mode.
- Update your credentials, upload a new file, or adjust the configuration settings as required.
- In the Test connectivity section, click Test Connectivity. Tenable Exposure Management must validate the new setup or credentials before you can proceed.
- Click Next to review your file preview and mapping settings. Tenable Exposure Management provides mapping suggestions based on your previously processed data.
- Review and address any synchronization alerts. For example, you may need to select a reconciliation mode or approve a manual baseline reset to prevent data duplication.
- Confirm your settings and click Save & Sync.
Switching from Static (Manual) to Automatic (S3)
Transitioning from manual uploads to automated cloud pulls generally maintains your previously configured sync mode. The following table describes the logic impact when changing your data source to S3.
| From | To | Logic Impact | UI Response |
|---|---|---|---|
| Static (Full) | Automatic (Full) | No change in synchronization logic occurs; only the data source is automated. | None. |
| Static (Incremental) | Automatic (Full) | Tenable Exposure Management switches to a more "destructive" mode to ensure a fresh baseline from the automated source. | Confirm Data Override alert: Notifies you that replacing records may reset historical trends and remediation metrics. |
| Static (Full) | Automatic (Incremental) | Since a "Full" baseline already exists from the static upload, the first S3 pull can proceed as an Incremental sync. | None. |
| Static (Incremental) | Automatic (Incremental) | No logic change occurs; Tenable Exposure Management continues incremental updates but pulls from S3 instead of a manual upload. | None. |
Switching from Automatic (S3) to Static (Manual)
Switching back to manual uploads requires you to ensure the uploaded file follows the existing sync criteria to prevent data duplication. The table below outlines the transition logic.
| From | To | Logic Impact | UI Response |
|---|---|---|---|
| Automatic (Full) | Static (Full) | This is a direct transition; you become responsible for manual "Full" uploads. | None. |
| Automatic (Incremental) | Static (Full) | Tenable Exposure Management performs an intentional shift to re-baseline the data manually. | Confirm Data Override modal: Acknowledges that the manual upload will replace existing asset records and findings. |
| Automatic (Full) | Static (Incremental) | This transition uses the previous S3 "Full" sync as the baseline for the manual upload to maintain efficiency. | None. |
| Automatic (Incremental) | Static (Incremental) | Tenable Exposure Management continues incremental logic; you must ensure the manual file follows the existing Incremental criteria. | None. |
Switching between Full and Incremental Sync Modes
Changing the sync mode without altering the data source requires Tenable Exposure Management to identify the last successfully processed file to establish a structure. This table covers transitions within the same source.
| From | To | Logic Impact | UI Response |
|---|---|---|---|
| Full Fetch | Incremental Fetch | Tenable Exposure Management identifies the last successful sync structure. Asset-only files default to Stable Inventory Mode. Files with assets and findings require user input. | Incremental Sync Mode Selection: A pop-up appears to choose between Additive Only Mode, Dynamic Remediation Mode, or Strict Inventory Mode. |
| Incremental Fetch | Full Fetch | The next synchronization overrides all existing asset records and findings for the connector to establish a new baseline. | Confirm Data Override alert: Warns that this action may reset historical trend lines and remediation metrics for those assets. |
Technical Constraints and Conflicts
To ensure data integrity, Tenable Exposure Management enforces the following constraints during synchronization transitions:
- Uniqueness criteria changes: Changing mapping or unique IDs is incompatible with Incremental Fetch. You must select the Run next upload as "Override File (Full Fetch)" check box during the edit flow to avoid creating duplicate records.
- Incompatible file content: If the file structure is not compatible with the selected Incremental mode, the sync fails. Tenable Exposure Management displays an error message requesting an update to the file or sync mode.
- Credential changes: Updating credentials re-initiates the configuration flow. While the Incremental selection is retained, you must re-verify the mapping and uniqueness criteria to ensure proper access.