Tenable One Open Connector FAQ

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

The following are frequently asked questions regarding the Tenable One Open Connector.

What happens when I switch between static file uploads and automated S3 pulls?

Tenable Exposure Management maintains your Data Update Mode (Full vs. Incremental) when transitioning between data sources. Tenable Exposure Management applies the following logic:

• Switching to Automated (S3): If you transition from a manual upload to an automated pull, the platform retains your sync mode. If you were using Incremental Fetch, the first S3 pull uses the previous manual "Full" sync as its baseline. Switching to automated Full Fetch triggers a Confirm Data Override warning.
• Switching to Static (Manual): If you switch back to manual uploads while in Incremental Fetch mode, your file must follow the existing incremental criteria established by the previous S3 sync.

What should I expect when switching between Full Fetch and Incremental Fetch modes?

Changing your sync mode triggers specific behaviors to protect data integrity:

• Switching from Full to Incremental: To establish a reliable starting point, Tenable Exposure Management performs the very next synchronization as a Full Fetch baseline. Subsequent syncs process only incremental changes.
• Switching from Incremental to Full: A Confirm Data Override alert appears. This mode replaces the entire dataset, which may reset historical trend lines and remediation metrics.

What happens if I change the unique identifiers or mappings while using Incremental Fetch?

Modifying uniqueness criteria or field mappings is incompatible with Incremental Fetch. These identifiers allow Tenable Exposure Management to recognize existing records. Changing them would cause data duplication. To save these changes, you must select the Run next upload as "Override File (Full Fetch)" check box to reset your data baseline.

What happens if I change the connector credentials?

Updating credentials (such as AWS Access Keys or Role ARNs) retains your Data Update Mode but re-initiates the configuration flow. You must complete the connectivity test, preview, mapping, and uniqueness steps again to ensure the new credentials can access the data.

What happens if my sync fails with an "Incompatible File Content" error?

This error occurs if the structure of your new file does not align with your selected Incremental Fetch mode. For example, selecting a findings-based delta mode for an asset-only file will cause a failure. You must update either the file content or the sync mode to proceed.

What happens if an asset appears in the first file but is missing from later uploads?

The behavior depends on your Data Update Mode and selected reconciliation mode:

• Full Fetch: The platform archives the missing asset immediately.
• Incremental Fetch (Additive Only): The asset remains active subject to your Asset Retention policy.
• Incremental Fetch (Strict Inventory): The platform archives the missing asset immediately to maintain a clean inventory.

How does Asset Retention work in the Tenable One Open Connector?

Tenable Exposure Management automatically removes assets once they exceed the Asset Retention period. The default is 460 days. You can customize this value in the connector settings.

Source File State	Expected Retention Behavior
Source file includes a mapped Asset Last Observed At attribute.	The asset remains in the platform as long as the provided date, plus the retention days, is greater than the current date.
Source file does not include a timestamp.	The platform uses the time of the file upload or S3 pull as the Asset Last Observed At value. The retention period starts from that ingestion date.