Welcome to Tenable for Nutanix
This document provides information and steps for integrating Tenable One Vulnerability Management, Tenable Nessus, or Tenable Security Center with Nutanix Prism Central. For more information, refer to the following product documentation:
Overview
Virtualization environments combine hypervisors, management servers, and often a large number of virtual machines (VMs), which makes them complex to assess. Integrating Tenable One Vulnerability Management, Tenable Security Center, or Tenable Nessus with Nutanix Prism Central lets you scan these environments for a complete view of your cyber exposure.
During a scan, Tenable connects to the Nutanix Prism Central API to enumerate the clusters, hypervisor hosts, and virtual machines that Prism Central manages, and to collect host software versions. This information supports patch management and the detection of known vulnerabilities in Nutanix Acropolis Operating System (AOS) and Acropolis Hypervisor (AHV). For more information about Nutanix Prism Central, refer to Nutanix documentation.
How It Works
Note: Nutanix Prism Central is the management server for one or more Nutanix clusters and the hypervisor hosts and virtual machines that run on them. By default, Tenable authenticates to the v4 Nutanix Prism Central API, which is available in Prism Central version pc.2024.3 and later. For Nutanix Prism Central versions earlier than pc.2024.3, Tenable uses the v3 API.
-
You configure a Nutanix Prism Central credential in the Miscellaneous category of credential types in Tenable One Vulnerability Management, Tenable Nessus, or Tenable Security Center.
-
Tenable sends the credential policy to the linked scanner. The scanner connects to the Prism Central API host and authenticates with the values in the credential.
-
The integration connects only to the Nutanix Prism Central API. It does not connect directly to individual hypervisor hosts, and it does not authenticate to the hosts or virtual machines it discovers.
-
The Nutanix Prism Central credential does not apply to the hosts and virtual machines that Nutanix Prism Central manages. To assess the operating systems of discovered virtual machines, add SSH or Windows credentials to the scan.
API call pattern
Tenable gathers data about clusters, hypervisor hosts, and virtual machines from three Prism Central API endpoints. The endpoint set depends on the API version that Tenable uses.
| Data | API v4 (pc.2024.3 and later) | API v3 (earlier than pc.2024.3) |
|---|---|---|
| Clusters | GET /api/clustermgmt/v4.0/config/clusters | POST /api/nutanix/v3/clusters/list |
| Hypervisor hosts | GET /api/clustermgmt/v4.0/config/hosts | POST /api/nutanix/v3/hosts/list |
| Virtual machines | GET /api/vmm/v4.0/ahv/config/vms | POST /api/nutanix/v3/vms/list |
| File servers | GET /api/files/v4.1/config/file-servers | N/A |
Data collection is centralized
Tenable executes collection against a single Nutanix Prism Central target and reuses the stored results to report on the clusters, hosts, and virtual machines it manages. Authentication uses HTTP Basic Authentication credentials included with each request.
For each scan, the request pattern is:
-
List clusters: Retrieve all clusters managed by Nutanix Prism Central.
-
List hypervisor hosts: Retrieve all managed AHV/ESXi hosts.
-
List virtual machines: Retrieve all managed VMs (only when Discover Virtual Machines is enabled).
-
List file servers: Retrieve all Nutanix file servers and their versions (used for vulnerability assessment of the Files product).
All three API requests may require pagination, so Tenable issues additional requests until Tenable retrieves all pages. Request volume scales with the total number of clusters, hosts, and virtual machines managed by Prism Central.
Note: Disabling Discover Virtual Machines removes step 3 and reduces the number of requests the scanner makes.
Caution: The standard credentialed checks concept does not apply to this integration. Tenable authenticates only to the Prism Central API, not to the hosts it discovers. Therefore, the Credentialed checks value in Nessus Scan Information (19506) are only YES for hypervisor (AHV) nodes and the cluster (AOS) IP. Use the plugins described in Plugin families and plugins instead.