Welcome to Tenable for VMware

This document provides information and steps for integrating Tenable One Vulnerability Management, Tenable Nessus, or Tenable Security Center with VMware vSphere (vCenter Server and ESXi). For more information, refer to the following product documentation:

Overview

Virtualization environments combine hypervisors, management servers, and often a very large number of virtual machines. Integrating Tenable One Vulnerability Management, Tenable Security Center, or Tenable Nessus with VMware allows you to assess these environments without maintaining hand-built target lists.

The integration collects information from vCenter servers, ESXi servers, or a combination of both. You integrate with VMware by listing VMware ESXi and/or vCenter servers as scan targets. Additional functionality becomes available when you enable credentialed scans using the VMware vCenter API and VMware ESX SOAP API credentials for the respective hosts. Together, these capabilities deliver a complete perspective of cyber exposure across the virtual environment:

  • Host enumeration — discover the ESXi hosts a vCenter server manages, including hosts that are not directly routable from the scanner.

  • Virtual machine identification — enumerate active (powered on) and inactive (powered off) virtual machines per ESXi host.

  • Software version tracking — collect ESXi and vCenter versions, and collect VMware Installation Bundles (VIBs) for each managed ESXi host.

  • Configuration insight from the management tier — run compliance/audit checks against vCenter and ESXi configuration.

The integration supports Tenable One Vulnerability Management, Tenable Nessus, and Tenable Security Center. For details on VMware's own APIs, permission models, and product versions, refer to VMware's official documentation.

How It Works

A vCenter server manages one or more ESXi hosts, and each ESXi host runs one or more virtual machines. Tenable authenticates to the management tier (vCenter) or directly to a hypervisor (ESXi) and works down that hierarchy.

  • API support: the VMware vCenter API credential supports both a SOAP API and a REST API. Tenable automatically selects which API to use based on the detected vCenter/ESXi version — the SOAP API for versions earlier than 7.0.3 and the REST API for version 7.0.3 and later.

  • Compliance scanning: compliance scanning always uses the SOAP API, regardless of version, because it collects configuration data at a level of detail the REST API does not expose.

  • Connection targets: the integration can connect directly to a single ESXi hypervisor (using the VMware ESX SOAP API credential), directly to a vCenter management server (using the VMware vCenter API credential), or to both in the same scan.

  • Credential inheritance: credentials entered for a vCenter server apply to the ESXi hosts and virtual machines that vCenter manages for the purposes of management-tier data collection — you do not need separate ESXi credentials to collect version data, VIBs, or VM inventory for vCenter-managed hosts. Standalone ESXi hosts that vCenter does not manage require their own VMware ESX SOAP API credential.

  • Host-level and guest-level data requires additional credentials: the VMware credentials do not authenticate to the underlying operating systems. To assess the vCenter appliance OS, an ESXi host OS, or a guest OS inside a virtual machine, add a separate SSH or Windows credential targeting that host.

Caution: Tenable does not support mixed-version environments where the REST API is unavailable on some hosts. For example, vCenter 7.0.3 managing ESXi servers earlier than 7.0.3 is not supported, but vCenter 8 managing ESXi 7.0.3 is supported.

API Call Pattern

This is not a per-target secret-retrieval integration. Data collection is centralized — Tenable executes collection against a single target in the scan and reuses the stored results to report on the other targets enumerated during the scan. Per scan, the REST API request pattern against vCenter is:

  1. POST /api/session — authenticate and obtain a session token (once).

  2. GET /api/vcenter/host — list the ESXi hosts vCenter manages (once).

  3. GET /api/esx/hosts/<host>/software/installed-components — retrieve installed software components (VIBs), once per managed ESXi host.

  4. GET /api/vcenter/vm?hosts=<host> — list virtual machines, once per managed ESXi host.

  5. GET /api/vcenter/vm/<vm>/guest/identity — retrieve virtual machine details, once per virtual machine. For powered-off VMs this returns 503 Service Unavailable and the integration falls back to GET /api/vcenter/vm/<vm>.

Request volume therefore scales with the number of managed hosts and virtual machines rather than with the number of scan targets. Disabling Report Active and Inactive Virtual Machines removes steps 4 and 5 and materially reduces the number of requests the scanner makes.

Caution: The standard "credentialed checks" concept does not apply here the way it does for a traditional SSH or Windows scan. Tenable authenticates to the vCenter or ESXi *API*, not to the host operating system. Unless an SSH credential is also included, Credentialed Checks: yes/no in plugin 19506 (Nessus Scan Information) does not represent successful or failed authentication to the host. Instead: yes means the integration collected VIBs for that host and no means it did not. Additionally, when scanning vCenter-managed ESXi hosts with API credentials, the vCenter host's own results always show Credentialed Checks: No — verify authentication by checking the ESXi hosts' results instead.