Configure the VMware Integration with Tenable One Vulnerability Management

Required User Role: Scan Operator, Standard User, Scan Manager, or Administrator.

Required Scan Permissions: Can Scan.

Tenable One Vulnerability Management exposes two VMware credentials in the Miscellaneous credential category:

  • VMware vCenter API — for vCenter servers and the ESXi hosts and virtual machines they manage. Supports vCenter 6.x through 8.x. Uses the REST API on 7.0.3+ and the SOAP API on earlier versions.

  • VMware ESX SOAP API — for authentication directly to targeted ESXi hosts to collect VIBs and virtual machine inventory.

Required Permissions

Within VMware, the minimum privileges depend on which API the scan uses.

Scan Type API Type Permissions Needed
vCenter credential for vulnerability scanning (7.0.3+) REST vCenter account with read permissions, plus VMware vSphere Lifecycle Manager: Image Privileges = Read
vCenter credential for vulnerability scanning (earlier than 7.0.3) SOAP vCenter admin account with read and write permissions
Standalone ESXi hosts using ESXi credentials SOAP User = Read Only (or administrator)
Compliance scan SOAP Global → Settings

To create a minimally privileged vCenter user role:

  1. Log in to vCenter.

  2. (Optional) Create a new user account. Under Administration > Access Control, select Roles, then create a new role with a name of your choice (for example, "Nessus").

  3. Select the VMware vSphere Lifecycle Manager category.

  4. Under Lifecycle Manager: Image Privileges, select Read.

  5. (Optional) To perform compliance scans, also select Global → Settings.

  6. Click Create.

  7. Go to the Inventory page and right-click the root vCenter object at the top of the left-hand tree.

  8. Click Add Permission.

  9. Select the user account and the role you created.

  10. Select Propagate to children, then click OK.

  11. Run a Tenable scan to verify the permissions work.

To create a minimally privileged ESXi user role:

  1. Log in to the ESXi server.

  2. (Optional) Create a new user account:

    1. Under Navigator, expand Host.

    2. Select Manage.

    3. Select Users.

    4. Click Add user.

  3. Under Navigator, select Host.

  4. Click Actions, then select Permissions.

  5. Select the user you want to use as a read-only user, then click Assign role.

  6. Select Propagate to all children, then click Assign role.

  7. Run a Tenable scan to verify that credentialed checks are enabled on the ESXi host.

Required User Role: Some compliance audits — specifically those with "Bare Metal" in the name — require an SSH credential, and that SSH user must be an administrator-level ESXi user. A read-only user cannot be used. This requirement applies only to the SSH user needed by Bare Metal audits.

Note: Because the VMware vCenter API credential supports both a SOAP and a REST connection method, and Tenable selects between them by version, the scan configuration below covers both. Configure the credential once. No version-specific credential selection is required.