> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/integrate-and-administer/integrations/asset-discovery/tenable.md).

# Tenable OT Security

Connect Tenable OT Security, through its REST API on your on-premise appliance, to pull discovered OT assets into Dispel as devices — with their known vulnerabilities — mapped to a Wicket and refreshe

## Overview

The Tenable integration lets Dispel pull the OT assets that Tenable has discovered on your network and bring them in as Dispel devices, along with the known vulnerabilities Tenable has found on them. You connect to your Tenable appliance once, map it to a Dispel facility and Wicket, and Dispel imports the matching devices and keeps them current on a recurring sync.

Tenable is an on-premise asset-discovery integration. Specifically, Dispel integrates with Tenable OT Security (formerly Tenable.ot) through its REST API.

Because a Tenable appliance holds a single flat asset inventory with no native site or location concept, Dispel treats it as one site that you map to a single Wicket — there is no per-site list to work through.

#### What Dispel imports

* Discovered OT assets (name, IP address, MAC address, make/model, operating system, firmware version, serial number, device type) as Dispel devices.
* Known vulnerabilities for each asset, drawn from Tenable's plugin findings, with the CVE and CVSS severity where available. Informational-severity plugins (for example, "Open Port") are filtered out so the counts match Tenable's own OT dashboard.
* Extra device intelligence surfaced on the device: end-of-life status, SNMP details, and — for chassis-based controllers — a backplane view showing which modules share the rack.

{% hint style="info" %}
**Where to find it.** Sign in as an organization administrator and open **Settings → Integrations**. Tenable appears in the **Asset Discovery / Network Visibility** section. Click **Connect** on the Tenable card to begin.
{% endhint %}

## Before you begin

You'll need the following from your Tenable console:

* An API key — generate one under **Local Settings → User Management → API Keys**. Tenable issues two values: a **Key ID** (a short identifier) and the **API Key** secret itself.
* The **Appliance URL** of your Tenable appliance — for example `https://tenable-ot.example.com`.
* If your appliance uses a self-signed TLS certificate, be ready to enable the self-signed option during setup.

{% hint style="warning" %}
**Allowlist Dispel's IP.** When you open the connection form, Dispel shows a **Whitelist IP** value. Add this address to your network firewall allowlist so Dispel can reach the on-premise appliance.
{% endhint %}

## Connecting Tenable

1. Go to **Settings → Integrations** and click **Connect** on the Tenable card.
2. Optionally set a **Display Name** to tell this integration apart from others (you can connect more than one appliance).
3. Fill in the connection fields:

| Field                              | Type       | Notes                                                                                                         |
| ---------------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------- |
| **Appliance URL**                  | Config     | The base URL of your Tenable appliance, e.g. `https://tenable-ot.example.com`.                                |
| **Allow Self-Signed Certificates** | Config     | Toggle on if your appliance uses a self-signed TLS certificate.                                               |
| **Key ID**                         | Credential | The identifier shown next to your API key in Tenable. It identifies the key — it is not used to authenticate. |
| **API Key**                        | Credential | The API key secret. Stored encrypted and never shown again.                                                   |

4. Click **Test Connection** to confirm Dispel can authenticate against the appliance. Fix any reported error before saving.
5. Click **Save**. Dispel saves the integration and immediately runs the initial sync.

{% hint style="info" %}
**Key ID vs. API Key.** Dispel authenticates using the API key secret only. The Key ID is stored purely for reference — so you can tell which key is in use when it's time to rotate it.
{% endhint %}

{% hint style="info" %}
**Your credentials are encrypted.** The API key is encrypted at rest and is never displayed again after you save. When editing later, leave credential fields blank to keep the stored values.
{% endhint %}

## Mapping the appliance to a Wicket

Once the initial sync finishes, open the integration to find the **Site Mapping** section. Tenable appears as a single site representing your appliance.

> Map each vendor site to a Dispel facility and Wicket. Devices from mapped sites will be synced into Dispel.

1. Pick a **Facility**.
2. Pick a **Wicket**. If the facility has only one Wicket, Dispel selects it for you.
3. Click **Save Mappings & Import**.

Dispel imports the appliance's assets into the mapped Wicket — you'll see progress move from waiting, to fetching, to syncing, to complete — and then reports how many devices were imported. Imported devices appear in the mapped Wicket alongside any devices you've added manually, with their vulnerabilities attached.

## Keeping your inventory current

* Dispel re-syncs automatically on a recurring schedule, so newly discovered assets, changed details, and updated vulnerabilities are picked up without any action from you.
* To pull the latest inventory immediately, open the integration and choose **Refresh**.
* To change connection details or rotate credentials, edit the integration and use **Save & Sync**. Leave credential fields blank to keep the current API key.

Vulnerability findings refresh on every sync, and findings that Tenable no longer reports drop off automatically.

## Connection status

Each integration shows a status so you always know where it stands:

| Status              | Meaning                                                 |
| ------------------- | ------------------------------------------------------- |
| **Not Initialized** | Saved, but the first sync hasn't run yet.               |
| **Initializing**    | Running the first sync.                                 |
| **Ready**           | Connected and synced; the mapping is applied.           |
| **Needs Refresh**   | New vendor data is available; run a refresh to pull it. |
| **Refreshing**      | A sync is in progress.                                  |
| **Pending Changes** | Mapping changes are saved but not yet applied.          |
| **Applying**        | Importing devices for your saved mapping.               |
| **Failed**          | The last operation failed — see the error guidance.     |

A separate **health badge** (Connected, Degraded, Unreachable) reflects whether Dispel can currently reach the Tenable appliance.

## Troubleshooting

If a sync or test connection fails, Dispel classifies the error and suggests a fix:

| Error                     | What it usually means and how to fix it                                                                                                                                                 |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Authentication Failed** | The API key was rejected. Confirm the key is still active in Tenable (**Local Settings → User Management → API Keys**) and that you pasted the **API Key** secret — not the **Key ID**. |
| **Endpoint Unreachable**  | Dispel couldn't reach the appliance. Verify the Appliance URL and that Dispel's IP is allowlisted in your firewall.                                                                     |
| **Certificate Error**     | The appliance presented an untrusted TLS certificate. If it uses a self-signed certificate, enable **Allow Self-Signed Certificates** in the connection settings.                       |
| **Connection Timed Out**  | The appliance took too long to respond — often network latency or a firewall rule between Dispel and your network.                                                                      |
| **Configuration Error**   | The URL looks wrong or the API isn't reachable at that address. Re-check the Appliance URL.                                                                                             |

## Frequently asked questions

<details>

<summary>Which Tenable product does this connect to?</summary>

Tenable OT Security (formerly Tenable.ot) — the on-premise appliance that discovers and assesses OT assets. This is not the Tenable Vulnerability Management (Tenable.io) cloud service.

</details>

<details>

<summary>What's the difference between the Key ID and the API Key?</summary>

When you generate an API key, Tenable issues two values: a Key ID (a short identifier) and the API Key secret. Dispel authenticates with the secret only; the Key ID is stored for reference so you know which key is in use when rotating it.

</details>

<details>

<summary>Why don't the vulnerability counts match Tenable's raw plugin count?</summary>

Dispel filters out informational-severity plugins (for example, "Open Port") so the numbers line up with the vulnerability counts shown on Tenable's own OT dashboard, rather than the larger total that includes purely informational results.

</details>

<details>

<summary>Can I connect more than one Tenable appliance?</summary>

Yes. Tenable supports multiple integrations, so you can connect several appliances side by side. Give each a distinct **Display Name** to tell them apart.

</details>

<details>

<summary>Does connecting Tenable change anything on my appliance?</summary>

No. Dispel only reads from Tenable's API. It never creates, modifies, or deletes data on the Tenable side.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.dispel.com/integrate-and-administer/integrations/asset-discovery/tenable.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.