{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":46119,"path":"security-management/vulnerability-response/tenable-data-transformref.md","title":"Data transformation for the Tenable Vulnerability Integration","bundle":null,"doc_type":null,"release":"australia","body":"\n# Data transformation for the Tenable Vulnerability Integration\n\nAfter you identify the data to import, it’s retrieved from the Tenable product and processed through a set of data sources and transforms in your instance.\n\nDuring installation, normalized severity maps are installed in the Normalized Severity Mapping module. These maps transform imported Tenable severity levels to standard severity levels for processing in your instance. For information about creating severity maps, see Create a Vulnerability Response severity map in the Vulnerability Response documentation.\n\n## Tenable.io asset import\n\nImported asset data is first loaded into the Tenable.io Asset Import \\[sn\\_vul\\_tenable\\_io\\_asset\\_import\\] Table.\n\nThe transform map writes the transformed asset records to the Discovered Items \\[sn\\_sec\\_cmn\\_src\\_ci\\] table.\n\nThe Tenable.io Asset Integration transform map is used to transform the imported assets information. Changes to this transform alter how data from the Tenable Asset import is processed. To access this transform map, navigate to **System Import Sets** &gt; **Transform Maps**. Search for `Tenable.io Asset Transform`.\n\nThe following table lists the transform map fields by integration.\n\n|Source field|Target field|Description|\n|------------|------------|-----------|\n|u\\_id|source\\_id|Tenable provides a unique id for assets and maps to the discovered item record and is used for CI lookup.|\n|u\\_ipv4s|ip\\_address|Maps the first ip value to the ip\\_address field on the discovered item record.|\n|u\\_mac\\_addresses|mac\\_address|Maps the first mac\\_address value to the mac address field on the discovered item record.|\n|u\\_fqdns|fqdn|Maps the first fqdn value to the fqdn field on the discovered item record.|\n|u\\_netbios\\_names|netbios|Maps the first netbios value to the netbios field on the discovered item record.|\n|u\\_plugin.cvss4\\_base\\_score|v4\\_base\\_score|CVSS v4 base score is mapped to the v4 base score in third-party entry record.|\n|u\\_plugin.cvss4\\_threat\\_score|v4\\_threat\\_score|CVSS v4 threat score is mapped to the v4 threat score in third-party entry record.|\n|u\\_operating\\_systems|os|Maps the first OS value to the os field on the discovered item record.|\n|\\(Prior to v14.0 Vulnerability Response and v2.2 of the Tenable Vulnerability Integration\\)u\\_last\\_scan\\_time|last\\_scan\\_date|Maps to the last\\_scan\\_date field on the discovered item record.|\n|u\\_last\\_authenticated\\_scan\\_date|last\\_auth\\_scan\\_date|Maps to the last\\_auth\\_scan\\_date field on the discovered item record.|\n|\\[script\\]|name|Maps the host name using the script's logic.|\n|u\\_tags| |The Tags are saved in sn\\_sec\\_cmn\\_host\\_tag. The mapping from tags to assets is saved in sn\\_sec\\_cmn\\_m2m\\_src\\_ci\\_tag.|\n|u\\_serial\\_number|source\\_payload|The serial number from the Tenable.io asset data is included in the source\\_payload field on the Discovered Items \\[sn\\_sec\\_cmn\\_src\\_ci\\] record. The source\\_payload stores the raw source data and is used for CI matching.|\n\nThere are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.\n\n## Tenable.io asset transform map script timing and purpose\n\n|When the script is run|Purpose|\n|----------------------|-------|\n|onStart \\(when an import set has started transformation\\)|Initializes the values in the import\\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onBefore \\(before an import set has completed transformation\\).|Updates values in the host and verify if the host exists. Based on the results, modifies the values in an import\\_set. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onComplete \\(when an import set has completed transformation\\).|Sets the values of new CIs created, and CIs that have been updated and ignored.This script is for internal use, and modifying or deleting them isn’t recommended.|\n\n## Tenable.io plugins integration\n\nThe Tenable.io plugins transform map is used to transform plugins imported from Tenable.io.\n\n**Note:** Changes to this transform map alters how data received from the Tenable plugins is processed.\n\nTo access this transform map, navigate to **System Import Sets** &gt; **Transform Maps**. Search for the Tenable.io Plugin Transform.\n\nThe tenable.io plugins payload contains all the fields in the u\\_attributes column of the sn\\_vul\\_tenable\\_io\\_plugin\\_import table. The attributes field is parsed and mapped to the third-party entry table records as listed in the following table.\n\nThe transform map writes the transformed plugin data to the Third-Party Entry \\[sn\\_vul\\_third\\_party\\_entry\\] table.\n\n<table><thead><tr><th>\n\nSource field\n\n</th><th>\n\nTarget field\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nid\n\n</td><td>\n\nid\n\n</td><td>\n\nMaps id from source and adds the TEN-prefix to it. For example, if the id received is 12345, the id in the target table is TEN-12345.\n\n</td></tr><tr><td>\n\nDescription\n\n</td><td>\n\nsummary\n\n</td><td>\n\nMaps the description of the plugin to the summary column.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nsource\n\n</td><td>\n\nThe source for imported third-party entry \\(TPE\\) is Tenable.io.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nsource\\_instance\n\n</td><td>\n\nReference to the Tenable deployment that imports this record.\n\n</td></tr><tr><td>\n\nfamily\n\n</td><td>\n\ncategory\n\n</td><td>\n\nMaps the family of plugin to the category column.\n\n</td></tr><tr><td>\n\nplugin\\_modification\\_date\n\n</td><td>\n\nlast\\_modified\n\n</td><td>\n\nMaps the plugin\\_modification\\_date to the last modified field.\n\n</td></tr><tr><td>\n\nplugin\\_publication\\_date\n\n</td><td>\n\ndate\\_published\n\n</td><td>\n\nMaps the plugin\\_publication\\_date to the published date.\n\n</td></tr><tr><td>\n\nhas\\_patch\n\n</td><td>\n\nremediation\\_type\n\n</td><td>\n\nMaps the remediation type from has\\_patch value.\n\n</td></tr><tr><td>\n\nsynopsis\n\n</td><td>\n\nthreat\n\n</td><td>\n\nMaps the threat information about this vulnerability.\n\n</td></tr><tr><td>\n\ncvss\\_base\\_\\_score\n\n</td><td>\n\nscore\n\n</td><td>\n\nMaps the Common Vulnerability Scoring System \\(CVSS\\) base score to the score column in third-party entry table.\n\n</td></tr><tr><td>\n\nsolution\n\n</td><td>\n\nsolution\n\n</td><td>\n\nMaps the solution provided by scanner to the solution column in the third-party entry table.\n\n</td></tr><tr><td>\n\nexploit\\_available\n\n</td><td>\n\nexploit\n\n</td><td>\n\nMaps the exploit\\_available provided by scanner to the exploit column in the third-party entry table.\n\n</td></tr><tr><td>\n\nvpr.score\n\n</td><td>\n\nsource\\_risk\\_score\n\n</td><td>\n\nMaps the vpr score provided by scanner to the source\\_risk\\_score in the third-party entry table.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nsource\\_risk\\_rating\n\n</td><td>\n\nMaps the vpr score to the standard risk rating based on the score ranges: -   9–10 – Critical\n-   7–9 – High\n-   4–7 – Medium\n-   0–4 - Low\n\n</td></tr><tr><td>\n\nvpr.drivers.age\\_of\\_vuln\n\n</td><td>\n\nage\\_of\\_vuln\n\n</td><td>\n\nMaps the age of the vulnerability from the scanner to the age\\_of\\_vuln column in the third-party entry table.\n\n</td></tr><tr><td>\n\nvpr.drivers.exploit\\_code\\_maturity\n\n</td><td>\n\nexploit\\_code\\_maturity\n\n</td><td>\n\nMaps exploit code maturity from the scanner to exploit\\_code\\_maturity in the third-party entry table.\n\n</td></tr><tr><td>\n\nvpr.drivers.product\\_coverage\n\n</td><td>\n\nproduct\\_coverage\n\n</td><td>\n\nMaps product coverage from the scanner to product\\_coverage in the third-party entry table.\n\n</td></tr><tr><td>\n\nvpr.drivers.threat\\_sources\\_last28\n\n</td><td>\n\nthreat\\_sources\n\n</td><td>\n\nMaps threat sources in the last 28 days from the scanner to the threat\\_sources in the third-party table.\n\n</td></tr><tr><td>\n\nvpr.drivers.threat\\_intensity\\_last28\n\n</td><td>\n\nthreat\\_intensity\n\n</td><td>\n\nMaps threat intensity in the last 28 days from the scanner to threat\\_intensity in the third-party entry table.\n\n</td></tr><tr><td>\n\nvpr.drivers.threat\\_recency\n\n</td><td>\n\nthreat\\_recency\n\n</td><td>\n\nMaps the threat recency information from scanner to threat\\_recency in the third-party entry table.\n\n</td></tr><tr><td>\n\nvpr.drivers.cvss3\\_impact\\_score\n\n</td><td>\n\nv3\\_impact\\_subscore\n\n</td><td>\n\nMaps cvss3 impact score to v3\\_impact\\_subscore column in the third-party entry table.\n\n</td></tr><tr><td>\n\ncvss\\_temporal\\_score\n\n</td><td>\n\ncvss\\_temporal\\_score\n\n</td><td>\n\nMaps the temporal score for CVSS v2.\n\n</td></tr><tr><td>\n\ncvss\\_v3\\_temporal\\_score\n\n</td><td>\n\nv3\\_temporal\\_score\n\n</td><td>\n\nMaps the temporal score for CVSS v3.\n\n</td></tr><tr><td>\n\nrisk\\_factor\n\n</td><td>\n\nsource\\_severity\n\n</td><td>\n\nMaps to the source severity in the third-party entry table.\n\n</td></tr><tr><td>\n\nname\n\n</td><td>\n\nname\n\n</td><td>\n\nMaps the name of the plugin to name in third-party entry table.\n\n</td></tr><tr><td>\n\nstig\\_severity\n\n</td><td>\n\nstig\\_severity\n\n</td><td>\n\nMaps the vpr score provided by the scanner to the source\\_risk\\_score in the third-party entry table.\n\n</td></tr><tr><td>\n\nplugin\\_type\n\n</td><td>\n\ncheck\\_type\n\n</td><td>\n\nMaps the plugin type to check\\_type in third-party entry table.\n\n</td></tr><tr><td>\n\nunsupported\\_by\\_vendor\n\n</td><td>\n\nunsupported\\_by\\_vendor\n\n</td><td>\n\nMaps the unsupported\\_by\\_vendor field to the unsupported\\_by\\_vendor column.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nexploit\\_attack\\_vector\n\n</td><td>\n\nThe exploit\\_attack\\_vector column in the third-party entry table is populated based on exploit\\_available and v3\\_attack\\_vector of columns.\n\n</td></tr><tr><td>\n\ncpe\n\n</td><td>\n\nsoftware\\_raw\n\n</td><td>\n\nMaps the raw CPE strings from the plugin payload to the software\\_raw column in the third-party entry table, stored as a comma-separated list.\n\n</td></tr><tr><td>\n\ncpe\n\n</td><td>\n\nvendor\n\n</td><td>\n\nVendor names extracted from the CPE data are mapped to the vendor column in the third-party entry table, stored as a comma-separated list.\n\n</td></tr><tr><td>\n\ncpe\n\n</td><td>\n\nproduct\n\n</td><td>\n\nProduct names extracted from the CPE data are mapped to the product column in the third-party entry table, stored as a comma-separated list.\n\n</td></tr></tbody>\n</table>In addition to the direct fields, other information is added as related lists to third-party entries.\n\n|Source field|Description|\n|------------|-----------|\n|cve|Inserts CVE-related data into the reference table \\(sn\\_vul\\_nvd\\_entry\\). If the same Common Vulnerabilities and Exposures \\(CVE\\) in the NVD entry table \\(sn\\_vul\\_nvd\\_entry\\) is found, it associates the current vulnerability to the NVD entry. The mapping can be found in sn\\_vul\\_m2m\\_entry\\_cve.|\n|bid|The list of bug traqs is added as a reference.|\n|cpe|CPE entries are added as individual related list entries on the third-party entry record, containing vendor, product, version, update, edition, and other CPE attributes.|\n|see\\_also|The list of URLs is added as a reference.|\n|xrefs|The list of X-REF is added as a reference.|\n|\\[script\\]|The list of exploits for that plugin and inserts mapping for applicable exploit framework and plugin to sn\\_vul\\_m2m\\_framework\\_vul.|\n\nThere are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.\n\n|When the script is run|Purpose|\n|----------------------|-------|\n|onStart \\(when an import set has started transformation\\)|Initializes the values in the import\\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onBefore \\(before an import set has completed transformation\\).|Updates the values in the third-party entry, and verify if the third-party entry exists. Based on the results, modifies the values in a third-party entry. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onComplete \\(when an import set has completed transformation\\).|Sets the values of new CIs created, and CIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.|\n\nThe TenableIOPluginsImportProcessor script include is called from the onBefore transform script. It takes the output from Tenable.io plugins integration and transforms it into ServiceNow AI Platform third-party vulnerability entries. Any changes to this script include may alter the transformation of Tenable.io plugins data in the third-party entry table.\n\n## Tenable.io vulnerabilities import\n\nThe Tenable.io Vulnerable Item transform map is used to transform open and fixed vulnerabilities information imported from Tenable.io.\n\n**Note:** Changes to this transform map alter how data from the Tenable Vulnerabilities Import is processed.\n\nThe same transform map is used for both the Tenable.io Fixed Vulnerabilities Integration and the Tenable.io Open Vulnerabilities Integration. To access this transform map, navigate to **System Import Sets** &gt; **Transform Maps**. Search for the `Tenable.io Vulnerable Item transform map`.\n\nThe transform map writes the transformed vulnerability data to the Vulnerable Item \\[sn\\_vul\\_vulnerable\\_item\\] table.\n\n<table><thead><tr><th>\n\nSource field\n\n</th><th>\n\nTarget field\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nu\\_asset.uuid\n\n</td><td>\n\nid\n\n</td><td>\n\nUuid is mapped to the id field of the cmdb\\_ci record.\n\n</td></tr><tr><td>\n\nu\\_asset.ipv4\n\n</td><td>\n\nip\\_address\n\n</td><td>\n\nThe ipv4 field is mapped to the ip address field of the cmdb\\_ci record.\n\n</td></tr><tr><td>\n\nu\\_asset.last\\_authenticated\\_results\n\n</td><td>\n\nlast\\_auth\\_scan\\_date\n\n</td><td>\n\nThe last authenticated scan date is mapped to the last auth scan date of the cmdb\\_ci record.\n\n</td></tr><tr><td>\n\nu\\_asset.mac\\_addess\n\n</td><td>\n\nmac\\_address\n\n</td><td>\n\nMac address is mapped to the host mac address field of the cmdb\\_ci record.\n\n</td></tr><tr><td>\n\nu\\_asset.netbios\\_name\n\n</td><td>\n\nnetbios\n\n</td><td>\n\nNetbios is mapped to the netbios field of cmdb\\_ci record.\n\n</td></tr><tr><td>\n\nu.\\_plugin.cvss3\\_base\\_score\n\n</td><td>\n\nv3\\_base\\_score\n\n</td><td>\n\nCVSS v3 base score is mapped to the v3 base score of the third-party entry record. These changes will be implemented as part of Tenable 5.2.1 Version.\n\n</td></tr><tr><td>\n\nu.\\_plugin.cvss3\\_temporal\\_score\n\n</td><td>\n\nv3\\_temporal\\_score\n\n</td><td>\n\nCVSS v3 temporal score is mapped to the v3 temporal score in the third-party entry record. These changes will be implemented as part of Tenable 5.2.1 Version.\n\n</td></tr><tr><td>\n\nu.\\_plugin.cvss\\_base\\_score\n\n</td><td>\n\nscore\n\n</td><td>\n\nCVSS base score is mapped to the score field of the third-party entry record.\n\n</td></tr><tr><td>\n\nu.\\_plugin.cvss\\_temporal\\_score\n\n</td><td>\n\ntemporal\\_score\n\n</td><td>\n\nTemporal Score is mapped to the temporal score in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_plugin.description\n\n</td><td>\n\nsummary\n\n</td><td>\n\nDescription is mapped to the summary field in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_plugin.family\n\n</td><td>\n\ncategory\n\n</td><td>\n\nMaps the family of plugin to the category column of the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_plugin.modification\\_date\n\n</td><td>\n\nlast\\_modified\n\n</td><td>\n\nLast modified date is mapped to the plugin last modified date in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_plugin.publication\\_date\n\n</td><td>\n\ndate\\_published\n\n</td><td>\n\nPublication date is mapped to the date published field of the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_plugin.risk\\_factor\n\n</td><td>\n\nsource\\_severity\n\n</td><td>\n\nRisk factor is mapped to the source\\_severity field of the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_plugin.solution\n\n</td><td>\n\nsolution\n\n</td><td>\n\nSolution is mapped to the solution field of the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_plugin.synopsis\n\n</td><td>\n\nthreat\n\n</td><td>\n\nSynopsis is mapped to the threat field of the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_severity\\_id\n\n</td><td>\n\npriority\n\n</td><td>\n\nPriority is mapped to the severity id from the payload. The default value is 5.\n\n</td></tr><tr><td>\n\nu\\_plugin.exploit\\_available\n\n</td><td>\n\nexploit\n\n</td><td>\n\nMaps the exploit\\_available provided by the scanner to the exploit column in the third-party entry table.\n\n</td></tr><tr><td>\n\nvpr.score\n\n</td><td>\n\nsource\\_risk\\_score\n\n</td><td>\n\nMaps the vpr score provided by the scanner to the source\\_risk\\_score in the third-party entry table.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nsource\\_risk\\_rating\n\n</td><td>\n\nMaps the vpr score to the standard risk rating based on the score ranges:-   9–10 – Critical\n-   7–9 – High\n-   4–7 – Medium\n-   0–4 - Low\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr.drivers.age\\_of\\_vuln\n\n</td><td>\n\nage\\_of\\_vuln\n\n</td><td>\n\nMaps the age of vulnerability from the scanner to age\\_of\\_vuln in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr.drivers.exploit\\_code\\_maturity\n\n</td><td>\n\nexploit\\_code\\_maturity\n\n</td><td>\n\nMaps exploit code maturity from the scanner to exploit\\_code\\_maturity in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr.drivers.product\\_coverage\n\n</td><td>\n\nproduct\\_coverage\n\n</td><td>\n\nMaps product coverage from the scanner to product\\_coverage in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr.drivers.threat\\_sources\\_last28\n\n</td><td>\n\nthreat\\_sources\n\n</td><td>\n\nMaps threat sources in the last 28 days from the scanner to threat\\_sources in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr.drivers.threat\\_intensity\\_last28\n\n</td><td>\n\nthreat\\_intensity\n\n</td><td>\n\nMaps threat intensity in the last 28 days from the scanner to threat\\_intensity in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr.drivers.threat\\_recency\n\n</td><td>\n\nthreat\\_recency\n\n</td><td>\n\nMaps the threat recency information from the scanner to threat\\_recency in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr.drivers.cvss3\\_impact\\_score\n\n</td><td>\n\nv3\\_impact\\_subscore\n\n</td><td>\n\nMaps CVSS3 v3 impact score to v3\\_impact\\_subscore column in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_plugin.type\n\n</td><td>\n\ncheck\\_type\n\n</td><td>\n\nMaps the plugin type to check\\_type in third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_plugin.unsupported\\_by\\_vendor\n\n</td><td>\n\nunsupported\\_by\\_vendor\n\n</td><td>\n\nMaps the unsupported\\_by\\_vendor field in plugin to the unsupported\\_by\\_vendor column.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nexploit\\_attack\\_vector\n\n</td><td>\n\nThe exploit\\_attack\\_vector column in the third-party entry table is populated based on exploit\\_available and v3\\_attack\\_vector of columns.\n\n</td></tr><tr><td>\n\nU\\_plugin.on\\_cisa\\_kev\n\n</td><td>\n\ncisa\\_exists\n\n</td><td>\n\nMaps on\\_cisa\\_kev field with cisa\\_exists in third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_plugin.family\\_id\n\n</td><td>\n\nFamily\\_id\n\n</td><td>\n\nMaps the plugin Family id to family\\_id column in third-party entry table.\n\n</td></tr><tr><td>\n\nport\n\n</td><td>\n\nport\n\n</td><td>\n\nPort is mapped to the port field of the vulnerable item record.\n\n</td></tr><tr><td>\n\nprotocol\n\n</td><td>\n\nprotocol\n\n</td><td>\n\nProtocol is mapped to the protocol field of the vulnerable item record.\n\n</td></tr><tr><td>\n\nu\\_first\\_found\n\n</td><td>\n\nfirst\\_found\n\n</td><td>\n\nFirst found is mapped to the first found field of the vulnerable item record.\n\n</td></tr><tr><td>\n\nu\\_last\\_found\n\n</td><td>\n\nlast\\_found\n\n</td><td>\n\nLast found is mapped to the last found field of the vulnerable item record.\n\n</td></tr><tr><td>\n\nu\\_state\n\n</td><td>\n\nstate\n\n</td><td>\n\nState is mapped to the State field in the vulnerable item record\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nsource\n\n</td><td>\n\nThe source of the integration is populated. The vulnerable items created from this integration have Tenable.io as the source.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nintegration\\_instance\n\n</td><td>\n\nThe integration\\_instance is the name of the instance from which the vulnerable item is imported.\n\n</td></tr><tr><td>\n\nu\\_plugin.name\n\n</td><td>\n\nname\n\n</td><td>\n\nMaps the name of the plugin to name in third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_plugin.stig\\_severity\n\n</td><td>\n\nstig\\_severity\n\n</td><td>\n\nMaps the stig severity of the plugin to stig severity column in third-party entry table\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr\\_v2.malware\\_observations\\_intensity\\_last30\n\n</td><td>\n\nvprv2\\_malware\\_observations\\_intensity\n\n</td><td>\n\nMaps the VPRv2 malware\\_observations\\_intensity\\_last30 value to the vprv2\\_malware\\_observations\\_intensity field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr\\_v2.targeted\\_industries\n\n</td><td>\n\nvprv2\\_targeted\\_industries\n\n</td><td>\n\nMaps the VPRv2 targeted\\_industries value to the vprv2\\_targeted\\_industries field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr\\_v2.targeted\\_regions\n\n</td><td>\n\nvprv2\\_targeted\\_regions\n\n</td><td>\n\nMaps the VPRv2 targeted\\_regions value to the vprv2\\_targeted\\_regions field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr\\_v2.threat\\_summary\n\n</td><td>\n\nvprv2\\_threat\\_summary\n\n</td><td>\n\nMaps the VPRv2 threat\\_summary value to the vprv2\\_threat\\_summary field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr\\_v2.remediation\n\n</td><td>\n\nvprv2\\_remediation\n\n</td><td>\n\nMaps the VPRv2 remediation value to the vprv2\\_remediation field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.d2\\_elliot\\_name\n\n</td><td>\n\nd2\\_elliot\\_name\n\n</td><td>\n\nMaps the d2\\_elliot\\_name value to the d2\\_elliot\\_name field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.canvas\\_package\n\n</td><td>\n\ncanvas\\_package\n\n</td><td>\n\nMaps the canvas\\_package value to the canvas\\_package field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin. checks\\_for\\_default\\_account\n\n</td><td>\n\nchecks\\_for\\_default\\_account\n\n</td><td>\n\nMaps the checks\\_for\\_default\\_account value to the checks\\_for\\_default\\_account field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.checks\\_for\\_malware\n\n</td><td>\n\nchecks\\_for\\_malware\n\n</td><td>\n\nMaps the checks\\_for\\_malware value to the checks\\_for\\_malware field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.exploitability\\_ease\n\n</td><td>\n\nexploitability\\_ease\n\n</td><td>\n\nMaps the exploitability\\_ease value to the exploitability\\_ease field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.exploithub\\_sku\n\n</td><td>\n\nexploithub\\_sku\n\n</td><td>\n\nMaps the exploithub\\_sku value to the exploithub\\_sku field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.in\\_the\\_news\n\n</td><td>\n\nin\\_the\\_news\n\n</td><td>\n\nMaps the in\\_the\\_news value to the in\\_the\\_news field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.metasploit\\_name\n\n</td><td>\n\nmetasploit\\_name\n\n</td><td>\n\nMaps the metasploit\\_name value to the metasploit\\_name field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.ms\\_bulletin\n\n</td><td>\n\nms\\_bulletin\n\n</td><td>\n\nMaps the ms\\_bulletin value to the ms\\_bulletin field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.usn\n\n</td><td>\n\nusn\n\n</td><td>\n\nMaps the usn value to the usn field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.version\n\n</td><td>\n\nversion\n\n</td><td>\n\nMaps the version value to the version field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vuln\\_publication\\_date\n\n</td><td>\n\nvuln\\_publication\\_date\n\n</td><td>\n\nMaps the vuln\\_publication\\_date value to the vuln\\_publication\\_date field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.workaround\n\n</td><td>\n\nworkaround\n\n</td><td>\n\nMaps the workaround value to the workaround field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.workaround\\_type\n\n</td><td>\n\nworkaround\\_type\n\n</td><td>\n\nMaps the workaround\\_type value to the workaround\\_type field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.workaround\\_published\n\n</td><td>\n\nworkaround\\_published\n\n</td><td>\n\nMaps the workaround\\_published value to the workaround\\_published field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vendor\\_unpatched\n\n</td><td>\n\nvendor\\_unpatched\n\n</td><td>\n\nMaps the vendor\\_unpatched value to the vendor\\_unpatched field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.has\\_workaround\n\n</td><td>\n\nhas\\_workaround\n\n</td><td>\n\nMaps the has\\_workaround value to the has\\_workaround field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vendor\\_severity\n\n</td><td>\n\nvendor\\_severity\n\n</td><td>\n\nMaps the vendor\\_severity value to the vendor\\_severity field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.vpr\\_v2.cve\\_id\n\n</td><td>\n\nvprv2\\_cve\\_id\n\n</td><td>\n\nMaps the VPRv2 cve\\_id value to the vprv2\\_cve\\_id field in the Tenable TPE Additional Attributes table.\n\n</td></tr><tr><td>\n\nu\\_plugin.epss\\_score\n\n</td><td>\n\nepss\\_score\n\n</td><td>\n\nMaps the epss\\_score value to the epss\\_score field in the Tenable TPE Additional Attributes table.\n\n</td></tr></tbody>\n</table>In addition to the direct fields, other information is added as related lists to third-party entries.\n\n|Source field|Description|\n|------------|-----------|\n|cve|Inserts CVE-related data into the reference table \\(sn\\_vul\\_nvd\\_entry\\). If the same CVE in the NVD entry table \\(sn\\_vul\\_nvd\\_entry\\) is found, it associates the current vulnerability to the NVD entry. The mapping can be found in sn\\_vul\\_m2m\\_entry\\_cve.|\n|bid|The list of bug traqs is added as a reference.|\n|see\\_also|The list of URLs is added as a reference.|\n|xrefs|The list of X-REF is added as a reference.|\n|\\[script\\]|The list of exploits for that plugin and Inserts mapping for applicable exploit framework and plugin to sn\\_vul\\_m2m\\_framework\\_vul.|\n\nThere are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.\n\n|When the script is run|Purpose|\n|----------------------|-------|\n|onStart \\(when an import set has started transformation\\)|TTriggers Tenable IO Vulnerabilities Processor which imports data from Tenable.io using the import set and loads each record into the CMDB CI table, the Vulnerable Items table, and the Third-party vulnerability table. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onBefore \\(before an import set has completed transformation\\).|Checks if the Third-Party Entry and Detections exist. If not, these records are created in their respective tables. isn’tThis script is for internal use, and modifying or deleting them is not recommended.|\n|onComplete \\(when an import set has completed transformation\\).|Updates the count of CIs, VITs, and Detections as imported from Tenable.io. This script is for internal use, and modifying or deleting them isn’t recommended.|\n\n## Tenable.io compliance results integration\n\nTenable.io Compliance Results transform map enables you to import secure configuration assessment findings from Tenable.io into ServiceNow. This integration leverages Tenable’s compliance export APIs to retrieve test results on assets, supporting regular differential imports to keep data up to date.\n\nImported data is first loaded into the Tenable.io Test Results Import \\[sn\\_vul\\_tenable\\_io\\_tr\\_import\\] table.\n\nTo access the transform map, navigate to **System Import Sets** &gt; **Transform Maps**. Search for Tenable.io Compliance Results Transform.\n\nThe following table lists the transform map fields by integration.\n\n|Source field|Table|Target field|Description|\n|------------|-----|------------|-----------|\n|asset\\_uuid|sn\\_vulc\\_result|sn\\_sec\\_cmn\\_src\\_ci -&gt; source\\_id|Unique identifier for the asset in Tenable.io, mapped to the corresponding CMDB CI in ServiceNow after transformation.|\n|first\\_seen|sn\\_vulc\\_result|first\\_seen|Date and time when the compliance check was first observed on the asset.|\n|last\\_seen|sn\\_vulc\\_result|last\\_seen|Date and time when the compliance check was last observed on the asset.|\n|audit\\_file|sn\\_vulc\\_policy|short\\_description|Name or identifier of the audit file used for the compliance check.|\n|check\\_id|sn\\_vulc\\_test|source\\_id|Unique identifier for the compliance check within Tenable.io.|\n|check\\_name|sn\\_vulc\\_test|short\\_description|Human-readable name of the compliance check.|\n|check\\_info|sn\\_vulc\\_test|description|Detailed information about the compliance check, including its purpose and context.|\n|expected\\_value|sn\\_vulc\\_result|expected\\_values|The value expected for the configuration setting according to the compliance policy.|\n|actual\\_value|sn\\_vulc\\_result|actual\\_values|The actual value found on the asset during the compliance check.|\n|status|sn\\_vulc\\_result|result|Result of the compliance evaluation. Possible values \\(from Tenable\\): PASSED, FAILED.|\n|see\\_also|sn\\_vulc\\_result|remediation|Additional references or links for remediation guidance.|\n|reference.framework|sn\\_vulc\\_auth\\_src|short\\_description|Compliance framework associated with the check \\(e.g., CIS, NIST\\).|\n|reference.control|sn\\_vulc\\_citation|section|Specific control or section within the compliance framework.|\n|solution|sn\\_vulc\\_test|remediation|Recommended steps to remediate the compliance failure.|\n|profile\\_name|sn\\_vulc\\_citation|section\\_name|Name of the compliance profile or benchmark applied.|\n|db\\_type|sn\\_vulc\\_technology|name|Database type or technology associated with the compliance check.|\n\n**Note:** Tenable does not provide a risk score for compliance test results. ServiceNow calculates risk scores using Configuration Compliance calculators and applies the default Medium risk value of 20 when no risk score is available. To ensure accurate prioritization, review and customize the risk calculator rules to reflect your organization’s priorities.\n\nFor more information, see [Configuration Compliance calculators and calculator rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/configuration-compliance/config-compliance-calculator-rules.md).\n\n## Tenable.sc asset import\n\nAsset data imported from Tenable.sc is first loaded into the Tenable.sc Asset Import table \\(sn\\_vul\\_tenable\\_sc\\_asset\\_import\\). The Tenable.sc Asset Integration transform map is used to transform the imported assets information. Changes to this transform alter how data from the Tenable Asset import is Processed. To access this transform map, navigate to **System Import Sets** &gt; **Transform Maps**. Search for the `Tenable.sc Asset Transform`.\n\nThe transform map writes the transformed asset records to the Discovered Items \\[sn\\_sec\\_cmn\\_src\\_ci\\] table.\n\n|Source field|Target field|Description|\n|------------|------------|-----------|\n|u\\_uuid|id|The uuid isn’t populated from the Tenable API, so the ‘u\\_uniqueness’ attribute is used to create a unique uuid field for assets and map it to the Discovered Items \\[sn\\_sec\\_cmn\\_src\\_ci\\] record.|\n|u\\_ip|source\\_payload|The IP address from the Tenable.sc API is stored in the source\\_payload field on the Discovered Items \\[sn\\_sec\\_cmn\\_src\\_ci\\] record for CI matching and lookup purposes.|\n|u\\_macaddress|mac\\_address|Maps the mac address field from the API to the address field on the Discovered Items \\[sn\\_sec\\_cmn\\_src\\_ci\\] record.|\n|u\\_dnsname|fqdn|Maps the dnsname field from the API to the fqdn field on the Discovered Items \\[sn\\_sec\\_cmn\\_src\\_ci\\] record.|\n|u\\_netbiosname|netbios|Maps the netbios field from the API to the netbios field on the Discovered Items \\[sn\\_sec\\_cmn\\_src\\_ci\\] record.|\n|u\\_oscpe|os|The OS information is extracted from the oscpe attribute in the payload and maps it to the os field on the Discovered Items \\[sn\\_sec\\_cmn\\_src\\_ci\\] record.|\n|u\\_lastauthrun|last\\_auth\\_scan\\_date|Maps the lastauthrun field from the API to the last\\_auth\\_scan\\_date field on the discovered item record.|\n|u\\_lastauthrun and u\\_lastunauthrun|last\\_scan\\_date|The lastauthrun is extracted from the Tenable API or lastunauthrun. The last\\_scan\\_date field on the discovered item record is populated based on the value that appears in the payload.|\n\nThere are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.\n\n|When the script is run|Purpose|\n|----------------------|-------|\n|onStart \\(when an import set has started transformation\\)|Initializes the values in the import\\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onBefore \\(before an import set has completed transformation\\).|Updates the values in the host and verify if the host exists. Based on the results, modifies the values in an import\\_set. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onComplete \\(when an import set has completed transformation\\).|Sets the values of new CIs created, and CIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.|\n\n## Tenable.sc plugins import\n\nPlugins data imported from Tenable.sc is first loaded into the Tenable.sc Plugins Import table \\(sn\\_vul\\_tenable\\_sc\\_plugin\\_import\\). The Tenable.sc Plugin Transform Map is used to transform the plugins information that has been imported. Changes to this transform alter how data from the Tenable Plugin import is Processed. To access this transform map, navigate to **System Import Sets** &gt; **Transform Maps**. Search for `Tenable.sc Plugin Transform Map`.\n\nThe transform map writes the transformed plugin data to the Third-Party Entry \\[sn\\_vul\\_third\\_party\\_entry\\] table.\n\n<table><thead><tr><th>\n\nSource field\n\n</th><th>\n\nTarget field\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nu\\_id\n\n</td><td>\n\nid\n\n</td><td>\n\nMaps id from source and adds the TEN-prefix. For example, if the id received is 12345, the id in the target table is TEN-12345.\n\n</td></tr><tr><td>\n\nu\\_description\n\n</td><td>\n\nsummary\n\n</td><td>\n\nMaps the description of the plugin to the summary column.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nsource\n\n</td><td>\n\nImported TPE from this integration has Tenable.sc as the source.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nsource\\_instance\n\n</td><td>\n\nReference to the Tenable deployment that imports this record.\n\n</td></tr><tr><td>\n\nu\\_family\n\n</td><td>\n\ncategory\n\n</td><td>\n\nMaps the name field in family object of plugin to the category column.\n\n</td></tr><tr><td>\n\nu\\_plugin\\_modification\\_date\n\n</td><td>\n\nlast\\_modified\n\n</td><td>\n\nMaps the plugin\\_modification\\_date to the last modified field.\n\n</td></tr><tr><td>\n\nu\\_plugin\\_publication\\_date\n\n</td><td>\n\ndate\\_published\n\n</td><td>\n\nMaps the plugin\\_publication\\_date to published date.\n\n</td></tr><tr><td>\n\nu\\_has\\_patch\n\n</td><td>\n\nRemediation\\_type\n\n</td><td>\n\nMaps the remediation type from has\\_patch value.\n\n</td></tr><tr><td>\n\nu\\_synopsis\n\n</td><td>\n\nthreat\n\n</td><td>\n\nMaps the threat information about this vulnerability.\n\n</td></tr><tr><td>\n\nu\\_cvss\\_base\\_score\n\n</td><td>\n\nscore\n\n</td><td>\n\nMaps the CVSS base score to the score column in third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_solution\n\n</td><td>\n\nsolution\n\n</td><td>\n\nMaps the solution provided by the scanner to the solution column in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_cvss\\_temporal\\_score\n\n</td><td>\n\ncvss\\_temporal\\_score\n\n</td><td>\n\nMaps the temporal score for CVSS v2.\n\n</td></tr><tr><td>\n\nu\\_cvss\\_v3\\_temporal\\_score\n\n</td><td>\n\nv3\\_temporal\\_score\n\n</td><td>\n\nMaps the temporal score for CVSS v3.\n\n</td></tr><tr><td>\n\nu\\_risk\\_factor\n\n</td><td>\n\nsource severity\n\n</td><td>\n\nMaps to the source severity in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_cvss\\_v3\\_base\\_score\n\n</td><td>\n\nv3\\_base\\_score\n\n</td><td>\n\nMaps the CVSS base score in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_exploit\\_available\n\n</td><td>\n\nexploit\n\n</td><td>\n\nMaps the exploitAvailable provided by the scanner to the exploit column in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_score\n\n</td><td>\n\nsource\\_risk\\_score\n\n</td><td>\n\nMaps VPR score from the scanner to the Source risk score in the third-party entry table.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nsource\\_risk\\_rating\n\n</td><td>\n\nMaps the vpr score to the standard risk rating based on the score ranges:-   9–10 – Critical\n-   7–9 – High\n-   4–7 – Medium\n-   0–4 - Low\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=age\\_of\\_vuln\\]\n\n</td><td>\n\nage\\_of\\_vuln\n\n</td><td>\n\nMaps the age of the vulnerability from the scanner to age\\_of\\_vuln in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=exploit\\_code\\_maturity\\]\n\n</td><td>\n\nexploit\\_code\\_maturity\n\n</td><td>\n\nMaps exploit code maturity from the scanner to exploit\\_code\\_maturity in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=product\\_coverage\\]\n\n</td><td>\n\nproduct\\_coverage\n\n</td><td>\n\nMaps product coverage from the scanner to product\\_coverage in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=”threat\\_sources\\_last\\_28\\]\n\n</td><td>\n\nthreat\\_sources\n\n</td><td>\n\nMaps threat sources in the last 28 days from scanner to threat\\_sources in the third-party table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=”threat\\_intensity\\_last\\_28\\]\n\n</td><td>\n\nthreat\\_intensity\n\n</td><td>\n\nMaps threat intensity in the last 28 days from the scanner to threat\\_intensity in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=”threat\\_recency”\\]\n\n</td><td>\n\nthreat\\_recency\n\n</td><td>\n\nMaps the threat recency information from the scanner to threat\\_recency in the third-part entry table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=cvssV3\\_impactScore\\]\n\n</td><td>\n\nv3\\_impact\\_subscore\n\n</td><td>\n\nMaps CVSS v3 impact score from the scanner to v3\\_impact\\_subscore in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_name\n\n</td><td>\n\nname\n\n</td><td>\n\nMaps the name of the plugin to the name column in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_stig\\_severity\n\n</td><td>\n\nstig\\_severity\n\n</td><td>\n\nMaps the stig\\_severity field in the plugin to stig\\_severity in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_check\\_type\n\n</td><td>\n\ncheck\\_type\n\n</td><td>\n\nMaps the check type to check\\_type in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_family.id\n\n</td><td>\n\nfamily\\_id\n\n</td><td>\n\nMaps the plugin family\\_id to family\\_id in the third-party entry table.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nexploit\\_attack\\_vector\n\n</td><td>\n\nThe exploit\\_attack\\_vector column in the third-party entry table is populated based on exploit\\_available and v3\\_attack\\_vector of columns.\n\n</td></tr><tr><td>\n\nu\\_cpe\n\n</td><td>\n\nsoftware\\_raw\n\n</td><td>\n\nMaps the raw CPE strings from the Tenable.sc plugin import to the software\\_raw column in the third-party entry table, stored as a comma-separated list.\n\n</td></tr><tr><td>\n\nu\\_cpe\n\n</td><td>\n\nvendor\n\n</td><td>\n\nVendor names extracted from the CPE data are mapped to the vendor column in the third-party entry table, stored as a comma-separated list.\n\n</td></tr><tr><td>\n\nu\\_cpe\n\n</td><td>\n\nproduct\n\n</td><td>\n\nProduct names extracted from the CPE data are mapped to the product column in the third-party entry table, stored as a comma-separated list.\n\n</td></tr></tbody>\n</table>In addition to the direct fields, other information is added as related lists to third-party entries.\n\n|Source field|Description|\n|------------|-----------|\n|u\\_cpe|The list of CPEs is added as a reference.|\n|u\\_see\\_also|The list of URLs is added as a reference.|\n|u\\_exploit\\_frameworks|The list of exploits for that plugin and inserts mapping for applicable exploit framework and plugin to sn\\_vul\\_m2m\\_framework\\_vul.|\n\nThere are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.\n\n|When the script is run|Purpose|\n|----------------------|-------|\n|onStart \\(when an import set has started transformation\\)|This transform is used to initialize the values in the import\\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onBefore \\(before an import set has completed transformation\\).|Function used to update the values in the third-party entry and verify if the third-party entry exists. Based on the results, modifies the values in a third-party entry. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onComplete \\(when an import set has completed transformation\\).|This transform is used to set the values of Plugins created and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.|\n\nThe TenableSCPluginsImportProcessor script include is called from the onBefore transform script. It takes the output from the Tenable.sc plugins integration and transforms it into ServiceNow third-party vulnerability entries. Any changes to this script include may alter the transformation of Tenable.sc plugins data in the third-party entry table.\n\n## Tenable.sc vulnerabilities import\n\nThe Tenable.sc Open Vulnerabilities transform map is used to transform imported data from the Tenable.sc Open Vulnerabilities integration, and the Tenable.sc and Fixed Vulnerabilities transform map is used to transform imported data from the Tenable.sc Fixed Vulnerabilities Integration.\n\n**Note:** Changes to these transform maps alter how data from the Fixed/Open Tenable Vulnerabilities Import is processed.\n\nTo access the Tenable.sc Open and Fixed Vulnerabilities transform maps, navigate to **Tenable Vulnerability Integration** &gt; **Administration** &gt; **Integration Instances** &gt; **Tenable.sc Fixed/Open Vulnerabilities Integration** &gt; **Data Sources** &gt; **Tenable.sc Open/Fixed Vulnerabilities** &gt; **Tranforms**.\n\nThe transform maps write the transformed vulnerability data to the Vulnerable Item \\[sn\\_vul\\_vulnerable\\_item\\] table.\n\n<table><thead><tr><th>\n\nSource field\n\n</th><th>\n\nTarget field\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nu\\_pluginID\n\n</td><td>\n\nId\n\n</td><td>\n\nUsed as the identifier for the plugin. This field is mapped to the plugin Id in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_riskfactor\n\n</td><td>\n\nsource\\_severity\n\n</td><td>\n\nThis field is mapped to source\\_severity in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_severity\n\n</td><td>\n\npriority\n\n</td><td>\n\nThe priority field is mapped with the severity. The default value is 5.\n\n</td></tr><tr><td>\n\nu\\_hasbeenmitigated\n\n</td><td>\n\nstate\n\n</td><td>\n\nHas been mitigated is mapped to the state field of vulnerability record. For the Fixed vulnerabilities integration, all the VIs are in the 'Closed' state.\n\n</td></tr><tr><td>\n\nu\\_ip\n\n</td><td>\n\nip\\_address\n\n</td><td>\n\nIp address is mapped to the host ip field of cmdb\\_ci table.\n\n</td></tr><tr><td>\n\nu\\_port\n\n</td><td>\n\nport\n\n</td><td>\n\nPort is mapped to the port field of the vulnerable item record.\n\n</td></tr><tr><td>\n\nu\\_protocol\n\n</td><td>\n\nprotocol\n\n</td><td>\n\nProtocol is mapped to the port field of the vulnerfable item record.\n\n</td></tr><tr><td>\n\nu\\_firstSeen\n\n</td><td>\n\nfirst\\_found\n\n</td><td>\n\nThe first seen value is mapped to the first found field of the VI record.\n\n</td></tr><tr><td>\n\nu\\_lastSeen\n\n</td><td>\n\nlast\\_found\n\n</td><td>\n\nThe last seen value is mapped to the last found field of the VI record.\n\n</td></tr><tr><td>\n\nu\\_exploitAvailable\n\n</td><td>\n\nexploit\n\n</td><td>\n\nExploitAvailable is mapped to the exploit field in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_synopsis\n\n</td><td>\n\nthreat\n\n</td><td>\n\nSynopsis is mapped to the threat field in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_description\n\n</td><td>\n\nsummary\n\n</td><td>\n\nDescription is mapped to the summary field in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_solution\n\n</td><td>\n\nsolution\n\n</td><td>\n\nSolution is mapped to the solution field in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_basescore\n\n</td><td>\n\nscore\n\n</td><td>\n\nBaseScore is mapped to the score field in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_temporalScore\n\n</td><td>\n\ntemporal\\_score\n\n</td><td>\n\nTemporal Score is mapped to the temporal score in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_cvssv3basescore\n\n</td><td>\n\nv3\\_base\\_score\n\n</td><td>\n\nCvssv3basescore is mapped to the v3 base score in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_cvsstemporalscore\n\n</td><td>\n\nv3\\_temporal\\_score\n\n</td><td>\n\nCvssv3temporal score is mapped to the v3 temporal score in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_pluginpubdate\n\n</td><td>\n\ndate\\_published\n\n</td><td>\n\nPlugin published date is mapped to the plugin published date in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_pluginmoddate\n\n</td><td>\n\nlast\\_modified\n\n</td><td>\n\nLast modified date is mapped to the plugin last modified date in the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_dnsname\n\n</td><td>\n\nfqdn\n\n</td><td>\n\nDnsName is mapped to the FQDN field of the cmdb\\_ci record.\n\n</td></tr><tr><td>\n\nu\\_macaddress\n\n</td><td>\n\nmac\\_address\n\n</td><td>\n\nMacAddress is mapped to the mac\\_address field of the cmdb\\_ci record.\n\n</td></tr><tr><td>\n\nu\\_netbiosName\n\n</td><td>\n\nnetbios\n\n</td><td>\n\nNetbiosName is mapped to the NETBIOS field of the cmdb\\_ci record.\n\n</td></tr><tr><td>\n\nu\\_ip\n\n</td><td>\n\nip\n\n</td><td>\n\nIP is mapped to the IP field of cmdb\\_ci record.\n\n</td></tr><tr><td>\n\nhostUniqueness\n\n</td><td>\n\nuuid\n\n</td><td>\n\nHost uniqueness is not mapped to any field but is used to determine uuid for the host.\n\n</td></tr><tr><td>\n\nu\\_family\n\n</td><td>\n\ncategory\n\n</td><td>\n\nMaps the name field in the family object of the plugin to the category column of third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_plugintext\n\n</td><td>\n\nproof\n\n</td><td>\n\nPlugin text is mapped to proof in tpe record.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nsource\n\n</td><td>\n\nThe source of the integration is populated. The vulnerable items created from this integration have Tenable.sc as the source.\n\n</td></tr><tr><td>\n\n\\[script\\}\n\n</td><td>\n\nintegration\\_instance\n\n</td><td>\n\nThe integration\\_instance is the name of the instance from which the vulnerable item is imported.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_score\n\n</td><td>\n\nsource\\_risk\\_score\n\n</td><td>\n\nMaps VPR score from the scanner to the Source risk score in the third-party entry table.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nsource\\_risk\\_rating\n\n</td><td>\n\nMaps the vpr score to the standard risk rating based on the score ranges:-   9 - 10 – Critical\n-   7 – 9 – High\n-   4–7 – Medium\n-   0–4 - Low\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=age\\_of\\_vuln\\]\n\n</td><td>\n\nage\\_of\\_vuln\n\n</td><td>\n\nMaps the age of the vulnerability from the scanner to age\\_of\\_vuln in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=exploit\\_code\\_maturity\\]\n\n</td><td>\n\nexploit\\_code\\_maturity\n\n</td><td>\n\nMaps exploit code maturity from the scanner to exploit\\_code\\_maturity in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=product\\_coverage\\]\n\n</td><td>\n\nproduct\\_coverage\n\n</td><td>\n\nMaps product coverage from the scanner to product\\_coverage in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=”threat\\_sources\\_last\\_28\\]\n\n</td><td>\n\nthreat\\_sources\n\n</td><td>\n\nMaps threat sources in the last 28 days from the scanner to threat\\_sources in the third-party table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=”threat\\_intensity\\_last\\_28\\]\n\n</td><td>\n\nthreat\\_intensity\n\n</td><td>\n\nMaps threat intensity in the last 28 days from the scanner to threat\\_intensity in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=”threat\\_recency”\\]\n\n</td><td>\n\nthreat\\_recency\n\n</td><td>\n\nMaps the threat recency information from the scanner to threat\\_recency in the third-part entry table.\n\n</td></tr><tr><td>\n\nu\\_vpr\\_context\\[id=cvssV3\\_impactScore\\]\n\n</td><td>\n\nv3\\_impact\\_subscore\n\n</td><td>\n\nMaps CVSS v3 impact score from the scanner to v3\\_impact\\_subscore in the third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_pluginname\n\n</td><td>\n\nname\n\n</td><td>\n\nMaps the name of the plugin to name column in third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_stigseverity\n\n</td><td>\n\nstig\\_severity\n\n</td><td>\n\nMaps the stig\\_severity field in the plugin to stig\\_severity in third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_checktype\n\n</td><td>\n\ncheck\\_type\n\n</td><td>\n\nMaps the check type to check\\_type in third-party entry table.\n\n</td></tr><tr><td>\n\nu\\_family.id\n\n</td><td>\n\nfamily\\_id\n\n</td><td>\n\nMaps the plugin family.id to family\\_id in the third-party entry table.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nexploit\\_attack\\_vector\n\n</td><td>\n\nThe exploit\\_attack\\_vector column in the third\\_party\\_entry table is populated based on exploit\\_available and v3\\_attack\\_vector of columns.\n\n</td></tr></tbody>\n</table>|Source field|Description|\n|------------|-----------|\n|u\\_cve|Inserts CVE-related data into the reference table \\(sn\\_vul\\_nvd\\_entry\\). If the same CVE in the NVD entry table \\(sn\\_vul\\_nvd\\_entry\\) is found, it associates the current vulnerability to the NVD entry. The mapping is found in sn\\_vul\\_m2m\\_entry\\_cve.|\n|u\\_bid|The list of bug traqs is added as a reference.|\n|u\\_cpe|The list of CPEs is added as a reference.|\n|u\\_seealso|The list of URLs is added as a reference.|\n|u\\_xrefs|The list of X-REFs is added as a reference.|\n|u\\_exploitframeworks|The list of exploits for that plugin and Inserts mapping for applicable exploit framework and plugin to sn\\_vul\\_m2m\\_framework\\_vul.|\n\nThere are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.\n\n|When the script is run|Purpose|\n|----------------------|-------|\n|onStart \\(when an import set has started transformation\\)|This transform is used to initialize the values in the import\\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onBefore \\(before an import set has completed transformation\\).|Function used to update the values in the vulnerability and verify if the vulnerability exists. Based on the results, modifies the values in a vulnerable items table. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onComplete \\(when an import set has completed transformation\\).|This transform is used to set the values of new VIs created, and VIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.|\n\n## Tenable.cs container asset import\n\nImported asset data is first loaded into the Tenable.cs Container Asset Import \\[sn\\_vul\\_tenable\\_cs\\_container\\_asset\\_import\\] Table.\n\nThe Tenable.cs Container Asset transform map is used to transform the imported assets information. Changes to this transform alter how data from the Tenable.cs Container Asset import is processed. To access this transform map, navigate to System Import Sets &gt; Transform Maps. Search for Tenable.cs Container Asset Transform.\n\nThe following tables lists the transform map fields by integration.\n\n|Source field|Target field|Description|\n|------------|------------|-----------|\n|u\\_digest|Image\\_id|Tenable provides a unique digest for the container assets and maps to the discovered container image and docker image record and is used for CI lookup.|\n|u\\_digest|Image\\_digest|Tenable provides a unique digest for the container assets and maps to the discovered container image and docker image record and is used for CI lookup.|\n|u\\_name|name|Maps to the name field of the docker image record.|\n|u\\_repositoryuri|name|Maps to the container repository record|\n|u\\_repositoryuri|repo|Maps to the discovered container image record.|\n|u\\_virtualmachines|host\\_list|Maps to the discovered container image record|\n|u\\_labels|Image\\_labels|Maps the labels assigned to the container image to the image\\_labels field of the discovered container image record.|\n|u\\_clusters|image\\_cluster|Maps to the discovered container image record|\n|u\\_imagetags|tags|Maps to the discovered container image record|\n|u\\_cloudprovider|cloud\\_providers|Maps to the discovered container image record|\n|u\\_accountid|cloud\\_account\\_ids|Maps to the discovered container image record|\n|u\\_region|cloud\\_regions|Maps to the discovered container image record|\n|u\\_operatingsystem|os|Maps to the discovered container image record|\n|u\\_scantime|last\\_scan\\_date|Maps to the discovered container image record|\n\nThere are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.\n\n<table id=\"table_alv_sh5_cfc\"><thead><tr><th>\n\nWhen the script is run\n\n</th><th>\n\nPurpose\n\n</th></tr></thead><tbody><tr><td>\n\nonStart \\(when an import set has started transformation\\)\n\n</td><td>\n\nThis transform is used to initialize the values in the import\\_set for the integration process. This script is for internal use, and modifying or deleting them isn’t recommended.\n\n</td></tr><tr><td>\n\nonBefore \\(before an import set has completed transformation\\).\n\n</td><td>\n\nA function used to update values in the host and verify if the host exists. Based on the results, modifies the values in an import\\_set. This script is for internal use, and modifying or deleting them isn’t recommended.\n\n</td></tr><tr><td>\n\nonComplete \\(when an import set has completed transformation\\).\n\n</td><td>\n\nThis transform is used to set the values of new CIs created, and CIs that have been updated and ignored. This script is for internal use, and modifying or deleting them isn’t recommended.\n\n</td></tr></tbody>\n</table>## Tenable.cs container vulnerability import\n\nImported container vulnerability data is first loaded into the Tenable.cs Container Vulnerability Import \\[sn\\_vul\\_tenable\\_cs\\_container\\_vuln\\_import\\] Table.\n\nThe Tenable.cs Container Vuln transform map is used to transform the imported container vulnerability information. Changes to this transform alter how data from the Tenable.cs Container Vulnerability Import is processed. To access this transform map, navigate to **System Import Sets** &gt; **Transform Maps**. Search for Tenable.cs Container Vuln Transform.\n\nThe following tables list the transform map fields by integration.\n\n|Source field|Target field|Description|\n|------------|------------|-----------|\n|\\[script\\]|Image\\_id|Digest is extracted from the Resource.Id field from the API and mapped to image\\_id field of discovered container image and docker image record.|\n|\\[script\\]|Image\\_digest|Digest is extracted from the Resource.Id field from the API and mapped to image\\_digest field of discovered container image and docker image record.|\n|\\[script\\]|name|Repository information is extracted from name field and mapped to docker image and container repository record.|\n|\\[script\\]|repo|Repository information is extracted from name field and mapped to discover container image record.|\n|u\\_resource.Labels|Image\\_labels|Maps to the discovered container image record|\n|u\\_resource.CloudProvider|cloud\\_providers|Maps to the discovered container image record|\n|u\\_resource. AccountId|cloud\\_account\\_ids|Maps to the discovered container image record|\n|u\\_resource.Region|cloud\\_regions|Maps to the discovered container image record|\n|u\\_vulnerability. Id|id|Maps id from source and adds the TEN- prefix. For example, if the id received is 12345, the id in the third-party entry table is TEN-12345.|\n|u\\_vulnerability. Description Id|summaryid|Maps to the third-party entry record. or CVE record.|\n|u\\_vulnerability.Severity|v4\\_base\\_severity|Maps to the third-party entry record.|\n|u\\_vulnerability.VprScore|source\\_risk\\_score|Maps to the third-party entry record.|\n|u\\_vulnerability.VprSeverity|source\\_severity|Maps to the third-party entry record.|\n|u\\_vulnerability.AttackVector|v4\\_attack\\_vector|Maps to the third-party entry record.|\n|u\\_vulnerability.ExploitMaturity|v4\\_exploit\\_maturity|Maps to the third-party entry record.|\n|\\[script\\]|source|he source for imported TPE is Tenable.cs.|\n|u\\_vulnerability.Id|name|Maps to the vulnerability references record|\n|u\\_vulnerability. Links|url|Maps to the vulnerability references record|\n| |vulnerability|Reference of TPE or CVE in vulnerability references record|\n|u\\_software.Name|name|Maps to the container image package record|\n|u\\_software.Version|version|Maps to the container image package record|\n|u\\_software.Type|package\\_type|Maps to the container image package record|\n|u\\_softwarepaths|path|Maps to the container image package record|\n|u\\_resolved|status|Maps to the container image finding record|\n|u\\_firstscantime|first\\_found|Maps to the container image finding record|\n|u\\_resource.ScanTime|last\\_found|Maps to the container image finding record|\n|u\\_vulnerability.Description|proof|Maps to the container image finding record|\n|u\\_resolved|state|Maps to the container vulnerable item record|\n|u\\_firstscantime|first\\_found|Maps to the container vulnerable item record|\n|u\\_resource.ScanTime|last\\_found|Maps to the container vulnerable item record|\n|\\[script\\]|source|The source for container vulnerable item record is Tenable.cs.|\n\nThere are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.\n\n|When the script is run|Purpose|\n|----------------------|-------|\n|onStart \\(when an import set has started transformation\\)|Triggers TenableCS Container Vulnerabilities Processor which imports data from Tenable.cs using the import set and loads each record into the CMDB CI table, the Vulnerable Item table, Third-party Vulnerability Entry table, Vulnerability Reference table, Container Image Package, Container Image Finding, and Container Vulnerable Item. Modifying or deleting isn’t recommended.|\n|onBefore \\(before an import set has completed transformation\\)|Checks if the third-party Entry and Image Findings exist. If not, these records are created in their respective tables. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onComplete \\(when an import set has completed transformation\\)|Updates the count of CIs, VITs, and Findings as imported from Tenable.cs. This script is for internal use, and modifying or deleting them isn’t recommended.|\n\n## Tenable.cs compute vulnerability import\n\nImported host vulnerability data is first loaded into the Tenable.cs Compute Vulnerability Import \\[sn\\_vul\\_tenable\\_cs\\_compute\\_vuln\\_import\\] Table.\n\nThe Tenable.cs Compute Vuln transform map is used to transform the imported host vulnerability information. Changes to this transform alter how data from the Tenable.cs Compute Vulnerability Import is processed. To access this transform map, navigate to **System Import Sets** &gt; **System Import Sets**. Search for Tenable.cs Compute Vuln Transform.\n\nThe following table lists the transform map fields by integration.\n\n<table id=\"table_hzw_4rv_cfc\"><thead><tr><th>\n\nSource field\n\n</th><th>\n\nTarget field\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nu\\_resource.Id\n\n</td><td>\n\nobject\\_id\n\n</td><td>\n\nMaps to the CMDB Ci record.\n\n</td></tr><tr><td>\n\nu\\_resource.Name\n\n</td><td>\n\nname\n\n</td><td>\n\nMaps to the CMDB Ci record.\n\n</td></tr><tr><td>\n\n \n\n</td><td>\n\nasset\\_category\n\n</td><td>\n\nCloud is mapped as Asset Category in discovered item record.\n\n</td></tr><tr><td>\n\nU\\_resource.CloudProvider\n\n</td><td>\n\ncloud\\_service\\_provider\n\n</td><td>\n\nMaps to the discovered item record\n\n</td></tr><tr><td>\n\nu\\_resource.Region\n\n</td><td>\n\ncloud\\_region\n\n</td><td>\n\nMaps to the discovered item record\n\n</td></tr><tr><td>\n\nu\\_resource.AccountId\n\n</td><td>\n\ncloud\\_account\n\n</td><td>\n\nMaps to the discovered item record\n\n</td></tr><tr><td>\n\nu\\_resource. CloudProvider\n\n</td><td>\n\ncloud\\_resource\\_type\n\n</td><td>\n\nMaps to the discovered item record\n\n</td></tr><tr><td>\n\nu\\_resource.Id\n\n</td><td>\n\nresource\\_id\n\n</td><td>\n\nMaps to the discovered item record\n\n</td></tr><tr><td>\n\nu\\_resource.Name\n\n</td><td>\n\nresource\\_name\n\n</td><td>\n\nMaps to the discovered item record\n\n</td></tr><tr><td>\n\nu\\_vulnerability.Id\n\n</td><td>\n\nid\n\n</td><td>\n\nMaps id from source and adds the TEN- prefix. For example, if the id received is 12345, the id in the third-party entry table is TEN-12345.\n\n Maps id to CVEs as well.\n\n</td></tr><tr><td>\n\nu\\_vulnerability. Description\n\n</td><td>\n\nsummary\n\n</td><td>\n\nMaps to the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_vulnerability.Severity\n\n</td><td>\n\nv4\\_base\\_severity\n\n</td><td>\n\nMaps to the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_vulnerability.VprScore\n\n</td><td>\n\nsource\\_risk\\_score\n\n</td><td>\n\nMaps to the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_vulnerability.VprSeverity\n\n</td><td>\n\nsource\\_severity\n\n</td><td>\n\nMaps to the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_vulnerability.AttackVector\n\n</td><td>\n\nv4\\_attack\\_vector\n\n</td><td>\n\nMaps to the third-party entry record.\n\n</td></tr><tr><td>\n\nu\\_vulnerability.ExploitMaturity\n\n</td><td>\n\nv4\\_exploit\\_maturity\n\n</td><td>\n\nMaps to the third-party entry record.\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nsource\n\n</td><td>\n\nThe source for imported TPE is Tenable.cs.\n\n</td></tr><tr><td>\n\nu\\_vulnerability.Id\n\n</td><td>\n\nname\n\n</td><td>\n\nMaps to the vulnerability references record\n\n</td></tr><tr><td>\n\nu\\_vulnerability.Links\n\n</td><td>\n\nurl\n\n</td><td>\n\nMaps to the vulnerability references record\n\n</td></tr><tr><td>\n\n \n\n</td><td>\n\nvulnerability\n\n</td><td>\n\nReference of TPE or CVE in vulnerability references record\n\n</td></tr><tr><td>\n\nu\\_resolved\n\n</td><td>\n\nstatus\n\n</td><td>\n\nMaps to the vulnerable item detection record\n\n</td></tr><tr><td>\n\nu\\_firstscantime\n\n</td><td>\n\nfirst\\_found\n\n</td><td>\n\nMaps to the vulnerable item detection record\n\n</td></tr><tr><td>\n\nu\\_resource.ScanTime\n\n</td><td>\n\nlast\\_found\n\n</td><td>\n\nMaps to the vulnerable item detection record\n\n</td></tr><tr><td>\n\nu\\_softwarepaths\n\n</td><td>\n\nproof\n\n</td><td>\n\nMaps to the vulnerable item detection record\n\n</td></tr><tr><td>\n\nu\\_softwareresolutionversions\n\n</td><td>\n\nsolution\\_summary\n\n</td><td>\n\nMaps to the vulnerable item detection record\n\n</td></tr><tr><td>\n\nu\\_resolved\n\n</td><td>\n\nstate\n\n</td><td>\n\nMaps to the vulnerable item record\n\n</td></tr><tr><td>\n\nu\\_firstscantime\n\n</td><td>\n\nfirst\\_found\n\n</td><td>\n\nMaps to the vulnerable item record\n\n</td></tr><tr><td>\n\nu\\_resource.ScanTime\n\n</td><td>\n\nlast\\_found\n\n</td><td>\n\nMaps to the vulnerable item record\n\n</td></tr><tr><td>\n\n\\[script\\]\n\n</td><td>\n\nsource\n\n</td><td>\n\nThe source for vulnerable item record is Tenable.cs.\n\n</td></tr></tbody>\n</table>There are three transform scripts executed during the transformation process. The following table lists when each script runs and its purpose.\n\n|When the script is run|Purpose|\n|----------------------|-------|\n|onStart \\(when an import set has started transformation\\)|Triggers Tenable CS Compute Vulnerabilities Processor which imports data from Tenable.cs using the import set and loads each record into the CMDB CI table, the Vulnerable Items table, and the Third-party vulnerability table. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onBefore \\(before an import set has completed transformation\\).|Checks if the third-party entry and detections exist. If not, these records are created in their respective tables. This script is for internal use, and modifying or deleting them isn’t recommended.|\n|onComplete \\(when an import set has completed transformation\\).|Updates the count of CIs, VITs, and detections as imported from Tenable.cs. This script is for internal use, and modifying or deleting them isn’t recommended.|\n\n|Source field|Target field|Description|\n|------------|------------|-----------|\n|u\\_digest|Image\\_id|A unique digest provided by Tenable for the container assets. It maps to the discovered container image and docker image record and is used for CI lookup.|\n|u\\_name|name|Maps to the name field of the docker image record.|\n\n## Standardized logic for calculating source\\_risk\\_score and source\\_risk\\_rating\n\nAs part of the standardized data-transformation, the Tenable integration uses a centralized business rule to populate both **source\\_risk\\_score** and **source\\_risk\\_rating**.\n\nDuring the integration run, if either **vprv1\\_risk\\_score** or **vprv2\\_risk\\_score** is updated, the system automatically recalculates and populates **source\\_risk\\_score** and **source\\_risk\\_rating** using the values from the **vprv2\\_risk\\_score** and **vprv1\\_risk\\_score** fields in the Third-Party Entry table.\n\n-   If **vprv2\\_risk\\_score** is present, it takes precedence over**vprv1\\_risk\\_score**.\n-   If the **vprv1\\_risk\\_score** and **vprv2\\_risk\\_score** are empty, then source\\_risk\\_score will not be changed.\n-   **source\\_risk\\_rating** is derived from the finalized **source\\_risk\\_score** using the standardized thresholds:\n    -   9-10 → **Critical**\n    -   7-9 → **High**\n    -   4-7 → **Medium**\n    -   0-4 → **Low**\n    -   NaN → **None**\n\n**Note:** The before changes will be implemented as part of Tenable 5.2.1 Version.\n\n"}}