Adding tenable.io connector to Microsoft Sentinel

Taiwo Oyewo 21

I am trying to connect tenable io connector to my Sentinel instance. I have followed the steps and provided the access key and other information requested. I can see in my resource group that everything was successfully deployed with app insight and function app and storage but when I go back to the connector it shows that it is disconnected and the common logs are still greyed out. Please what am I doing wrongly?

Taiwo Oyewo 21 Reputation points

2024-03-09T15:00:59.4266667+00:00
Givary-MSFT 28,321 Reputation points Microsoft Employee

2024-04-01T12:08:40.56+00:00

@Taiwo Oyewo Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

1 answer

JamesTran-MSFT 36,376 Reputation points Microsoft Employee

2024-03-11T21:44:30.2+00:00
@Taiwo Oyewo

Thank you for your post!

Based off the Tenable.io connector for Microsoft Sentinel documentation, I can see you met the pre-requisites, retrieved both the TenableAccessKey and TenableSecretKey, and successfully deployed your Azure resources per the Vendor installation instructions.

After your Azure Functions app is deployed, can you make sure that you fully configured your Function app's Application settings to complete the set-up?

Additional Links:

Tenable.io - Vendor installation instructions

Tenable.io Vulnerability Management (using Azure Functions) connector for Microsoft Sentinel

Use Azure Functions to connect Microsoft Sentinel to your data source

I hope this helps!

If you're still having issues even after configuring your Functions App, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Please sign in to rate this answer.
Taiwo Oyewo 21 Reputation points

2024-03-11T22:14:26.0066667+00:00

Thank you for your kind response. However, I already have all the function app application settings set up. I can see the API is being called

JamesTran-MSFT 36,376 Reputation points Microsoft Employee

2024-03-11T23:22:24.05+00:00

@Taiwo Oyewo

Thank you for following up on this!

To hopefully help point you in the right direction and troubleshoot your issue from the Microsoft Sentinel side, can you also check that:

The Workspace ID and Key are correct within your Function's app settings.

Microsoft Sentinel -> Data Connectors -> Open the Connector Page for Tenable.io

The logAnalyticsUri, is correct depending on your cloud environment.

For example:

Public cloud - leave the value empty.

Azure Gov US cloud environment, specify the value in the following format: https://<WorkspaceID>.ods.opinsights.azure.us

Since I can't reproduce your issue on my end due to not having access to a TenableAccessKey or TenableSecretKey , and from your screenshots, it looks like you set everything up correctly per the documentation.

If you're still having issues after re-confirming all the values within your Function app's Application settings, I'd recommend reaching out to Tenable as they'd be the primary support contact for this data connector.

Additional Links:

Find the support contact for a data connector

Tenable Technical Support

Tenable Community

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

JamesTran-MSFT 36,376 Reputation points Microsoft Employee

2024-03-12T18:32:06.6533333+00:00

@Taiwo Oyewo I just wanted to check in and see if you had any other questions?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Sign in to comment