---
title: "Tenable One Vulnerability Management"
url: "https://axoflow.com/docs/axoflow/data-sources/appliances/tenable/vulnerability-management/"
description: "Collect the audit log of Tenable One Vulnerability Management with a Cloud Connector, and look up the labels Axoflow adds."
last_modified: "2026-10-26T13:51:02+01:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/llms.txt).

# Tenable One Vulnerability Management

Collect the audit log of Tenable One Vulnerability Management with a Cloud Connector, and look up the labels Axoflow adds.

Tenable One Vulnerability Management:
Cloud-based vulnerability management platform whose audit log API records user and configuration activity.

Axoflow can collect the audit log of your [Tenable One Vulnerability Management](https://www.tenable.com/products/vulnerability-management) deployment with an Axoflow Cloud Connector. At a high level, the process looks like this:

- [Create a **Connector Rule**](https://axoflow.com/docs/axoflow/data-sources/appliances/tenable/vulnerability-management/index.md#create-connector-rule) on the AxoRouter that deploys an Axoflow Cloud Connector and collects the data from the Tenable audit log API. Axoflow Cloud Connector is a simple container that runs on an AxoRouter instance.
- Configure a [Flow](https://axoflow.com/docs/axoflow/data-management/index.md) on AxoConsole that processes and routes the collected data to your [destination](https://axoflow.com/docs/axoflow/destinations/index.md) (for example, Splunk or another SIEM).

![How Axoflow collects data from Tenable One Vulnerability Management with Axoflow Cloud Connector and AxoRouter](https://axoflow.com/docs/axoflow/data-sources/appliances/tenable/vulnerability-management/architecture-same-host.svg)

## Prerequisites

- An AxoRouter instance that:

  - Was provisioned with [**Enable Cloudconnectors**](https://axoflow.com/docs/axoflow/provisioning/axorouter/linux/advanced-options/index.md#cloudconnectors-enable) turned on.
  - Can reach the Tenable Vulnerability Management API (by default, cloud.tenable.com) on TCP port 443. Adjust your firewall rules and the access rules of the data source as needed.
  - You know the IP address the AxoRouter. To find it:

    1. Open the AxoConsole.
    2. Select the **Routers** or the **Topology** page.
    3. Select on AxoRouter instance that is going to receive the logs.
    4. Check the **Networks > Address** field.
- A Tenable Vulnerability Management account with an active subscription.
- An [API key pair](https://developer.tenable.com/docs/api-access) (an access key and a secret key) generated for a user who can read the audit log of your container.

> **Note:**
> The Tenable audit log API retains the events of the last 30 days only. Axoflow Cloud Connector cannot collect events that are older than that.

## Configure Axoflow Cloud Connector on AxoRouter

To collect data from Tenable One Vulnerability Management, complete the following steps.

1. Select **Routers > Connector Rules > Add Connector Rule**. (Alternatively, you can select **Add Connector > Add a connector rule** on the **Connectors** page of an AxoRouter host.)

   ![Connector rules list](https://axoflow.com/docs/axoflow/img/data-management/connector-rules/connector-rules-list_hu_6f335a0660dd40e6.webp)
2. Select **Vulnerability Management** (Tenable).
3. Enter a name for the connector rule into the **Connector rule name** field.

   ![Generic connector rule parameters](https://axoflow.com/docs/axoflow/img/connector-rule-generic_hu_32a9c886e16162f3.webp)
4. (Optional) Add labels to the connector rule. You will be able to use these labels in [Flow Processing steps](https://axoflow.com/docs/axoflow/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps. For details about the message schema and the related connector-specific fields, see the [`meta.connector` object](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.connector).
5. Set the **Router selector** for the connector rule. The selector determines which AxoRouter instances get a connector from this connector rule.

   **CAUTION:**

   Each connector rule for Tenable One Vulnerability Management must match exactly one AxoRouter. Use the `name` or `guid` AQL selector to make sure it matches only one AxoRouter. Otherwise several Axoflow Cloud Connector instances collect the same data, and Axoflow receives every message multiple times.

   ![Router selectors](https://axoflow.com/docs/axoflow/img/data-management/connector-rules/connector-rules-router-selector_hu_4e7807cc9a0d1c54.webp)

   You can use any labels and metadata of the AxoRouter hosts in the Router selectors, for example, the hostname of the AxoRouter, or any [custom labels](https://axoflow.com/docs/axoflow/onboard-hosts/hosts/add-host-metadata/index.md).

   - If you leave the router selector empty, it matches every AxoRouter instance.
   - To select only a specific AxoRouter instance, set the `name` field to the name of the instance as selector. For example, `name = my-axorouter`.
   - If you set multiple fields in the selector, the selector will match only AxoRouter instances that match all elements of the selector. (There in an AND relationship between the fields.)
6. (Optional) Enter a **Suffix** for the connector rule. AxoConsole uses the suffix in the name of the connector instances that it creates on the AxoRouter hosts. The name of the connector instance follows the `<name-of-AxoRouter>-<suffix>` schema. For example, if the name of a matching AxoRouter instance is `axorouter-1`, and the suffix of the rule is `custom`, the name of the connector on that AxoRouter is `axorouter-1-custom`.

   If the **Suffix** field is empty, AxoConsole uses the name of the connector rule instead. For example, if the name of the connector rule is `otlp-1`, the name of the connector is `axorouter-1-otlp-1`.
7. (Optional) Enter a description for the rule.
8. Configure how Axoflow Cloud Connector reaches the Tenable audit log API.

   - **Access key** and **Secret key**: The [Tenable API key pair](https://developer.tenable.com/docs/authorization) that Axoflow Cloud Connector uses to authenticate.
   - **Endpoint**: (Optional) The base URL of the Tenable Vulnerability Management API. Default value: `https://cloud.tenable.com`
9. (Optional) Select **More options** to change the [advanced options](https://axoflow.com/docs/axoflow/data-sources/appliances/tenable/vulnerability-management/index.md#advanced-options) of the connector, for example, how often it polls the API.
10. Select **Add**. The Axoflow Cloud Connector starts polling the Tenable audit log API and forwarding the collected events to the AxoRouter instance.
11. Verify that the Axoflow Cloud Connector is running.

    1. Select **Routers**, then select the AxoRouter you added the Axoflow Cloud Connector to.
    2. Select **Services** and check that **axoflow-cloudconnector.service** is running without errors.
12. [Create a Flow](https://axoflow.com/docs/axoflow/data-management/flows/index.md) to route the data from the AxoRouter instance to a destination. You can use the [Labels](https://axoflow.com/docs/axoflow/data-sources/appliances/tenable/vulnerability-management/index.md#labels) of this source to select its messages.

## Advanced options

Select **More options** on the connector rule to set the following options.

- **Poll interval**: How often Axoflow Cloud Connector queries the audit log API. Default value: `5m`
- **Page size**: The number of events that Axoflow Cloud Connector requests per API call. Minimum value: `1`. Maximum value: `5000`. Default value: `1000`
- **Max records per poll**: Caps the number of events that a single poll collects. Axoflow Cloud Connector collects the remaining events during the following polls. Minimum value: `1`. Default value: `5000`
- **Initial lookback**: How far back Axoflow Cloud Connector collects events when no checkpoint is stored yet. Set it to `0` to collect only the events that arrive after the connector starts. Default value: `24h`

  Axoflow Cloud Connector checkpoints the position of the poll cursor, so after a restart it resumes the collection where the last poll stopped. The **Initial lookback** option applies only when there is no stored checkpoint. Since the Tenable audit log retains 30 days of events, setting a longer period doesn’t collect more data.

## Labels

Axoflow automatically adds the following labels to data collected from this source:

| Analytics label | Message field | Value |
| --- | --- | --- |
| `vendor` | [`meta.vendor`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.vendor) | `tenable` |
| `product` | [`meta.product`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.product) | `vulnerability-management` |
| `service` | [`meta.service.name`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.service.name) | `audit` |

You can use the labels as:

- labels in **Customize Graph** on the [Analytics page](https://axoflow.com/docs/axoflow/metrics/analytics/index.md),
- in the **Filter labels** field during [log tapping](https://axoflow.com/docs/axoflow/onboard-hosts/log-tapping/index.md).

You can use the message fields

- in [Flow Processing steps](https://axoflow.com/docs/axoflow/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps,
- in AQL expressions in the search bars.