Workflows in the Vulnerability Management module

This topic describes the high-level process workflow and other workflows in the Vulnerability Management – BMC-SA-Vulnerability_Scan_Import module. 

For understanding the Vulnerability Management use case, see Vulnerability-Management-module. 

Process Tenable Scan Files

The Process Tenable Scan Files workflow in the BMC-SA-Vulnerability_Scan_Import module is extensible and contains rules, schedules, and configuration. The high-level process workflow internally calls other sub-processes to perform the end-to-end process of downloading the scan file from Tenable and importing it in BMC Helix Automation Console or TrueSight Automation Console. Output data for each sub-process is considered as input for the subsequent process. 

The following figure shows the workflow in the TrueSight Orchestration Development Studio. 

Process tenable scan.png

The following table describes the internal sub-processes that are invoked when the Process Tenable Scan Files workflow is run and the input and output elements for the workflows: 

Process name

Input

Output

Description

Process Tenable Scan Files

  • vendor name
  • start time in days
  • vendor connection data
  • target connection data
  • target version
  • status
  • message

Invokes the sub-processes.

Read Input and Configuration Data

  • vendor name
  • start time in days
  • vendor connection data
  • target connection data
  • target version
  • adapter configuration
  • vendor connection details
  • tsac connection details
  • start time in days
  • download directory
  • tsac version

This workflow extracts configuration information specific to this module, which includes Web Service connection details required to log in to Tenable and Automation Console version, adapter details, and so on.

Tenable Login

  • adapter name
  • url
  • user name
  • password
  • request timeout
  • authentication token
  • tns session id
  • status
  • status code
  • error message

This workflow logs in to the Tenable server by using the authentication token and TNS Session ID required for subsequent calls to the Tenable server.

Login

  • adapter name
  • url
  • user name
  • password
  • authentication method
  • role
  • tsac version
  • request timeout
  • authentication token
  • status
  • status code
  • error message

This workflow logs in to Automation Console by using the authentication token required for the subsequent calls to Automation Console.

Generate Bearer Using Refresh Token

  • adapter name
  • url
  • refresh token
  • tenant id
  • request timeout
  • bearer token
  • status
  • status code
  • error message

This workflow provides the Bearer Access token using the refresh token (authentication token) and tenant ID.
This is applicable for TrueSight Automation Console version 20.08 only.

Get Scan Result IDs

  • adapter name
  • authentication token
  • tns session id
  • url
  • start time in days
  • status
  • scan result output

This workflow retrieves the list of Scan result IDs as per the given timestamp.

It accepts the authentication token obtained from the Read Configuration Details workflow, and the start time, in days, from which the scan result IDs needs to retrieved.

The value for the Start Time in Days is configured in the Vulnerability Management – BMC-SA-Vulnerability_Scan_Configuration module.

Download Scan File

  • adapter name
  • authentication token
  • tns session id
  • url
  • id
  • download directory
  • status
  • file name output

This workflow downloads the scan file for the given Scan result ID.

It accepts the authentication token obtained from the Read Configuration Details workflow, and the scan result ID obtained from the Get Scan Result IDs workflow.

The Download Directory path is configured in the Vulnerability Management – BMC-SA-Vulnerability_Scan_Configuration module.

Import Scan File

  • adapter name
  • authentication token
  • url
  • file
  • status
  • error message

This workflow imports the downloaded file in to Automation Console.

It requires and accepts the authentication token obtained from the Login workflow and the file to be imported from the Download Scan File workflow.

Delete Scan File

  • connection details
  • file
  • command output
  • exit code

After a successful import, this workflow deletes the downloaded scan file on the TrueSight Orchestration – Configuration Distribution Peer host.

Calculate Timestamp

  • start time in days
  • timestamp

This workflow calculates the past timestamp based on the specified number of days.


 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*