Microsoft TVM Connector

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

Microsoft TVM delivers asset visibility, intelligent assessments, and built-in remediation tools for Windows, macOS, Linux, Android, iOS, and network devices. Leveraging Microsoft threat intelligence, breach likelihood predictions, business contexts, and devices assessments, Microsoft TVM rapidly and continuously prioritizes the biggest vulnerabilities on your most critical assets and provides security recommendations to mitigate risk.

Connector Details

Prerequisites and User Permissions

Before you begin configuring the connector, make sure you have the following:

• Microsoft TVM registered application with the required credentials (Directory/Tenant ID and Application/Client ID).

• API token with the appropriate Read access permissions.

Generate Credentials

To register the app and generate Tenant and Client IDs: 

1. Log in to the Microsoft Azure portal using your Azure portal administrator credentials.

2. In the left navigation panel on the Home pane, click Azure Active Directory.

3. In the Overview pane, click App Registrations.

4. In the App Registrations (Preview) pane, click New Registration. The Register an application form appears.

5. Configure the following options:

   • Name - Enter a name for the integration

   • Supported account types - Accounts in this organizational directory only

6. Click Register.
   

7. Microsoft creates the Application (client) ID. Save this ID for future use.

8. Navigate to Manage > API Permissions > Add API Permissions.

9. Navigate to APIs my organization uses and click WindowsDefenderATP.

10. In the API permissions pane, click Add a Permission and provide the following access permissions:

    • Machine.Read and Machine.ReadWrite access to machines.

11. Click Grant Admin Consent for <your organization name>.

12. Navigate to Integration > Certificates & Secrets and click New Client Secret.

13. Configure the following Client secrets options:

    • Description — A brief description of the application.

    • Expires — The date at which the client secret expires.

14. Click Add.

    The Value field is populates with your client secret. Save this secret for use in the API Token field within Tenable Exposure Management.

Add a Connector

To add a new connector:

1. In the left navigation menu, click Connectors.

   The Connectors page appears.

   

2. In the upper-right corner, click Add new connector.

   The Connector Library appears.

   

3. In the search box, type the name of the connector.

4. On the tile for the connector, click Connect.

   The connector configuration options appear.

Configure the Connector

To configure the connector:

1. (Optional) In the Connector's Name text box, type a descriptive name for the connector.

2. In the Tenant ID, enter your Tenant ID.

3. In the App ID (Application) ID) and Client Secret Value fields, enter the corresponding credentials you generated in Microsoft Azure.

4. Data pulling configuration: This configuration has dynamic settings tailored to the specific connector and integration type. Below are the configurations relevant to this connector.

   • In the Set the integration data pulling section, select the Map External IP to Asset and/or Fetch only onboarded assets if relevant to your connector needs.

   • In the Asset Retention text box, type the number of days after which you want assets to be removed from Tenable Exposure Management. If an asset has not been detected or updated within the specified number of days, it is automatically removed from the application, ensuring your asset inventory is current and relevant.

     Tip: For more information, see Asset Retention.

   • (Optional) From the drop-down menu, you can choose to automatically remove assets that reach a certain asset status, for example, Inactive.

5. In the Test connectivity section, click the Test Connectivity button to verify that Tenable Exposure Management can connect to your connector instance.
   

   • A successful connectivity test confirms that the platform can connect to the connector instance. It does not, however, guarantee that the synchronization process will succeed, as additional syncing or processing issues may arise.
     

   • If the connectivity test fails, an error message with details about the issue appears. Click Show tests for more information about the exact error.
     

     

6. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

   Tip: For more information, see Connector Scheduling

7. Click Create. Tenable Exposure Management begins syncing the connector. The sync can take some time to complete.
   

8. To confirm the sync is complete, do the following:

   • Navigate to the Connectors page and monitor the connector's status. Sync is complete once the connector status is Connected.

   • View the sync logs for the connector to monitor the logs for a successful connection.

Microsoft TVM in Tenable Exposure Management

Locate Connector Assets in Tenable Exposure Management

As the connector discovers assets, Tenable Exposure Management ingests those devices for reporting.

To view assets by connector:

1. In Tenable Exposure Management, navigate to the Assets page.

2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view assets.

   

   The asset list updates to show only assets from the selected connector.

3. Click on any asset to view Asset Details.

Locate Connector Weaknesses in Tenable Exposure Management

As the connector discovers weaknesses, Tenable Exposure Management ingests those weaknesses for reporting.

To view weaknesses by connector: 

1. In Tenable Exposure Management, navigate to the Weaknesses page.

2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view weaknesses.

   

   The weaknesses list updates to show only weaknesses from the selected connector.

3. Click on any weakness to view Weakness Details.

Locate Connector Findings in Tenable Exposure Management

As the connector discovers individual findings, Tenable Exposure Management ingests those findings for reporting.

To view findings by connector:

1. In Tenable Exposure Management, navigate to the Findings page.

2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view findings

   

   The findings list updates to show only assets from the selected connector.

3. Click on any asset to view Finding Details.

Data Mapping

Exposure Management integrates with the connector via API to retrieve relevant weakness and asset data, which is then mapped into the Exposure Management system. The following tables outline how fields and their values are mapped from the connector to Exposure Management.

Tenable Exposure Management UI Field	Microsoft TVM Field
Unique Identifier	id
Asset - External Identifier or Asset - Provider Identifier	vmMetadata.vmId or id
Asset - Name	ComputerDnsName or lastIpAddress or lastExternalIpAddress or id
Asset - Operating Systems	osPlatform
Asset - IPv4 Adresses Asset - IPv6 Adresses	lastIpAddress and lastExternalIpAddress
Asset - First Observation Date	firstSeen
Asset - Last Observed At	lastSeen
Asset - External Tags	machineTags computerDnsName rbacGroupName healthStatus riskScore managedBy exposureLevel lastExternalIpAddress osPlatform
Asset Custom Attributes	device_id: id healthStatus: healthStatus exposureLevel: exposureLevel osBuild: osBuild osVersion or version

Findings Mapping

Tenable Exposure Management UI Field	Microsoft TVM Field
Unique Identifier	cveId + id + deviceId
Finding Name	cveId
CVEs	cveId
Severity Driver	cvssScore or vulnerabilitySeverityLevel
Description	data.description
Finding Custom Attributes	data.cvssVector software_vendor software_name software_version disk_paths registry_paths recommended_security_update: recommendedSecurityUpdate + recommendedSecurityUpdateUrl severity: vulnerabilitySeverityLevel
First Seen	firstSeenTimestamp
Last seen (Observed)	lastSeenTimestamp

Finding Status Mapping

Note:For Microsoft TVM, Exposure Management ingests only active/vulnerable findings.

Finding Severity Mapping

Note:For Microsoft TVM data, Tenable uses the cvssScore field to determine severity. If cvssScore is not available, Tenable uses the vulnerabilitySeverityLevel field from the connector, if provided.

Status Update Mechanisms

Every day, Tenable Exposure Management syncs with the vendor's platform to receive updates on existing findings and assets and to retrieve new ones (if any were added).

The table below describes how the status update mechanism works in the connector for findings and assets ingested into Tenable Exposure Management.

Uniqueness Criteria

Tenable Exposure Management uses defined uniqueness criteria to determine whether an ingested asset or finding should be recognized as a distinct record. These criteria help define how assets and findings are identified and counted from each connector.

Tip:  Read all about Third-Party Data Deduplication in Tenable Exposure Management

The uniqueness criteria for this connector are as follows:

API Endpoints in Use

API version: 1.0

Data Validation

This section shows how to validate and compare data between Tenable Exposure Management and the Microsoft TVM platform.

Asset Data Validation

Objective: Ensure the number of endpoints (devices) in Microsoft TVM aligns with the number of devices displayed in Tenable Exposure Management.

In Microsoft TVM:

1. Navigate to Assets > Devices.

2. Set the time filter to the maximum value (6 months).

   

3. (Optional) Depending on the connector setup in Exposure Management,you may need to apply filters in Microsoft Defender for Vulnerability Management to view the correct set of assets. Apply the following filters based on the connector setup:

   • If "Fetch only onboarded assets" is enabled, select the Active filter in Microsoft Defender for Vulnerability Management.

   • If "Immediately remove assets when their status is set to Inactive is enabled", exclude the configured value from the filter.

     
     For example, if Inactive is selected in the connector, select Active and Misconfigured in the Microsoft Defender asset view.
     

In Tenable Exposure Management:

1. Locate your connector assets.

2. Compare the total number of assets between Microsoft TVM and Tenable Exposure Management.

Expected outcome: The total numbers returned in Microsoft TVM and Exposure Management should match.

If an asset is not visible in Exposure Management, check the following conditions:

• The asset was archived based on its last observed date (last_seen field).

• The asset was archived based on its healthStatus value.

• The asset was archived because it did not return in the connector's last sync.

  Tip: To learn more on how assets are archived and findings change status, see Status Update Mechanisms.

Finding Data Validation

Objective: Ensure the number of findings in Microsoft TVM aligns with the number of findings in Tenable Exposure Management.

In Microsoft TVM:

1. Navigate to Assets > Devices.
   

2. Click on the name of any asset you want to view.

3. Navigate to Inventories > Software.

   

4. Sum up the Weaknesses column.

   Tip: Use the Export function to do this efficiently!

In Tenable Exposure Management:

1. Locate your connector findings.

2. Compare the total number of findings between Microsoft TVM and Tenable Exposure Management.

Expected outcome: The total numbers returned in Microsoft TVM and Exposure Management should match

If a finding is missing from Exposure Management or no longer active, check the following conditions:

• The finding is marked as Fixed and appears under the Fixed state on the Findings screen

• The finding no longer appears because its related asset was archived.

  Tip: To learn more on how assets are archived and findings change status, see Status Update Mechanisms.