Roles

This page describes the role models used by Tenable products to control access to API endpoints.

Most Tenable products, including Tenable Vulnerability Management, Tenable Web App Scanning, Tenable Exposure Management, and Tenable PCI ASV, use a combination of user roles and custom roles:

• User Roles, a set of predefined roles.
• Custom Roles, a set of privileges you tailor to your organization.

Container Security uses a separate model, described in Container Security Roles. The Managed Security Service Provider (MSSP) endpoints use user roles only, described in Managed Security Service Provider Roles.

---

User Roles

User roles are a set of Tenable-provided privileges that are predefined. For more information about user roles, see Tenable-Provided Roles and Privileges in the Tenable Vulnerability Management User Guide.

👍

Tip

To determine user permissions for the current user, use the GET /users/{user_id} endpoint.

Custom Roles

Custom roles are a custom set of privileges that allow you to tailor user privileges and access to resources on your Tenable Vulnerability Management instance that are specific to your organization's needs. For more information about custom roles, see Custom Roles in the Tenable Vulnerability Management User Guide.

When you create a custom role, you can add all or some of the privileges described in this section.

🛑

Caution

You must include the toggle privilege for an application alongside any other privilege for that application. If you omit it, the request fails with a 400 response and an Invalid role_permission_string error. Where a category within an application has its own toggle privilege, you do not need to include it: Tenable adds it for you. Each section below lists the toggle privileges that apply to it.

📘

Note

Privileges are hierarchical: a privilege that grants more also grants less. Assigning VM.VM_SCAN.VM_SCAN.EDIT, for example, also grants VM.VM_SCAN.VM_SCAN.READ. Endpoint documentation names the least privilege that permits a request, so a role that holds a broader privilege for the same entity satisfies it as well. To see the relationships for a privilege, use the List role permissions endpoint.

Platform Settings

Toggle privilege: none required.

📘

Note

The Access Control Create, Edit, and Delete privileges each grant Access Control Read. A role that holds any one of them can perform every Access Control write operation, so endpoint documentation names the privilege that matches the operation rather than the only privilege that permits it.

Account Management

Hexa

Exposure Management

Toggle privilege: EXPOSURE_MANAGEMENT.TOGGLE_EXPOSURE_MANAGEMENT.USE. Analytics privileges, that is, any Exposure View or Dashboards privilege, also require EXPOSURE_MANAGEMENT.ANALYTICS.TOGGLE_EXPOSURE_MANAGEMENT_ANALYTICS.USE, which Tenable adds for you when you assign one.

📘

Note

The Exposure Response privileges and the Vulnerability Management Exposure Response privileges permit the same operations, action for action. Assigning one set does not grant the other, so assign the set that matches the application your role is for.

Analytics

Attack Path

Connectors

Exposure Response

Exposure Signals

Inventory

Tags

Attack Surface Management

Toggle privilege: ASM.TOGGLE_ASM.USE.

Vulnerability Management

Toggle privilege: VM.TOGGLE_VM.USE. Scans privileges also require VM.VM_SCAN.TOGGLE_VM_SCAN.USE, and Sensors privileges VM.VM_SENSOR.TOGGLE_VM_SENSOR.USE. Tenable adds both category toggles for you when you assign a privilege that needs them.

Dashboards

Explore

Exports

Exposure Response

Recast/Accept Rules

Remediation

Reports

Scans

Sensors

Vulnerability Intelligence

Web App Scanning

Toggle privilege: WAS.TOGGLE_WAS.USE.

📘

Note

The Managed Credential and Recast/Accept Rule privileges grant access to both Vulnerability Management and Web App Scanning operations for those entities.

PCI ASV

Toggle privilege: PCI.TOGGLE_PCI.USE.

---

Managed Security Service Provider Roles

The Managed Security Service Provider (MSSP) endpoints use the user roles described in User Roles and have no custom role privileges. The List role permissions endpoint returns no MSSP privileges, and MSSP is not one of the applications you can select for a custom role.

Each MSSP endpoint states the user role it requires. Tenable evaluates that role in the MSSP partner container.

---

Container Security Roles

Tenable Enclave Security uses a separate, permission-based role model for Container Security that is independent of the Vulnerability Management and Web App Scanning role system described above.

Each Container Security role has a set of permissions that are enabled or disabled by default. Administrators can assign these roles to users to control access to Container Security features. Additionally, administrators can create custom roles and assign specific Container Security permissions to tailor access for their organization's needs. For more information about Container Security permissions, see Permissions.

The following table lists the default Container Security roles and their enabled permissions: