Tenable
OPEN for AI

BeyondTrust

Combine BeyondTrust identity and privileged access context with live Tenable exposure data using your preferred AI tool to see which identities can reach a vulnerable asset and stop lateral movement before it starts.    

Use Case: Identity-Aware Exposure Investigation
By connecting the BeyondTrust Pathfinder MCP server and the Tenable Hexa AI MCP Server in a single AI agent session, security teams can join Tenable vulnerability findings with BeyondTrust identity and privileged access data for assets present in both platforms. Starting from a Tenable scan finding or a BeyondTrust detection, analysts can identify the identities and privileged accounts tied to an exposed host, assess whether its vulnerabilities could be chained for lateral movement, and prioritize remediation or investigation with both exposure and identity context."    

Sample Prompts:
“Tenable flagged critical vulnerabilities on [host] in the latest scan. Use BeyondTrust to show which identities and privileged accounts have access to that host, and tell me whether those vulnerabilities could be chained for lateral movement.”

“BeyondTrust detected suspicious activity on [host]. Check Tenable for that host’s vulnerability posture and list the privileged accounts we should review first.”

Resources:

Cohesity

Combine Tenable exposure data with Cohesity data protection and recovery context using your preferred AI tool to see which business-critical applications carry the most risk and whether they have clean recovery points.    

Use Case: Exposure-Aware Recovery Readiness
By connecting Cohesity’s MCP support and the Tenable Hexa AI MCP Server in a single AI session, security teams can identify which business-critical applications have the highest Tenable exposure, then check whether those applications have clean recovery points in Cohesity. This helps teams focus protection and recovery planning on the systems that would cause the most damage if compromised.    

Sample Prompt: 
“Which of our business-critical applications have the highest Tenable exposure, and do they have clean recovery points in Cohesity?”

Resources:

Command Zero

Take high-priority Tenable exposures straight into Command Zero investigations using your preferred AI tool to determine whether an exposure was exploited and propose a verdict in Tenable and/or Command Zero for analyst approval.

Use Case: Exposure-to-Verdict Investigation
By connecting the Command Zero MCP server and the Tenable Hexa AI MCP Server in a single AI session, security teams can pass the highest-priority Tenable finding, ranked by VPR, ACR, or AES, into a scoped Command Zero investigation. Command Zero queries host evidence from connected security tools such as EDR to determine whether the exposure was exploited, then proposes the verdict as a Tenable asset tag for analyst approval.

Sample Prompts:
“Show my most critical Tenable exposures ranked by VPR, then open a Command Zero investigation on the top host to determine whether that finding reflects an active compromise.”

“Who has been on [host], what did they run, and did our endpoint tool alert on any of it? Give me a verdict and propose a Tenable tag for the result.”

Resources:

Corelight

Link Corelight network alerts and telemetry with Tenable vulnerability context using your preferred AI tool to rapidly investigate active network threats and determine enterprise blast radius.   
Use Case: End-to-End Network Incident Investigation & Blast Radius Mapping
By connecting Corelight network security monitoring with live Tenable asset context, security analysts can automatically triage live network alerts, evaluate target host vulnerabilities to explain why an attack is dangerous, and search across the entire organization to map exposed assets and prioritize remediation.   

Sample Prompt:
"A security alert just fired on this network. Investigate it end to end: (1) use get_alert_context to find what happened in the last 30 minutes and identify the affected host/IP, (2) check Tenable for that host's vulnerability posture and find the specific CVE that explains why this attack pattern is dangerous, (3) then search Tenable across the whole 87-asset organization for that same vulnerability/plugin to find every other host equally exposed, so we know the full blast radius. Finish with a short prioritized remediation recommendation. Be concise but show the real data at each step.""
 

Resources:

Infoblox

Combine Infoblox's authoritative DNS, DHCP, IP address management data and network identity context with live Tenable vulnerability data using your preferred AI tool to instantly eliminate security blind spots, enrich asset identity and prioritize risk triage.    "Validated 

Use Case 1: Risk-Ranked Asset Triage
By combining Tenable's findings index for active critical vulnerabilities with Infoblox IPAM, DNS, and DHCP data, security teams can risk-rank devices based on actual exposure while joining results across both platforms for a unified, accurate identity view.   

Use Case 2: Identity Gap Analysis 
By cross-referencing unauthenticated or incomplete Tenable scan assets against Infoblox network identity context, you can automatically resolve missing hostnames or MAC addresses and surface unmonitored hosts that would otherwise go unnoticed.

Use Case 3: MAC-to-Vulnerability Pivot 
By tracing a single network identifier—such as a MAC address or DHCP reservation in Infoblox—you can instantly resolve an asset's target identity and pull its complete Tenable vulnerability posture end-to-end.  

Sample Prompts:   
"Which devices in our engineering subnet have the highest asset criticality and active critical vulnerabilities? Rank using the findings index for active criticals rather than asset-level counters. For the top 5, look up each one's network identity in Infoblox DNS record, DHCP reservation and MAC. One table: hostname, IP, MAC per Tenable, MAC per Infoblox, identity status, ACR, and the most serious active critical finding prefer a named CVE over a rollup KB where one exists. Where Tenable has no MAC or hostname, mark identity 'Infoblox-only'."   
"Which critical assets in the engineering subnet have no hostname or MAC address recorded in Tenable? For each, check whether Infoblox can supply that missing identity from DNS or DHCP. Show me a table of what each system knows."   
"Infoblox has a DHCP reservation for MAC 00:50:56:a6:ac:4c. Work out which device that is, then pull its full vulnerability posture from Tenable." 

Resources:

Recorded Future

Cross-reference real-world threat intelligence with live Tenable context using your preferred AI tool to instantly prioritize and remediate targeted attack paths.    

Use Case: MITRE APT Attack Path Analysis
By connecting Recorded Future threat intelligence with live Tenable data, you can determine exactly how specific hacker groups could breach your environment. This highlights the exact weak points that must be patched first to stop a targeted threat, allowing your security team to preemptively secure critical infrastructure.    

"Cross-reference our live Tenable asset data with Recorded Future threat intelligence to show the exact attack path APT29 would most likely use to breach our environment."
"Which weak points and critical vulnerabilities must be patched first to stop a targeted threat from currently active ransomware groups?"

Resources:

Securonix

Match real-world threat actor activity from Securonix ThreatQ with live Tenable exposure data using your preferred AI tool to quickly see which assets adversaries are targeting and where to act first.   

Use Case: Threat Actor Exposure Check
By connecting the Securonix ThreatQ MCP server and the Tenable Hexa AI MCP Server in a single AI agent session, security teams can pull the CVEs and malware ThreatQ associates with a specific threat actor and match them against active Tenable findings by CVE ID. This allows analysts to identify which assets in their environment are exposed to that actor's current activity and prioritize remediation using both threat intelligence and Tenable exposure data."  

Sample Prompts:

“Use ThreatQ and Tenable to check whether anything [threat group] has been exploiting recently affects assets in our environment, and rank the exposed assets by remediation priority.”

“Tenable shows a backdoor finding on two hosts. Use ThreatQ to tell me which threat actors use that implant, what typically follows the initial foothold, and what else we should hunt for on those hosts.”"

Resources:

SentinelOne

Investigate alerts, vulnerable assets, and misconfigurations using your preferred AI tool to instantly streamline threat response.    

Use Case: Conversational Threat Investigation 
By connecting SentinelOne via the AI Analyst Claude Skill, security teams can ask natural language questions to investigate alerts, vulnerable assets, and misconfigurations directly within their AI chat window, eliminating the need to constantly switch between different tools.   

Sample Prompts:
"Show me all high-priority alerts on my critical servers and list their most severe misconfigurations."

"For the suspicious process alert on server XYZ, can you identify any existing vulnerable assets or misconfigurations on that specific endpoint?"

Resources:

Setyl

Match Tenable vulnerability data to Setyl's device and employee records using your preferred AI tool to see who owns each at-risk device and route remediation to the right person.   

Use Case: Vulnerable Device Ownership
By connecting the Setyl MCP server and the Tenable Hexa AI MCP Server in a single AI session, security teams can match the devices carrying the most critical Tenable vulnerabilities to Setyl's IT asset records. This allows analysts to see the assigned owner, department, and location for each at-risk device, and flag devices tied to employees who are offboarding."   

Sample Prompt: 
“Pull the top four devices with the most critical vulnerabilities from Tenable. Match each one to a Setyl asset, and show me a table with the owner, department, location, and main issue. Flag anyone who is offboarding.”

Resources:

Snyk

Correlate developer-first application security findings with Tenable runtime exposure context using your preferred AI tool to instantly prioritize code-to-cloud risks without tool switching.    

Use Case: Code-to-Runtime Vulnerability Correlation
By connecting the Snyk MCP server side-by-side with the Tenable Hexa AI MCP server in a single AI session, security teams can deterministically join dev-time code findings with active runtime assets using shared CVE IDs. This allows analysts to instantly determine whether vulnerabilities detected in source code or open-source dependencies are actively deployed on production container images and runtime infrastructure."    

Sample Prompts:
"Run an SCA scan on our repository using Snyk, then cross-reference any high-severity CVEs against Tenable findings to check if those exact vulnerabilities are active on deployed runtime assets."

"Check Snyk for open-source package vulnerabilities matching CVE-2021-23337, and query Tenable to resolve the exact container images currently running those vulnerable packages in our environment."

Resources:

Sparkle In

Pair Tenable vulnerability data with Sparkle In static and dynamic binary analysis in natural language AI workflows to investigate software supply chain vulnerabilities and prioritize remediation without switching consoles.    

Use Case: Binary-Aware Vulnerability Triage
By integrating the Tenable Hexa AI MCP Server into Sparkle In's agentic AI framework, security teams can query Tenable vulnerability findings alongside Sparkle In's static and dynamic binary analysis of the affected software. This allows analysts to confirm which software supply chain vulnerabilities are present in deployed binaries and focus remediation on those. 

Sample Prompts:  
“List the assets in the Weekly Network Scan and their vulnerability counts by severity.”

“What are the most severe vulnerabilities for [host]?”"

Resources:

Splunk

Link Tenable vulnerability data with Splunk alerts using your preferred AI tool to instantly detect active attacks and gain immediate visibility into your cloud security risks.    

Use Case 1: Active Attack Verification (AI Skill)
By utilizing a dedicated Splunk skill, you can automatically link Tenable vulnerability data with Splunk network alerts to instantly prove if a critical asset is under active attack, accelerating your incident response times.

Validated Use Case 2: Cloud Risk Summarization (MCP Server Integration)
By connecting both the Splunk and Tenable MCP servers, you can automatically group and summarize massive amounts of cloud security alerts by account or workload. This gives teams immediate, big-picture visibility into their cloud risks without forcing them to write complex search queries."    

Sample Prompts:
"Cross-reference our critical Tenable vulnerability data with recent Splunk network alerts to determine if any of our critical assets are currently under active attack."

"Group and summarize all recent Splunk cloud security alerts for our production AWS workloads, and highlight the most pressing risks."

Resources: