> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/tenable-scanner-reference.md). # Tenable step configuration You can scan your container images and application instances using [Tenable](https://docs.tenable.com/) and then ingest the results from Harness. ### Workflow descriptions

Orchestration/extraction workflows

Ingestion workflows

### Custom Scan step settings for Tenable scans in STO The recommended workflow is to add a Custom Scan step to a Security or Build stage and then configure it as described below. #### Scanner settings These settings are all required. * [Product name](#product-name) * [Scan type](#scan-type) * [Policy type](#policy-type) * [Product config name](#product-config-name) **Product name** **Key** ``` product_name ``` **Value** ``` tenableio ``` **Scan type** The target type to scan. **Key** ``` scan_type ``` **Value** Must be one of the following. ``` instance ``` **Policy type** The [scan mode](/security-testing-orchestration/3.0/new-to-sto/key-concepts/sto-workflows-overview.md) to use. **Key** ``` policy_type ``` **Value** ``` orchestratedScan ``` ``` dataLoad ``` ``` ingestionOnly ``` **Product config name** **Key** ``` product_config_name ``` **Value** Use the legacy Nessus scan inside tenableIO: ``` legacy-web-application-scan ``` #### Target and variant #### Instance #### Product access These settings are available to access your Tenable instance when `policy_type` is `orchestratedScan`. You should [create Harness text secrets](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md) for your encrypted passwords/tokens and reference them using the format `<+secrets.getValue("my-access-token")>`. **Product access keys** ``` product_domain ``` ``` product_access_id ``` ``` product_access_token ``` ``` product_policy_id ``` ``` product_scanner_id ``` ``` product_template_uuid ``` #### Ingestion file #### Fail on Severity ### Proxy settings