Mock Tenable

Quick start

You need Python 3.11 or later. The first run creates a virtual environment and downloads cloudflared.

Windows

Download the ZIP and unzip it.
Double-click deploy-and-start.bat once, so Python packages are installed.
After that, double-click start-windows.bat.

macOS

Download the ZIP and unzip it.
In Terminal, run python3 -m venv .venv and .venv/bin/pip install -r requirements.txt.
Control-click start-macos.command, choose Open, then confirm.

The window starts the mock, opens the console, and prints the Endpoint URL to give HAC. It looks like https://<name>.trycloudflare.com. Press Ctrl+C in that window to stop. The tunnel is left running so the next start keeps the same URL.

To run it locally with no tunnel and no download:

.venv\Scripts\python.exe start.py --no-tunnel

Ports start at 9742 (console) and 9743 (API). If either is taken, the launcher picks the next free pair. It will not use 9842 or 9843 (Mock TSSA) or 8443 (the Helix connector).

Connect Helix Automation Console

Configure the connector in HAC first, then download and run it. Use a sandbox or demo tenant. Findings are built for Apex-Online hosts so HAC can match them to managed assets by DNS name.

Start the mock and copy the Endpoint URL from its window.
In HAC, go to Configuration > Connectors and add a Tenablesc Connector.
Fill in the values below and save.
Download the connector package HAC gives you and unzip it on a computer with Java.
Run run.bat on Windows, or run.sh on macOS or Linux.
Open API Inspector in the mock console to watch every call arrive.

HAC field	Value
Endpoint URL	The Cloudflare URL from the mock's window
Fetch Data From	Last `3` days
Access Key	`A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6`
Secret Key	`Q7R8S9T0U1V2W3X4Y5Z6A7B8C9D0E1F2G3H4I5J6K7L8M9N0`
Tenable.sc Query ID	`202020`

Cloudflare presents a publicly trusted certificate, so the connector does not need a truststore import. Without the tunnel, point Endpoint URL at https://<this computer>:<https port> and import certs/cert.pem with import-cert.ps1.

The tunnel's address is public while the mock runs, and the console shows the demo keys. Use it for test data only, and stop it when you've finished. If the URL stops working, run .\start-mock.ps1 -NewTunnel and update the connector.

What you can do

Tenable.sc

The connector authenticates with the access and secret keys, reads query 202020, and posts /rest/analysis. The mock returns vulnerability rows whose lastSeen is inside the fetch window, keyed by DNS name and IP.

Tenable.io

The Scanner connector can also call POST /vulns/export and POST /assets/export. Exports finish immediately and their chunks are ready to download. They show up on the console's Exports page.

The mock console

The console uses the same layout as Mock TSSA: Dashboard, Assets, Findings, Plugins, Queries, Exports, API Inspector, and Settings. The Dashboard is where you copy the Endpoint URL, keys, and query id.

What works

Area	Status	Notes
Tenable.sc query and analysis	Works	Query `202020`, vuln details, pagination, and sumip.
Tenable.io vuln and asset export	Works	Status is finished as soon as the export is created.
Cloudflare endpoint	Works	Public HTTPS on port 443. No certificate import.
API Inspector	Works	Unimplemented calls are flagged so you can see what the connector asked for.
Side-by-side with Mock TSSA	Works	Different ports, so both mocks can run on one machine.

Options

Setting	Default	What it does
`HTTP_PORT`	`9742`	Console port. A busy port is replaced automatically.
`HTTPS_PORT`	`9743`	API port. The tunnel publishes this port.
`MOCK_TUNNEL`	`cloudflare`	`off` disables the tunnel
`MOCK_TUNNEL_TOKEN`	none	Use a named Cloudflare tunnel, which keeps a fixed host
`TENABLE_ACCESS_KEY`	demo key	Access key the connector must send
`TENABLE_SECRET_KEY`	demo key	Secret key the connector must send
`TENABLE_QUERY_ID`	`202020`	Query id HAC asks for

Copy .env.example to .env to change them. The README has the smoke test.

Troubleshooting

The start window closes or Python is missing

Install Python 3.11 or later from python.org and check Add python.exe to PATH. Then run deploy-and-start.bat.

HAC can't reach the mock

VPNs can block the tunnel. Run .\start-mock.ps1 -NewTunnel, then paste the new Endpoint URL into the connector.

The connector reports HTTP 500

Open API Inspector. The request and the mock's response are listed there.

Preferred ports are taken

The launcher prints the pair it chose, for example Using 9700/9701. The console URL in the same window is the one to open.