# Tenable Auth Failure Tracker

> Auto-classifies Tenable credentialed scan auth failures by root cause and tracks remediation cases.

- Type: Skill
- Author: rafansmpj
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-09-03
- Source repository: https://github.com/rafansmpj/Tenable-Authentication-Failure-Tracker
- Repo state: not archived
- Last push: 2026-09-02T01:48:26Z
- Stars: 1 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, Tenable Hexa AI MCP
- Domains: platform-operations
- Tags: tenable, authentication, credentialed-scan, root-cause-analysis, case-management, dashboard
- Date added: 2026-09-02
- Works with the Tenable Hexa AI MCP server: yes
- Compatible platforms: Claude Code, Claude Desktop
- Invocation: `/tenable-auth-failure-tracker`
- Listing page: https://exchange.tenable.com/skills/tenable-auth-failure-tracker
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/tenable-auth-failure-tracker.md

The Tenable Auth Failure Tracker is a Claude skill that turns Tenable credentialed scan authentication failures into a triaged, trackable remediation workflow. It targets SOC leads, remediation engineers, vulnerability managers, and IT operations teams who need to close scan coverage gaps caused by failed authentication.

## What it does

- Collects scan authentication health data from Tenable via the Hexa AI MCP connector, using dedicated auth-health plugins (10428, 19506, 21745, 24786, 26917, 91822, 102094, 104410, 110095, 110385, 110695, 110723, 117885, 122502, 122503, 141118, 150799).
- Auto-classifies each failure by root cause: bad password, insufficient privileges, account locked, firewall timeout, port unreachable, credential missing, service unavailable, privilege escalation failure, connection refused, or other.
- Generates a remediation runbook per root cause and maintains a persistent case ledger (open/in-progress/resolved/pending-validation) with SLA thresholds by severity.
- On re-run, detects Fixed/Regressed/New failures and updates case status automatically; exports the case ledger as JSON for downstream ticketing systems.

## How it works

Pulls scan authentication health data from Tenable One via the Hexa AI MCP (read-only), classifies failures with a root-cause heuristic against plugin output, and renders an interactive standalone-HTML dashboard: failure distribution by root cause, an asset table with SLA status, a runbook drawer per root cause, and a case list. The skill never executes remediation actions itself (no password changes, firewall updates, or privilege changes) — those stay manual, guided by the generated runbooks.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/tenable-auth-failure-tracker.json. The full index and how to read it: https://exchange.tenable.com/llms.txt