# Tenable + SentinelOne Asset Reconciliation

> Cross-references Tenable's asset inventory against SentinelOne's agent inventory to find protection gaps and exposure blind spots — matches on hostname/IP, classifies each host, and can tag unprotected assets in Tenable for follow-up.

- Type: Skill
- Author: jdelong-tenb
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-10-19
- Source repository: https://github.com/jdelong-tenb/tenable-sentinelone-asset-reconciliation
- Repo state: not archived
- Last push: 2026-09-17T14:24:24Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, SentinelOne
- Domains: security-operations, vulnerability-management
- Tags: sentinelone, asset-inventory, exposure-management, edr, coverage-gap
- Date added: 2026-09-02
- Compatible platforms: Claude Code
- Invocation: `Say things like "find gaps between our Tenable and SentinelOne coverage," "what's on the network that SentinelOne isn't protecting," or "which SentinelOne-protected assets does Tenable never scan" — the skill activates automatically.`
- Listing page: https://exchange.tenable.com/skills/tenable-sentinelone-asset-reconciliation
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/tenable-sentinelone-asset-reconciliation.md

## What it does

Tenable and SentinelOne each independently track "everything on the network" — one from vulnerability/exposure scanning, one from EDR agent telemetry — and nothing automatically checks whether the two agree. This skill pulls both inventories and reconciles them to find Tenable-visible hosts with no SentinelOne agent (protection gaps) and SentinelOne-protected hosts Tenable never scans (exposure blind spots).

This is a community-built skill, not official guidance from Tenable or SentinelOne.

**Scope:** asset-inventory reconciliation only. Does not deploy agents, launch scans, or modify SentinelOne policy.

## How it works

Install the skill with both a Tenable MCP server and SentinelOne's public `purple-mcp` server connected. When invoked, it:

1. Pulls Tenable assets (`workbenches_list_assets` or `tenable_one_search_assets`) and SentinelOne inventory (`list_inventory_items` / `search_inventory_items`, filterable by surface: endpoint, cloud, identity, network-discovery).
2. Matches hosts across vendors on hostname and IP — SentinelOne records have no single canonical hostname or MAC field, so the match key is built from `name`, `ipAddress`, and nested `networkInterfaces[].ip`.
3. Classifies each host as matched, Tenable-only, SentinelOne-only, or ambiguous (IP-only match, no hostname confirmation) — ambiguous matches are flagged, not silently promoted.
4. Reports counts and a host-level table, and — only with confirmation — can tag unprotected hosts in Tenable for remediation tracking.

Includes a utility script (`scripts/match_inventories.py`) that runs the matching logic standalone against exported inventory JSON.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/tenable-sentinelone-asset-reconciliation.json. The full index and how to read it: https://exchange.tenable.com/llms.txt