Integrated Vulnerability Remediation

Integrated Vulnerability Remediation (IVR) correlates the vulnerability findings from your Tenable Vulnerability Management scanner with BigFix Fixlets and devices, so that you can review vulnerabilities and deploy their remediations from one place.

Overview

It is available from the Resolve > Integrated Vulnerability Remediation menu in BigFix UI. You can review vulnerabilities by vulnerability or by device, and start remediation from either view. Administrators set up and maintain IVR from Administration > Application Configuration. IVR refreshes scanner data every 12 hours by default.

Entitlement

Required:

  • A BigFix license that includes the BigFix Insights for Vulnerability Remediation site: BigFix Remediate, BigFix Lifecycle, BigFix Compliance, BigFix Workspace or Workspace+, or BigFix Enterprise or Enterprise+.

Check:

User permissions

Required role:

  • To use IVR: a BigFix UI role that includes the IVR application, assigned in Administration > Identity and Access > User & Role Management.
  • To configure IVR: a BigFix UI administrator account mapped to a BigFix operator. Only administrators can access Application Configuration.
  • To install IVR: a BigFix Console operator who can enable external sites, activate analyses, and take actions.
  • To register IVR with BigFix UI (one time): a local Windows administrator on the BigFix UI server, and the BigFix UI instance admin credentials.

Required scope:

  • To remediate: the devices that the user's mapped BigFix operator can target.
  • Site subscription: computers subscribed to the BigFix Insights for Vulnerability Remediation site. All computers is recommended.

Prerequisites

  • BigFix platform: BigFix UI installed and connected to a Windows-based BigFix Server, version 11.0.7.61 or later.
  • BigFix content: the BigFix Insights for Vulnerability Remediation site enabled (site version greater than 0), and the IVR Vulnerability Scanner Host ID analysis activated globally.
  • IVR backend: the BES IVR Retriever Service, installed with the Download BigFix IVR Retriever v5.0.0.0 Task on the BigFix UI server or on a separate computer.
    • Operating system: Windows Server 2016, 2019, 2022, or 2025.
    • Hardware: at least 2 CPU cores (4 recommended). In addition to the operating system, 2 GB of RAM and 4 GB of disk space per 20,000 endpoints.
  • IVR database: an IVR schema that IVR creates in the BigFix UI database on Microsoft SQL Server 2025. The database user must have permission to create a schema. Back up the BigFix UI database before you configure IVR.
  • Network:
    • Inbound to the IVR host from BigFix UI on ports 8088 and 9022.
    • Outbound from the IVR host to Tenable on port 443 (a proxy is supported) and to the BigFix UI database on port 1433.
  • Scanner: a Tenable Vulnerability Management account with an administrator role to generate API keys. IVR supports one data source.
  • Earlier IVR versions: uninstalled before you install IVR v.5.

Full documentation

For full feature documentation, see BigFix Integrated Vulnerability Remediation (IVR) v.5.

Related