System requirements

Learn about the prerequisites, system requirements, network ports, and platform dependencies for the BigFix IVR v.5 Retriever service.

Software requirements

Category Details
BigFix component requirements BigFix UI (BFUI) installed and running, with access to its database. See System Requirements and Installation in the BigFix UI Administration Guide.
Prerequisites Microsoft SQL Server 2025, used by the BigFix UI database.
Operating system Microsoft Windows Server 2016, 2019, 2022, or 2025
Supported BigFix versions Windows-based BigFix Server, version 11.0.7.61 or later.
Note:
The BigFix IVR Retriever service does not support BigFix Server environments that are not based on Windows.
BigFix license requirements BigFix Remediate, BigFix Lifecycle, BigFix Compliance, BigFix Workspace or Workspace+, or BigFix Enterprise or Enterprise+
Supported vulnerability management platforms Tenable Vulnerability Management (formerly Tenable.io), selected as Tenable VM in the BigFix UI.
Note:
IVR v.5 supports only Tenable Vulnerability Management.
Note:
You need an administrator user role in Tenable to generate the API keys that IVR uses.
Network requirements

BES IVR Retriever Service (IVR host):

  • Inbound from BFUI Core on port 8088 (basic authentication) and port 9022 (mTLS).
  • Outbound to Tenable Vulnerability Management on port 443. You can route this connection through an HTTP or HTTPS proxy server.
  • Outbound to the BFUI DB (SQL Server) on port 1433.
  • Listens internally (localhost only) on ports 9012, 9013, 9014, 9015, 9016, and 9876. These ports don't need firewall rules, but no other application can use them.

BigFix UI: BFUI Core communicates with the BigFix Root Server through BES Explorer. The IVR Retriever doesn't connect to the BigFix Root Server directly.

Note:
All ports are TCP. Ports can change, and your defaults can differ from this implementation.
System limitations IVR v.5 supports one scanner data source per IVR instance.

Hardware requirements

Hardware IVR Retriever (Tenable)
CPU Minimum 2 cores (4 cores recommended)
RAM In addition to the host operating system requirements: 2 GB per 20,000 endpoints
Disk space With default settings: 4 GB per 20,000 endpoints
Execution time The time that data synchronization and processing take depends on CPU speed, the number of findings, the number of assets, the number of patch sites loaded in your BigFix environment, API latency, and other workloads on the IVR computer.

Deployment prerequisites

All IVR deployment prerequisites are documented here. The BigFix UI documentation summarizes IVR and links to this guide: see Integrated Vulnerability Remediation in the BigFix UI User’s Guide.

  • Backend: a Windows computer for the BES IVR Retriever Service. It can be the BigFix UI server or a separate computer, and it must meet the Hardware requirements and the network requirements in Software requirements.
  • Database: the BigFix UI database on Microsoft SQL Server 2025, and a database user with permission to create a schema in it. IVR creates its own schema in this database.
  • BigFix: the BigFix Insights for Vulnerability Remediation site and the IVR Vulnerability Scanner Host ID analysis. See Before you begin.

When the prerequisites are in place, Install the BigFix IVR Retriever and complete the IVR v.5 setup process.

Moving from IVR v.4

Important:
If an earlier version of IVR is installed in your environment, uninstall it before you install IVR v.5.

To move to IVR v.5 from an earlier version, uninstall the earlier version first, and then install and set up IVR v.5 as a new installation.

CAUTION:
Uninstalling the earlier version removes its IVR Retriever folder, service, and configuration. Back up the installation folder and record your data source settings before you start.
  1. In the BigFix Console, open the BigFix Insights for Vulnerability Remediation site, and then go to Fixlets and Tasks.
  2. Uninstall the earlier version:
    • IVR v.4: Select the Uninstall BigFix IVR Retriever v4 Fixlet, and then follow steps 2-5 of Uninstall the BigFix IVR Retriever.
    • IVR v.2 or v.3: Select the Uninstall BigFix Insights for Vulnerability Remediation Task, and then click Take Action. After the service is removed, delete the IVR schema from SQL Server. For the SQL query, see Uninstall the BigFix IVR Retriever.
  3. Confirm the removal as described in the uninstall results. See Uninstall the BigFix IVR Retriever.
  4. Install IVR v.5. See Install the BigFix IVR Retriever.
  5. Set up IVR v.5. See IVR v.5 setup process.
Note:
IVR v.5 stores its data in a new schema in the BigFix UI database, and you configure it from scratch in the BigFix UI. The earlier version's configuration isn't reused.

Where each step runs

Step Runs on Account you need
Enable the site, and deploy the Download and Uninstall Tasks Computer that runs the BigFix Console BigFix operator who can manage external sites and take actions
BES IVR Retriever Service Target computer that you select in the Download Task (the IVR host) —
BFUI.exe --configure-ivr BigFix UI server Local Windows administrator, plus the BigFix UI instance admin
Grant IVR access, run the configuration wizard Any browser that can reach the BigFix UI BigFix UI administrator

You can install the IVR Retriever on the BigFix UI server or on a separate computer. If you use a separate computer, open the inbound and outbound ports listed in Network requirements in the firewalls between the computers. In Task 1, enter the IVR host IP address and include it in the IP SANs.