---
title: "Process Workflow"
canonical: "https://docs.infoblox.com/space/DeploymentGuideIPAMTDwithTenable/1297024359/Process%20Workflow"
format: markdown
---
### IPAM Integration

The script is designed to synchronize IP address management (IPAM) data from Infoblox to Tenable Vulnerability Management. This synchronization process involves creating and updating objects such as address blocks, subnets, IP ranges, fixed IPs, IP reservations, and DHCP leases in Tenable based on changes made in the Infoblox IPAM system. After the synchronization is complete, the script will automatically initiate a Tenable scan wherever needed.

### Threat Defense Integration

In addition to IPAM synchronization, the script integrates with Infoblox Threat Defense to identify and respond to cyber threats. When a security policy is violated by an asset, it will be logged in the "Threat Defense Threat Feeds Hits Log." Any critical assets tagged as '**VM_Scan_on_Policy_Hit**' will be immediately sent to Tenable for a vulnerability scan, ensuring timely assessment of high-risk items.

> ℹ️ For **Threat Defense** to function properly, it requires both **DFP **and **DHCP services** to be running on a designated host.

### Script Workflow:

- **Initialization:** The process begins by initializing and retrieving the required environment variables, including Tenable credentials, Tenable template name, Tenable scanner name, and relevant API keys.
- **Data Fetching:**
  - **Initial Sync:** The script fetches all IPAM data from Infoblox using the bulk export data API and stores the IP space information in a cache. It also retrieves DHCP lease information via the Infoblox DHCP Lease API.
  - **Event-based Sync:** The script monitors events from audit logs, tracking changes to IP spaces and associated objects. Based on specific tags, such as `Tenable_sync`, `Tenable_tag`, and `Tenable_scan`, the script performs synchronization with the Tenable platform accordingly.
    
- **Data Filtering:** The script filters the data by prioritizing IP spaces and objects with relevant tags. IP spaces with the `Tenable_sync` or `Tenable_scan` tags are given priority, while objects are filtered based on the `Tenable_tag`. Only tagged objects or those marked for synchronization (`Tenable_sync=true`) are processed for syncing.
- **Data Synchronization:** During synchronization, if an asset is not already present in Tenable, it will be created. Depending on whether the event is a creation or an update, the asset will be handled accordingly. Supported object types for synchronization include:
  - Address Block
  - Address
  - Subnet
  - Range
  - Fixed Address
  - DDI DHCP
  - TD RPZ Log (Threat Feed Logs)