topic Re: What Splunk apps exist for Tenable IO data? in Dashboards & Visualizations

What Splunk apps exist for Tenable IO data?

danielbb — Fri, 30 May 2025 16:52:53 GMT

We have the following sourcetypes that come through Tenable Add-On for Splunk -

tenable:io:assets
tenable:io:plugin
tenable:io:audit_logs

Is there any app/dashboard that presents this data?

Re: What Splunk apps exist for Tenable IO data?

sainag_splunk — Fri, 30 May 2025 21:58:15 GMT

Hey @danielbb ,

Did you already check out the developer-supported Tenable App for Splunk? It should work with your sourcetypes:

https://splunkbase.splunk.com/app/4061

Here's the docs for it: https://docs.tenable.com/integrations/Splunk/Content/Splunk2/TenableAppforSplunk.htm

And there's also a full integration guide PDF that might be helpful: https://docs.tenable.com/integrations/Splunk/Content/PDF/Tenable_and_Splunk_Integration_Guide.pdf

This might give you dashboards and visualizations for your Tenable.io data.

Cheers
If this Helps, Please Upvote

Re: What Splunk apps exist for Tenable IO data?

livehybrid — Sat, 31 May 2025 07:01:16 GMT

Hi @danielbb

Tenable also publish an app to go with the TA-Tenable app (TenableAppForSplunk)

The recommended deployment for this is to install the TA and the App on your Searchhead(s):

For more into checkout the app on Splunkbase or the Tenable online docs at https://docs.tenable.com/integrations/Splunk/Content/Welcome.htm

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: What Splunk apps exist for Tenable IO data?

danielbb — Mon, 02 Jun 2025 17:09:37 GMT

Hi @sainag_splunk ,

I probably didn't explain it right, the data that flows in is under the following sourcetypes -

tenable:io:vuln

tenable:io:assets

tenable:io:plugin

tenable:io:audit_logs

And the app Tenable App for Splunk at https://splunkbase.splunk.com/app/4061 seems to present only the tenable:io:vuln sourcetype. Are there any other presentations, by any chance, for the assets, plugin, and audit_logs data?

Re: What Splunk apps exist for Tenable IO data?

sainag_splunk — Mon, 02 Jun 2025 20:28:15 GMT

@danielbb I wasn't able to find anything; we need to build a brand new one. You should be able to quickly build one using Dashboard examples.
If you have ondemand credits on your account entitlement, you can also leverage PS expert service to build dashboards; they can shoulder surf to get you started.

Assets Inventory Example:

index=<your_tenable_index> sourcetype=tenable:io:assets| eval ip=mvindex(ipv4, 0) | stats count by hostname, ip, os, last_seen, tags
Plugin Overview Example:

index=<your_tenable_index> sourcetype=tenable:io:plugin | stats count by plugin_name, plugin_id, family
Audit Log Events Example:

index=<your_tenable_index> sourcetype=tenable:io:audit_logs | timechart count by action