Ingesting Tenable Vulerability and STIG Audit separately. . .

[KglassCACI]

We use Tenable Nessus (and Security Center) for enterprise scanning of both vulnerabilities and STIG compliance. Can someone suggest a way to split that feed into two separate indexes, one for Vulns and one for Audit ? I was thinking along the lines of an intermediate index, and then filtering on the "(compliance)true(/compliance)" (that's actually XML) field in the plugin-text field. and then pushing the result for records with, and without, the value, to the appropriate index.. . The problem is, that the string is the BEGINNING of the plugin-text field, and not the entire field. . .

[stevesmd]

If you are using the Tenable Add-on for Splunk
You can pull out compliance scan results separately with sourcetype=tenable:sc:vuln "family.type"=compliance. Within the pluginText field values you can find the results of your compiance scan, PASSED, INFO, FAILED, & ERROR.

I had to use some regex to pull out the results cleanly. You should also look at the xref field if your compliance scans include more than just Windows systems. I had to separate out database and Windows on my systems where SQL and Windows are installed so I could see specific resullts.