All Apps and Add-ons

Splunk Add-on for Tenable: No Data

edwinmae
Path Finder

Hi,

I installed the Tenable Add-on for Tenable, but I don's see any data or events

When checking the nessus index, it's 0 -- so there is no traffic/data

I use Splunk v7.0 and have Security Center 5.6.0

The only 2 lines in the ta_nessus.log
2017-12-07 10:21:37,796 INFO pid=61967 tid=MainThread file=nessus_config.py:get_nessus_conf:71 | Try to get encrypted proxy username & password
2017-12-07 10:21:37,796 INFO pid=61967 tid=MainThread file=nessus.py:get_nessus_modinput_configs:142 | Set loglevel to WARN

--

inputs.conf (/opt/splunk/etc/apps/Splunk_TA_nessus/local)

[nessus://xxxxx]
access_key = ********
batch_size = 100000
index = nessus
interval = 43200
metric = nessus_scan
secret_key = ********
start_date = 2017/11/01
url = https://xxxxx:8834

--

Please advise

/Edwin

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @edwinmae,

Does your issue resolve? If it is resolved then can you please share your workarounds?

Thanks

0 Karma

edwinmae
Path Finder

Actually, the hostname could not be resolved. With the IP address it seems to work

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

is that a complete log you provided from ta_nessus.log??

0 Karma

Yunagi
Communicator

Hello Edwin,

Here are a few thoughts:

1) Check that your Splunk instance is able to connect to your Security Center on port 8834. You can check via:

curl -k https://xxxxx:8834

2) When adding a Security Center Server in Splunk, you must specify a username and a password. Make sure that this user has sufficient permissions to access the scans in Security Center.

3) When running your Splunk search (index=nessus) set the time range to the last 30 days or even longer. The default search time range is 24 hours but the scan results might be older than that.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...