Splunk Add-on for Tenable how does it ingest data?

[rogue670]

In order to properly build trending dashboards as well as "Vulnerability Status" dashboards base on Nessus Professional Vulnerability Scanner, I need to understand how the data is pulled by the add-on. So here is the question.

When scanning multiple times a month does the add-on when interfacing with the Nessus Rest API compare new data with older data and only pull the new stuff? Or does it just ingest everything again.

For example let's say you scan one PC the beginning of the month, Nessus finds 5 total vulnerabilities then you ingest that data in to Splunk. You scan the same PC 2 weeks later and Nessus finds the same 5 vulnerabilities plus 2 new ones. Does the add-on at that point compare and ingest only the 2 new vulneribilities?

[Richfez]

Speaking from knowledge of the Splunk Add-on for Tenable with respect to pulling Tenable Security Center vulnerability data, it pulls the data available from scans after the last checkpoint. There's no intelligence with respect to past scans.

Concrete example: If you create a scan to run daily in SC and you have your Add-on checking data every 60 seconds, the timeline is simply that once your scan finishes on one day, the next data collection pass (between 0 and 60 seconds from then) will collect all the information that scan contains. The next day the exact same thing happens - the scan runs, Splunk sees a finished scan result so it pulls that in its entirety in as well.

That does complicate some things slightly, but makes the overall end user methods of getting information on dashboards more consistent in that you always have to use max() and last() type stats functions on scans.