All Apps and Add-ons

Unique IP and Hosts from Tenable

jaxjohnny2000
Builder

Good day all,

We have data coming into the Tenable Add-on for Security Center. However, it seems that not ALL of the data is there. The polling is 86400, once a day.

At this point we are just trying to validate what we see in Splunk matches what we see in Tenable. We are using the Vulnerailbity Analysis module in tenable.sc which gives us one number. The we run index=tenable | stats dc(ip) for All Time; but we get a completely different number, The unique count is 10's of thousands fewer than what Tenable is reporting.

We are using the filters on pluginID, IP address, etc in Tenable and also in Splunk.

How can we reconcile what we see in Splunk compared to what we see in Tenable for counts?

0 Karma

nkeuning
Communicator

The way the data is stored today you need to run your search against "all time".

0 Karma

ferdydek
Path Finder

On top of the time constrain @nkeuning mentioned, note that the add on will import (by default) the scan results of Access:"usable" scans of the user you've configured to grab the results with.

0 Karma
Get Updates on the Splunk Community!

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...

Splunk Observability Cloud | Enhancing Your Onboarding Experience with the ...

We understand that your initial experience with getting data into Splunk Observability Cloud is crucial as it ...