All Apps and Add-ons

Unique IP and Hosts from Tenable

jaxjohnny2000
Builder

Good day all,

We have data coming into the Tenable Add-on for Security Center. However, it seems that not ALL of the data is there. The polling is 86400, once a day.

At this point we are just trying to validate what we see in Splunk matches what we see in Tenable. We are using the Vulnerailbity Analysis module in tenable.sc which gives us one number. The we run index=tenable | stats dc(ip) for All Time; but we get a completely different number, The unique count is 10's of thousands fewer than what Tenable is reporting.

We are using the filters on pluginID, IP address, etc in Tenable and also in Splunk.

How can we reconcile what we see in Splunk compared to what we see in Tenable for counts?

0 Karma

nkeuning
Communicator

The way the data is stored today you need to run your search against "all time".

0 Karma

ferdydek
Path Finder

On top of the time constrain @nkeuning mentioned, note that the add on will import (by default) the scan results of Access:"usable" scans of the user you've configured to grab the results with.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...