Unique IP and Hosts from Tenable

[jaxjohnny2000]

Good day all,

We have data coming into the Tenable Add-on for Security Center. However, it seems that not ALL of the data is there. The polling is 86400, once a day.

At this point we are just trying to validate what we see in Splunk matches what we see in Tenable. We are using the Vulnerailbity Analysis module in tenable.sc which gives us one number. The we run index=tenable | stats dc(ip) for All Time; but we get a completely different number, The unique count is 10's of thousands fewer than what Tenable is reporting.

We are using the filters on pluginID, IP address, etc in Tenable and also in Splunk.

How can we reconcile what we see in Splunk compared to what we see in Tenable for counts?

[nkeuning]

The way the data is stored today you need to run your search against "all time".

[ferdydek]

On top of the time constrain @nkeuning mentioned, note that the add on will import (by default) the scan results of Access:"usable" scans of the user you've configured to grab the results with.