All Apps and Add-ons

What is the difference between Splunk Add-on for Tenable vs. Tenable Add-on for Splunk

rsanders30
Path Finder

I am recently trying to ingest data from Tenable to our Splunk environment. I noticed there are 2 add-ons available. I first used Tenable Add-on for Splunk and didn't have much issues. However, I noticed there was a Splunk add-on for Tenable. What's the difference between the 2?

Also, did anyone experience reports missing from Tenable SC after configuring the Splunk Tenable App? My IA team mentioned they no longer see their reports after I started ingesting the reports to Splunk.

Thanks!

0 Karma

KglassCACI
Explorer

We are comparing the two, by looking at events, and comparing them. The Tenable add-on for Splunk seems to add a lot more data fields, specific to the discovered vulnerability. But the Splunk Add-on for Tenable seems to give more data on the host with the vulnerability.

Our next step is to run both, and compare an identical event record in both plugins.

0 Karma

sosjoe1
New Member

Did you ever come to a conclusion on this?

0 Karma

whrg
Motivator

Hello @rsanders30,

I used the "Splunk Add-on for Tenable" some time ago. I'm not sure the "Tenable Add-On for Splunk" existed back then.

What we can tell from splunkbase is that the Tenable Add-On for Splunk is authored by Tenable. (I didn't verify.)
The Splunk Add-on for Tenable is authored by Splunk.
You can see that on Spunkbase under "BUILD BY".

Also, it appears that the "Tenable Add-On for Splunk" was recently updated on Oct. 30, 2018.
However, the "Splunk Add-on for Tenable" was last updated on May 10, 2018.

Given that the "Tenable Add-On for Splunk" appears to be directly from Tenable and that it was recently updated, I suggest you use this one.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...