Why are we missing data on Tenable Add-On?

[andrew_burnett]

We have an issue where Splunk is not showing vulnerabilities in fixed state, but Tenable Cloud has the correct information. So we're likely losing data between Tenable Cloud and Splunk at least for the update of the fixed status of vulnerabilities, but I have no clue why. Logs look clean, we're getting data. And the issue cannot be on Tenable side since they have the correct data and we collect that right off the API. Any ideas?

[etoombs]

If you're still having this issue, check your logs for the lag between event time and index time. The Tenable add-on pulls all of your open vulnerability data first, and only pulls in the fixed data after all of the open stuff is complete. If you've got a large lag time, it may not be getting as far as actually pulling in the fixed vulns.  

Check the  /opt/splunk/etc/apps/TA-tenable/default/inputs.conf, (and the local inputs.conf if you have one) and look for the "page_size". Increasing this number may resolve the issue. When I was troubleshooting a similar issue, Tenable indicated the number hadn't been changed - but it was set to 1000 - meaning it ran API calls for 1000 records at a time - and wasn't ever finishing with a large number of vulns.   We increased this to 10000, reducing the api calls by a factor of 10 - and allowing the process to complete so all our vulns got pulled in. 

[richgalloway]

Are you sure the fixed vulnerabilities are reported to Splunk?  Use tcpdump or wireshark (or similar) to confirm the data gets from Tenable to Splunk.

How are you searching for fixed vulns?  If you search the entire index (index=tenable earliest=-30d latest=+30d) do you see any fixed events?

[andrew_burnett]

No the issue is that it's not getting to Splunk, but I have no clue why that would be. The data is in Tenable Cloud but not getting to Splunk apparently.

[richgalloway]

If the data is not getting into Splunk then there should be a log message, either on the Splunk or Tenable side, explaining why.

Is the add-on installed properly? On which instance type(s) is it installed?  Is it configured?

Have you confirmed network connectivity between Splunk and Tenable?