All Apps and Add-ons

differentiating between scap and vuln scan in tenable app

murhammr
Path Finder

we configured the nessus TA via the web interface to extract data from Security Center.

[xxx]
batch_size = 10000
data = sc_vulnerability
index = xxx

i see vulnerability scans and SCAP scans, all under sourcetype=tenable:sc:vuln. what is the best way to differentiate between these 2 types of scan results? My best guess right now is pluginName=SCAP* to identify SCAP scan results but I am not sure this is correct.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...