What Splunk apps exist for Tenable IO data?

[danielbb]

We have the following sourcetypes that come through Tenable Add-On for Splunk -

tenable:io:assets
tenable:io:plugin
tenable:io:audit_logs

Is there any app/dashboard that presents this data?

[livehybrid]

Hi @danielbb 

Tenable also publish an app to go with the TA-Tenable app (TenableAppForSplunk) 

The recommended deployment for this is to install the TA and the App on your Searchhead(s):

For more into checkout the app on Splunkbase or the Tenable online docs at https://docs.tenable.com/integrations/Splunk/Content/Welcome.htm

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[sainag_splunk]

Hey @danielbb ,

Did you already check out the developer-supported Tenable App for Splunk? It should work with your sourcetypes:

https://splunkbase.splunk.com/app/4061

Here's the docs for it: https://docs.tenable.com/integrations/Splunk/Content/Splunk2/TenableAppforSplunk.htm

And there's also a full integration guide PDF that might be helpful: https://docs.tenable.com/integrations/Splunk/Content/PDF/Tenable_and_Splunk_Integration_Guide.pdf

This might give you dashboards and visualizations for your Tenable.io data. 



Cheers
If this Helps, Please Upvote

[danielbb]

Hi @sainag_splunk ,

I probably didn't explain it right, the data that flows in is under the following sourcetypes -

tenable:io:vuln

tenable:io:assets

tenable:io:plugin

tenable:io:audit_logs

And the app Tenable App for Splunk at https://splunkbase.splunk.com/app/4061 seems to present only the tenable:io:vuln sourcetype. Are there any other presentations, by any chance, for the assets, plugin, and audit_logs data?

[sainag_splunk · Accepted solution]

@danielbb I wasn't able to find anything; we need to build a brand new one. You should be able to quickly build one using Dashboard examples.
If you have ondemand credits on your account entitlement, you can also leverage PS expert service to build dashboards; they can shoulder surf to get you started.

• Assets Inventory Example:

  index=<your_tenable_index> sourcetype=tenable:io:assets| eval ip=mvindex(ipv4, 0) | stats count by hostname, ip, os, last_seen, tags

• Plugin Overview Example:

  index=<your_tenable_index> sourcetype=tenable:io:plugin | stats count by plugin_name, plugin_id, family

• Audit Log Events Example:

  index=<your_tenable_index> sourcetype=tenable:io:audit_logs | timechart count by action