The whole design of the app is to duplicate as little data a possible. We only index data based on the firstSeen or first_found date for each vulnerability on each host. We only create a new event when the state of the vulnerability changes. After the initial run of the input we only pull differential data. Given the basic design above we rely on splunk deduping functionality on event creation to see events are identical and not create duplicate events if for some reason duplicate data happens during a differential pull, which is very rare it could even happen. ... View more

Hi rrustong, You are correct, we store only one event for each open vulnerability. This event is created/stored based on the firstSeen/first_seen date field. Your logic is correct, the only thing i might suggest is some de-duping and leveraging the state field. Here is an example i would use for SecurityCenter data: get_tenable_index\ sourcetype="tenable:sc:vuln" | dedup ip, repository.id, pluginID, port, protocol | search state=open OR state=reopened basically this gets the correct index, limits data to SC vulnerabilities, dedupes data so we only get the most recent vuln events for every host and then limits the results to only open or reopened vulns so we dont show fixed vulns. Sincerely, Nick ... View more