I am experiencing the same issue as gharrison90 in the Splunk TA Nessus add-on 5.0.0.
Inside the Splunk_TA_nessus/bin/nessus_config.py file, it appears that there is no check or conversion of the configuration string value to the proper boolean value.
line 52: self.fields_scan = ("index_events_for_unsuccessful_scans")
This makes it look like it is storing the value as a string, which will always evaluate to true unless it is an empty string.
A similar issue appears in the Splunk_TA_nessus/bin/nessus_data_collector.py file as well, where it does not appear that it is doing any check to convert the string value to a boolean true or false. It just looks like it is checking if a value is set.
line 140: if self.config.get("index_events_for_unsuccessful_scans", True):
Any one else able to verify this?
... View more