Where do you install the tenable.sc app? The tenable add-on and tenable app go on SHs. How do you configure it to work? ... View more

HI, We are using the v5.2.3. Is there a way to get the scan name information? Thanks ... View more

try creating account and inputs from cli: $SPLUNK_HOME/TA-tenable/local/ta_tenable_account.conf [credentials] address = tenable.comp.com proxy_enabled = 0 tenable_account_type = tenable_securitycenter_api_keys tenable_sc_access_key = <access_key> tenable_sc_secret_key = <secret_key> verify_ssl = 0   $SPLUNK_HOME/TA-tenable/local/inputs.conf [tenable_securitycenter://Tenable_SC_Vulnerability] fixed_vulnerability = 1 global_account = credentials index = <your_index_name> interval = 86400 start_time = 2022-01-03T00:00:00Z sync_plugins = 1 disabled = 0 max_event_size = 67108864 page_size = 1000 Note: don't forget to change access_key,secret_key and your_index_name  ... View more

I think its related to some time out, I was trying and suddenly it took the input configuration. I later changed the interval to 1 day and i got same error , on second attempt it took the config again and i see logs now.   I will monitor this for a day to see if its stable , or I will raise a case and share the details here.. Thank you again 🙂 ... View more

Please open a case with support.tenable.com and we can help track this down. ... View more

I am using Tenable.sc . Thanks at least now I know what the source time format is in so I can try updating the search I am having an issue converting the date time format as the first_found and last_found dates are in the drilldown part of the query I have tried editing the Source XML with | eval first_found= strfptime(first_found ,"%25Y-%25m-%25dT%25H:%25M:%25S") | eval last_found= strfptime(last_found ,"%25Y-%25m-%25dT%25H:%25M:%25S") However when I do this the dashboard becomes unclickable. ... View more

It started working again which is a mystery. If it stops, i'll be sure to open a case. ... View more

Hi nkeuning Thanks for your information. That means we have to stay with the "Splunk Add-on for Tenable (Nessus)" and hope that the API doesn't change in the future (in Nessus Manager)? Thx ... View more

The new version will be 2.x.x. it depends on view but unique assets in t.sc are unique based on ip, repository.id so you could use that in a splunk search and dedupe. ... View more

It is hard to say without much more detail. Can you please open a case with support.tenable.com and include the following: Latest full log from the add-on Splunk Version Tenable Add-on Version Splunk OS Is the add-on running from a Heavy forwarder? Tenable.sc version List item Please reference this conversation when open the ticket so they can route it accordingly P.S. Given the way the add-on pulls/stores data there is a good chance there were not updates for us to pull for many days even if you scanned something. ... View more

I would make an addition to the example as it is deduping but you may end up removing a version that isn't the latest state. `get_tenable_index` sourcetype="tenable:sc:vuln" | dedup ip, repository.id, pluginID, port, protocol sortby - lastSeen | search state=open OR state=reopened ... View more

Thanks. A Tenable Case #00755880 has been raised already. No luck so far. As you suggested I have searched the index with 'All Time' as time range. Still no data. ... View more

To set debugging go to Tenable Add-On->Configuration->Logging. All of the Add-On logs are stored in the _internal index within splunk: index="_internal" source="ta_tenable" ... View more

Tenable has just released a new app with Tenable.io and SecurityCenter support. https://splunkbase.splunk.com/app/4060/ ... View more