Tenable Add-On for Splunk
Overview
Details
Splunk Cloud Support
If a version of our app is not yet supported on Splunk Cloud, you can request it be approved following this process: http://dev.splunk.com/view/app-cert/SP-CAAAE85
Unfortunately we can no longer request this.
Documentation
Upgrading from V1 to V2/3:
Upgrade Documentation
Backup your current app/configurations outside of the Splunk install path
Delete the app and all app configuration files from all Splunk search heads and heavy forwarders from the command line.
* rm -rf $SPLUNK_HOME/etc/apps/TA-tenable/
Install the V2 app (See How-To Guide)
Configure an account. (See How-To Guide)
Create a new index to store data in. (See How-To Guide) (You can't re-use an existing index as data formats have changed and it will be impossible to ensure numbers between your Tenable platform and Splunk are correct)
Configure an input. (See How-To Guide)
* Ensure that you have use the new index you created above
V2 Changelog:
- Global:
- Moved proxy configuration to a per account rather than global for all accounts
- Added the ability to set a cron schedule for any input or interval seconds
- Added Nessus Network Monitor (NNM) real-time event support/parsing
- Moved from pulling vulnerabilities only when the state (open/reopened/fixed) changed to pulling data any time it is updated
- Tenable.sc
- Changed event index time for vulnerabilities from firstSeen to lastSeen
- Added input type for Tenable.sc Mobile data
- Moved to using Tenable.sc query name for pulling information
- If Tenable.sc >= 5.7 is detected, you can now specify >= 1-hour interval rather than 1 day with Tenable.sc < 5.7
- Added field aliases so all Tenable.sc fields can be searched for using the Tenable.io field naming convention.
- Added a new input for Teneable.sc Mobile vulnerability data
- Moved from pulling data with the firstSeen variable to lastSeen for open/reopened vulnerabilities
- Tenable.io
- Changed event index time for vulnerabilities from first_found to last_found
- Moved from pulling data with the since variable to last_found for open/reopened and last_fixed for fixed vulnerabilities
- Added the ability to pull all historically fixed vulnerabilities on first input sync
- Added the ability to use Tenable.io assets tags to limit what vulnerabilities are synced
- Added Adaptive Response Actions:
- Get Vulnerability Summary
- Request Scan
- Nessus Network Monitor (NNM)
- Added the ability to extract realtime syslog messages from NNM
Release Notes
Version 3.0.0
Add tenable:io:plugins sourcetype that pulls plugin details directly from Tenable.io API
Moved to pyTenable for all Tenable platform interactions
Improved code documentation
Improved how asset state is set for Tenable.io
All Tenable code is fully Python 3 compatible
v3.1.0 will include Splunk library updates and add support for python 3 and Splunk 8
Version 2.0.3
Fixed an issue where duplicate events were being created