Tenable Add-On for Splunk
Overview
Details
Splunk Cloud Support
If a version of our app is not yet supported on Splunk Cloud, you can request it be approved following this process: http://dev.splunk.com/view/app-cert/SP-CAAAE85
Unfortunately we can no longer request this.
Documentation
Upgrading from V1 to V2/3/4:
Upgrade Documentation
Backup your current app/configurations outside of the Splunk install path
Delete the app and all app configuration files from all Splunk search heads and heavy forwarders from the command line.
* rm -rf $SPLUNK_HOME/etc/apps/TA-tenable/
Install the latest app (See How-To Guide)
Configure an account. (See How-To Guide)
Create a new index to store data in. (See How-To Guide) (You can't re-use an existing index as data formats have changed and it will be impossible to ensure numbers between your Tenable platform and Splunk are correct)
Configure an input. (See How-To Guide)
* Ensure that you have use the new index you created above
Release Notes
Version 4.0.1
* Updated pyTenable version
* Added hard-coded python 3 for Splunk Cloud support
* Fix eval-dest in props.conf for tenable:io:vuln
* Lowered the Tenable.io vulnerability download page size to 500 from 1000 to lower memory usage.