Ingest Tenable vulnerability findings, scan events, and audit logs

Latest Dynatrace Preview

Tenable provides robust solutions for identifying, prioritizing, and addressing vulnerabilities, which are crucial for reducing cyber risks and securing digital infrastructure. Integrating Tenable findings into Dynatrace can enhance your overall security posture by ensuring comprehensive visibility and streamlined vulnerability management.

Explore in Dynatrace Hub

Ingest Tenable vulnerability findings, scan events, and audit logs.

How it works

Dynatrace integration with Tenable is an extension running on Dynatrace ActiveGate. Once you enable and configure the Dynatrace Tenable extension

Prerequisites

Supported Tenable products

Tenable requirements

Dynatrace requirements

Get started

Now you can visualize findings, analyze audit logs and automate notifications.

Visualize

Example result:

Analyze

Open Notebooks or Security Investigator to query ingested data, using the data format in Semantic Dictionary.

For examples of how you can build your queries, see below.

Query for logs over time by action

fetch logs
| filter log.source == "Tenable"
| makeTimeseries logs=countDistinctExact(id), by:{audit.action}, time:{toTimestamp(received)}, interval:{3h}

Example result:

Query for vulnerability distribution by risk level

fetch events
| filter dt.system.bucket=="default_security_custom_events"
| filter event.kind == "SECURITY_EVENT" and event.type == "VULNERABILITY_FINDING"
| filter event.provider == "Tenable"
| dedup {object.id, vulnerability.id}, sort:{timestamp}
| summarize Vulnerabilities=countDistinctExact(vulnerability.id), by:{dt.security.risk.level}
| fieldsAdd order=if(dt.security.risk.level=="CRITICAL", 1, else:
                  if(dt.security.risk.level=="HIGH", 2, else:
                  if(dt.security.risk.level=="MEDIUM", 3, else:
                  if(dt.security.risk.level=="LOW", 4, else:5))))
| sort order asc

Example result:

Query for top 10 scans with the most host coverage

fetch events
| filter dt.system.bucket=="default_security_custom_events"
| filter event.kind == "SECURITY_EVENT" and event.type == "VULNERABILITY_SCAN"
| filter event.provider == "Tenable"
| dedup {object.id, scan.id}
| summarize Hosts=countDistinctExact(object.id), by:{scan.name}
| sort Hosts desc
| limit 10

Example result:

Automate notifications

Consumption

For billing information, see Events powered by Grail.

FAQ

Why does my configuration show an error?

Error message: Failed to assign monitoring configuration to ActiveGate. Reason: Extension com.dynatrace.extension.tenable(<version-number>) not available in cache yet (queued for download)

If your configuration shows the error message above, it simply means that ActiveGate is still downloading the extension for the cluster. The status should change after a few minutes.

Why do I see duplicate events?

Duplicate events in the Tenable extension are likely due to the first ingest running multiple times. When a monitoring configuration is assigned to an ActiveGate, the first execution will run an export for a longer timeframe (configurable in the monitoring configuration settings). Anytime the extension is restarted (due to an update, ActiveGate reset, failover, and so on), the first ingest will run again.

You can run a DQL query and dedup the events using the object.id, scan.id, and finding.id fields.

Example:

fetch events
| filter dt.system.bucket=="default_security_custom_events"
| filter event.kind == "SECURITY_EVENT" and event.type == "VULNERABILITY_FINDING"
| filter event.provider == "Tenable"
| dedup {object.id, finding.id}, sort:{timestamp}

Why do some scan events have the same start and end times?

When fetching vulnerabilities, the Tenable extension attempts to match the data with recent scan executions. If the scan mentioned in the Tenable vulnerability can't be found (for example, due to missing permissions), the extension creates a scan event based on this finding. These scan events have the same start and end times as when the vulnerability was found.

Why isn't my data ingested?

If you installed and configured the extension, but data isn’t being ingested, follow the steps below.

Common causes for missed data ingest include: