The vulnerability data being returned by the Tenable API /analysis endpoint is not in sorted order, which is required to prevent data loss. We make the API request to sort the data in ascending order based on lastSeen field here, but the returned API response remains unsorted.
The lack of sorting causes potential for data loss and duplicates as the cursor update depends on .last_event.lastSeen which is incorrect if the data is unsorted.
Looking at the corresponding API documentation here and here, there is also a bug in our implementation. The sort direction should be set using the field sortDir, but our current implementation uses sort_direction. However, during testing it was noticed that the sort order is still not being maintained. Tried several ways: "sortDirection": "ASC", "sortDir": "ASC" , "sort_direction": "ASC" with upper and lowercases, but none of them returned sorted data from the API.
As confirmed/recommended by Tenable, the data returned by the API isn't in sort order.
So remove the existing sort_direction and sortField options. Instead use the lastSeen inside filters query using epoch timestamp (NUM-NUM) syntax to move the cursor.
The vulnerability data being returned by the Tenable API
/analysisendpoint is not in sorted order, which is required to prevent data loss. We make the API request to sort the data in ascending order based on lastSeen field here, but the returned API response remains unsorted.The lack of sorting causes potential for data loss and duplicates as the cursor update depends on
.last_event.lastSeenwhich is incorrect if the data is unsorted.Looking at the corresponding API documentation here and here, there is also a bug in our implementation. The sort direction should be set using the field
sortDir, but our current implementation uses sort_direction. However, during testing it was noticed that the sort order is still not being maintained. Tried several ways:"sortDirection": "ASC", "sortDir": "ASC" , "sort_direction": "ASC"with upper and lowercases, but none of them returned sorted data from the API.As confirmed/recommended by Tenable, the data returned by the API isn't in sort order.
So remove the existing
sort_directionandsortFieldoptions. Instead use thelastSeeninsidefiltersquery using epoch timestamp (NUM-NUM) syntax to move the cursor.