Skip to content

[tenable_sc] Add support of new fields to vulnerability data stream - #18274

Merged
brijesh-elastic merged 3 commits into
elastic:mainfrom
brijesh-elastic:tenable_sc-2.2.0
Apr 10, 2026
Merged

[tenable_sc] Add support of new fields to vulnerability data stream#18274
brijesh-elastic merged 3 commits into
elastic:mainfrom
brijesh-elastic:tenable_sc-2.2.0

Conversation

@brijesh-elastic

@brijesh-elastic brijesh-elastic commented Apr 8, 2026 •
edited by efd6
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

tenable_sc: add support for new fields to vulnerability data stream

This PR introduces support for new data fields as specified in the
documentation examples[1]. Additionally, it updates the mapping logic
for the vulnerability.score.base field to prioritize CVSS v4 over v3.

[1] https://docs.tenable.com/security-center/api/Analysis.htm

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/tenable_sc directory.
  • Run the following command to run tests.

elastic-package test -v
@brijesh-elastic brijesh-elastic self-assigned this Apr 8, 2026
@brijesh-elastic brijesh-elastic added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:tenable_sc Tenable Security Center Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Apr 8, 2026
@brijesh-elastic
brijesh-elastic requested a review from a team as a code owner April 8, 2026 09:52
@elasticmachine

elasticmachine commented Apr 8, 2026

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
@github-actions

github-actions Bot commented Apr 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Vale Linting Results

Summary: 1 suggestion found

💡 Suggestions (1)
File Line Rule Message
packages/tenable_sc/docs/README.md 688 Elastic.WordChoice Consider using 'efficient' instead of 'easy', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Apr 8, 2026

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
efd6
efd6 reviewed Apr 9, 2026
View reviewed changes
Comment thread ...tenable_sc/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json

@efd6 efd6 Apr 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we have test inputs that exercise cvssV4ThreatVector and cvssV4Supplemental, and non-empty cvssV4ThreatScore?

@brijesh-elastic brijesh-elastic Apr 9, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, 0da528a.
Comment thread packages/tenable_sc/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml Outdated
Comment on lines +177 to +180
- set:
field: vulnerability.score.version
value: '4.0'
if: ctx.vulnerability?.score?.base != null

@efd6 efd6 Apr 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is brittle. I would prefer that the condition be based on the existence of tenable_sc.vulnerability.cvss_v4_base_score. At the moment, this depends on the arrangement of the processors and requires that the reader looks around to see what assigned vulnerability.score.base. Similar below.

@brijesh-elastic brijesh-elastic Apr 9, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agree, Updated in 0da528a.
Comment thread packages/tenable_sc/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml Outdated
- set:
field: vulnerability.score.version
value: '3.0'
if: ctx.vulnerability?.score?.base != null && ctx.vulnerability?.score?.version == null

@efd6 efd6 Apr 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if: ctx.vulnerability?.score?.base != null && ctx.vulnerability?.score?.version == null
if: ctx.vulnerability?.score?.base != null && ctx.vulnerability.score.version == null

but see the comment above.
@elasticmachine

elasticmachine commented Apr 9, 2026

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @brijesh-elastic
@brijesh-elastic
brijesh-elastic requested a review from efd6 April 9, 2026 07:21
@brijesh-elastic
brijesh-elastic merged commit 0406096 into elastic:main Apr 10, 2026
13 checks passed
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Apr 10, 2026

Copy link
Copy Markdown
Contributor

Package tenable_sc - 2.2.0 containing this change is available at https://epr.elastic.co/package/tenable_sc/2.2.0/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:tenable_sc Tenable Security Center Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants

@brijesh-elastic @elasticmachine @efd6