Skip to content

[tenable_io] - Preserve severity_level filter across export cycles - #19715

Merged
ShourieG merged 3 commits into
elastic:mainfrom
ShourieG:bugfix/tennable_7298
Jun 23, 2026
Merged

[tenable_io] - Preserve severity_level filter across export cycles#19715
ShourieG merged 3 commits into
elastic:mainfrom
ShourieG:bugfix/tennable_7298

Conversation

@ShourieG

@ShourieG ShourieG commented Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Type of change

  • Bug

Proposed commit message

tenable_io: preserve severity_level filter across export cycles

The vulnerability data stream collects findings through the Tenable vulns
export API using the CEL input. The severity filter was set on the initial
CEL state and the first export request, but the state-rebuild blocks for
status polling, chunk fetching, cancellation, and error paths did not carry
severity_level forward. Once the first export completed, severity_level was
dropped from the persisted state, so every subsequent export omitted the
filter and Tenable returned all severities, including info. Info-severity
findings continued to be ingested even when the policy excluded them.

Carry severity_level through every state-rebuild block, matching how the
other persistent state fields are propagated. Strengthen the vulnerability
system test to exercise at least two export cycles against a mock that
rejects exports missing the severity filter, so the regression is caught.

Changing the mock to return body:[] instead of body:null removes cel EOF errors during tests

Note

The updated system test mocks are derived from pre-existing system test mocks and do not contain any customer centric data.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots
@ShourieG @cursoragent
tenable_io: preserve severity_level filter across export cycles
6d1a197 
The vulnerability data stream collects findings through the Tenable vulns
export API using the CEL input. The severity filter was set on the initial
CEL state and the first export request, but the state-rebuild blocks for
status polling, chunk fetching, cancellation, and error paths did not carry
severity_level forward. Once the first export completed, severity_level was
dropped from the persisted state, so every subsequent export omitted the
filter and Tenable returned all severities, including info. Info-severity
findings continued to be ingested even when the policy excluded them.

Carry severity_level through every state-rebuild block, matching how the
other persistent state fields are propagated. Strengthen the vulnerability
system test to exercise at least two export cycles against a mock that
rejects exports missing the severity filter, so the regression is caught.

Co-authored-by: Cursor <cursoragent@cursor.com>
@ShourieG ShourieG self-assigned this Jun 23, 2026
@ShourieG ShourieG added Integration:tenable_io Tenable Vulnerability Management bugfix Pull request that fixes a bug issue labels Jun 23, 2026
@github-actions

github-actions Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.
@ShourieG ShourieG added the Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] label Jun 23, 2026
@ShourieG
ShourieG marked this pull request as ready for review June 23, 2026 09:45
@ShourieG
ShourieG requested review from a team as code owners June 23, 2026 09:45
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jun 23, 2026

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
@vera-review-bot

vera-review-bot Bot commented Jun 23, 2026

Copy link
Copy Markdown

👀 I have started reviewing the PR
@vera-review-bot

vera-review-bot Bot commented Jun 23, 2026

Copy link
Copy Markdown

Vera Review Bot

For the current commit state, I did not find any issues.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
kcreddy
kcreddy reviewed Jun 23, 2026
View reviewed changes
Comment thread packages/tenable_io/_dev/deploy/docker/files/config.yml
Comment thread packages/tenable_io/data_stream/vulnerability/_dev/test/system/test-default-config.yml Outdated
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.
@vera-review-bot

vera-review-bot Bot commented Jun 23, 2026

Copy link
Copy Markdown

👀 I have started reviewing the PR
kcreddy
kcreddy approved these changes Jun 23, 2026
View reviewed changes

@kcreddy kcreddy left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!
@vera-review-bot

vera-review-bot Bot commented Jun 23, 2026

Copy link
Copy Markdown

Vera Review Bot

For the current commit state, I did not find any issues.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.
@elasticmachine

elasticmachine commented Jun 23, 2026

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @ShourieG
@mergify

mergify Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request
@ShourieG
ShourieG merged commit 3591627 into elastic:main Jun 23, 2026
9 checks passed
@ShourieG
ShourieG deleted the bugfix/tennable_7298 branch June 23, 2026 14:14
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Package tenable_io - 4.11.2 containing this change is available at https://epr.elastic.co/package/tenable_io/4.11.2/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:tenable_io Tenable Vulnerability Management Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants

@ShourieG @elasticmachine @kcreddy