Skip to main content
Lantern Home

 

Splunk Lantern

Triaging Tenable Cloud Security findings with an AI agent skill

  1. Last updated
  2. Save as PDF

You are a SOC analyst responsible for examining Tenable Cloud Security posture findings in the Splunk platform. Your team sees a steady stream of open misconfigurations, container image vulnerabilities, and policy violations across AWS, Azure, and GCP — often scoped to Kubernetes clusters and individual workloads.

When you ask an AI assistant to help investigate, the results might be unreliable:

  • SPL targets the wrong data plane (for example, Tenable VM source types like tenable:io:vuln instead of Cloud Security posture events)
  • Searches run without time bounds or count checks, stressing production indexes
  • Cluster and workload names are parsed incorrectly from Tenable resource paths
  • Workload rankings inflate because the same finding appears across multiple container descriptions

The Splunk Tenable Cloud Security Skill is an open-source agent skill that gives AI assistants structured, production-safe guidance for investigating Tenable Cloud Security posture data in the Splunk platform. It is listed on the Tenable CyberAgents Exchange and published on GitHub.

What the skill does

The skill packages domain knowledge that the Splunk platform and Tenable practitioners would otherwise have to re-explain on every investigation:

Capability Detail
Three production workflows Finding inventory, cluster/workload triage, and Tenable policy/account exposure
Count-first SPL guardrails Explicit time bounds, read-only defaults, and row limits before any broad search
Validated field parsing Canonical extraction from resources{}{} with fallback to resources{}, plus a coalesce chain for workload names
Accurate finding counts Uses dc(link) to count unique findings, not raw events
MCP integration Discovers indexes and field names through the Splunk MCP Server before running searches
Human approval gates Requires confirmation before writes, rescans, or response actions

Prerequisites

Tenable Cloud Security data in the Splunk platform

Tenable Cloud Security findings must already be ingested into the Splunk platform. Configure Tenable Cloud Security to send findings through HEC using the Tenable Cloud Security documentation (Navigate to the Tenable One Cloud Exposure User Guide, then Splunk integration).

Typical landing zone:

Field Typical value
Index tenable (validate in your environment)
Event filter type=Finding, status=Open, sentBy=Tenable
Source Ermetic connector or HEC token source name
Source type httpevent (HEC) or connector-specific

Verify ingest before installing the skill by running the following search:

index=tenable type=Finding status=Open earliest=-24h | stats count

Splunk MCP Server

Install and connect the Splunk MCP Server to your AI assistant using the Splunk MCP Server connection documentation.

How to use the Splunk platform for this use case

Step 1: Install the skill

Full installation instructions for all supported AI agents, manual install, and upstream skills are in the GitHub README. To install for Cursor, run:

npx skills add rrossetti-splunk/splunk-tenable-cloud-security-skill --skill splunk-tenable-cloud-security --agent cursor --copy --yes

Add --global to install into your user-level agent skills directory instead of the project directory.

Step 2: Install upstream skills (optional)

Install the splunk-search and search-performance-optimizer skills from splunk/splunk-agent-skills alongside this skill. See the GitHub README Setup section for details.

Step 3: Connect the Splunk MCP Server and verify

  1. Confirm MCP connectivity from your AI client.
  2. Run the ingest verification search listed under Tenable Cloud Security data in the Splunk platform.
  3. Ask a test question, such as "Show open Critical Tenable findings by cluster for the last 7 days".

The agent discovers your index through MCP, runs a count-first search, parses clusters from resources{}{}, and returns structured output with evidence SPL.

If MCP is unavailable, the skill falls back to the upstream splunk-search skill through the splsearch CLI from splunk/splunk-agent-skills. MCP is the default and recommended transport.

Use cases

Finding inventory

Get a count-first rollup of open posture findings by severity, cloud account, or cluster. Example prompts include:

  • Show open Tenable Cloud Security findings by severity for the last 7 days
  • Roll up open findings by AWS account
  • Summarize open Critical findings by cluster
  • List Critical container image findings

The agent returns severity and account rollups, top clusters or finding titles, evidence SPL, and gaps such as unparsed clusters or zero ingest in the time window.

Cluster and workload triage

Rank Kubernetes workloads by open finding count and severity. Example prompts include:

  • Which workloads have the most open Critical findings?
  • Triage container posture findings by cluster
  • Show top 10 workloads by open finding count
  • Which platform workloads (kube-proxy, coredns) have open findings?
  • Prioritize container image CVE findings by workload

Tenable Cloud Security events store cluster context in multi-value resource paths (resources{}{}). Workload names might appear in resourceNames{}, finding descriptions, container image paths, or platform workload patterns.

resourceNames{} is often empty on HEC ingest. The skill applies a validated coalesce chain, uses dc(link) for rankings, and reports parse coverage (WORKLOAD_SCOPED vs CLUSTER_SCOPED vs ACCOUNT_SCOPED).

Tenable policy and account exposure

Support compliance reviews and exposure reporting by rolling up findings against Tenable policies and cloud accounts. Example prompts include:

  • Show policy violations by policy name
  • Break down finding types by cloud account
  • Which accounts have the highest compliance exposure?
  • Tenable compliance exposure by account for the last 30 days

The agent returns policy-level violation counts, account exposure ranked by open finding count, and finding type breakdown (findingType, title, severity).

Production safety guardrails

Rule Default
Count-first Always run stats count before detail searches
Time bounds -7d for triage; widen only when counts are zero and ingest is confirmed
Read-only stats, table, dedup only — writes require explicit approval
Row limits ≤ 100 aggregated rows; ≤ 20 raw events
Finding dedup dc(link) for rankings, not raw event count
Field parsing resources{}{} first, fall back to resources{}
No credentials Never embed HEC tokens or API keys in SPL or output

The agent requires human approval before modifying Splunk Enterprise Security detections, dashboards, or saved searches, triggering Tenable rescans, or any write operation.

Example output

When the skill runs successfully, triage output follows this structure:

## Summary
847 open Tenable Cloud Security findings in the last 7 days. Top cluster: prod-eks-us-east-1 (142 findings, 18 Critical).

## Findings
| Priority | Cluster | Workload | Finding | Severity | Account | Status |
|----------|---------|----------|---------|----------|---------|--------|
| P0 | prod-eks-us-east-1 | kube-proxy | Container Image has vulnerabilities | Critical | prod-aws | WORKLOAD_SCOPED |

## Evidence SPL
<count query>
<aggregation query>

## Gaps
- 12% of Critical findings are ACCOUNT_SCOPED (VM/Azure) — no workload parse available
- resourceNames{} empty on HEC events; using description extraction

## Recommended Next Actions
1. Triage P0 workloads in prod-eks-us-east-1 (kube-proxy, coredns)
2. Review Critical ACCOUNT_SCOPED findings in production-aws

Related integrations

Integration Scope
Tenable VM Add-on Vulnerability scan data (tenable:io:vuln source types) — different data plane
Tenable One API skill Direct Tenable API workflows — not the Splunk platform SPL

For investigation enrichment connecting Tenable exposure context with runtime signals from Isovalent, use the companion correlation skill when both data sources are available in the Splunk platform.

Frequently asked questions

What products do I need?

Splunk Enterprise or Splunk Cloud Platform with Tenable Cloud Security findings ingested, plus the Splunk MCP Server app. You also need an AI client that supports agent skills. Example clients include Cursor, Claude Code, GitHub Copilot, or Codex.

Does this skill configure Tenable or Splunk platform ingestion?

No. Configure ingest separately using the Tenable Cloud Security documentation.

Do I need Splunk Enterprise Security?

No. The skill works against any Splunk platform deployment with Tenable Cloud Security posture data. Splunk Enterprise Security is useful if you want to correlate findings with notables, but it isn't required.

How is this different from asking the AI Assistant to write SPL?

The AI Assistant generates general SPL. This skill encodes Tenable Cloud Security field layouts, validated parsing patterns, count-first guardrails, and workflow routing specific to posture findings — including the resources{}{} multi-value path structure that generic SPL generation often misses.

Where can I get the skill?

Download or install the skill from GitHub or browse the listing on the Tenable CyberAgents Exchange.

Best practices

  1. Count before detail — let the skill enforce count-first discipline.
  2. Use explicit time bounds — default to 7 days; widen only when ingest is confirmed and counts are zero.
  3. Parse resources{}{} first — fall back to resources{} when empty.
  4. Discover before querying — let MCP validate index and field names in each environment.
  5. Keep searches read-only — approve writes explicitly.
  6. MCP first, CLI on fallback — do not mix transports silently.
  7. Extend the platform workload regex — add fleet-specific platform workloads (longest names first) in workload-extraction.md if your clusters use non-standard DaemonSets.

Next steps

Install the skill from GitHub or browse the listing on the Tenable CyberAgents Exchange. Connect the Splunk MCP Server to your AI assistant and verify Tenable Cloud Security ingest with index=tenable type=Finding status=Open earliest=-24h | stats count. Then try a triage prompt, such as "Which workloads have the most open Critical findings in the last 7 days?" To contribute improvements, submit a pull request on GitHub or share related skills on the Tenable CyberAgents Exchange.

You might also find the following resources useful for implementing the guidance in this article: