Webhook SIEM Tenable

Hi ​@Elisangela 

Thank you for your post. 

To help ensure all of our members can easily read and respond, I've gone ahead and added an English translation via Google Translate below your original text.

We appreciate you being an active part of our forum, and we look forward to seeing the community's responses to your inquiry!

Thanks ​@ErikaB ! I'm creating a webhook in SIEM to configure with Tenable. Is it necessary to create a flow? What would that flow be? I added the SIEM URL to the Tenable webhook (integration), but the logs aren't reaching the SIEM. What exactly needs to be configured in SIEM? I'm having trouble creating this integration. Thank you in advance for your help.

​@Elisangela What product are we talking about here? Tenable SC? I know Tenable uses IP whitelisting to block access to their tenant outside of Corp network.

Otherwise the SIEM integration with webhook is pretty straight forward using the Ingestion API:

https://cloud.google.com/chronicle/docs/reference/ingestion-api

https://cloud.google.com/chronicle/docs/reference/ingestion-methods

Hi ​@ionutm , we're talking about Tenable Security Cloud.

Thanks Elisangela! Please let me know if you took care of the whitelisting and still having the same issue.

​@ionutm I'll let you know. Thank you for the information.