When first configuring the Tenable.io connector to Vulcan, This is highly recommended to conduct a data comparison between the numbers.
The two most common reasons to have asset count differences are two possible issues:
Licensed assets - Vulcan is ingesting only licensed assets, and Tenable UI showing all the assets.
Limited access - The Vulcan user created for the connector has limited access due to configuration on access groups on the Tenable side.
1. Licensed assets
Since March-18, Vulcan is able to ingest only licensed assets from Tenable.
To see the number of licensed assets on Tenable, check the following:
Enter Tenable and to Settings --> License
See the number of Licensed assets your organization has:
3. Now, Go and make sure you see all the available licensed assets before going to the specific comparisons.
Go to the assets view --> Choose to see the last 90m days:
4. On the same view, go to the search and apply the filters:
"Is licensed" - "Is equal to" - "True".
"Is deleted" - "Is equal to" - False.
5. Next to the search, you will see the number of licensed assets from the last 90 days.
6. Now, after we verified the numbers are aligned with the licensed assets number from the setting to the assets table, please return the time frame from "90 days" to "30 days" for the compression with Vulcan:
7. Now, next to the search, we can see the licensed assets that are active in the last 30 days. This is the default time frame Vulcan is ingesting. Now you will see a lower number of assets:
8. Go to Vulcan --> Assets view --> Tenable assets count:
2. Limited access due to Access groups configuration
Another option that can cause different asset counts is if the Vulcan user has limited access by being configured to an access group with limited capabilities.
To check if the Vulcan user has limited access, check the following:
Go to settings-->Users
Hover over the Vulcan user, and choose on the right side the option to "User Assist".
Click on the "User assist" option.
4. Now, you will see the numbers that the user is exposed to:
If the numbers you are seeing as a Vulcan user are different from the numbers you are expecting to see, the Vulcan user has limited access and under a limited access group.
To change that, go to the "Access group" section and add the Vulcan user to the same group that your user have access to.