# Tenable.io integration - missing FIXED vulnerabilities **URL:** \ **Category:** Elastic Agent\ **Tags:** integrations\ **Created:** [March 23, 2023, 2:04pm UTC](https://discuss.elastic.co/t/tenable-io-integration-missing-fixed-vulnerabilities/328351 "2023-03-23T14:04:14Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![marrc.rousseau](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@marrc.rousseau](https://discuss.elastic.co/u/marrc.rousseau)\ **Post date:** [March 23, 2023, 2:04pm UTC](https://discuss.elastic.co/t/tenable-io-integration-missing-fixed-vulnerabilities/328351/1 "2023-03-23T14:04:14Z")
Hello, I started to test [tenable.io](http://tenable.io) integration (great work BTW) and found a little issue. Vulnerabilities with state FIXED are missing in logs-tenable\_io.vulnerability indexes, I can only find OPEN and REOPENED events. In tenable API doc it's written that if you don't specify a state in body, it will return OPEN, REOPENED, FIXED states : [Refine Vulnerability Export Requests](https://developer.tenable.com/docs/refine-vulnerability-export-requests#request-body-example-1-since-only) I did a test and API behavior looks different : ```auto --------- TEST 1 : no state filter (exactly what do tenable.io integration) ---------- JSON body : { "num_assets": 50, "filters": { "last_found": 1653655049, } } Results : count state ----- ---- 317 OPEN 167 REOPENED --------- TEST 2 : state filter ---------- JSON body : { "num_assets": 50, "filters": { "state": [ "open", "reopened", "fixed" ], "last_found": 1653655049, } } Results : count state ----- ---- 317 OPEN 167 REOPENED 63 FIXED ``` Looks like if you don't specify state=open,reopened,fixed in json body, you will never get fixed vulnerabilities. - Someone has the same issue ? - If yes, how to request a modification in [integrations/httpjson.yml.hbs at main · elastic/integrations · GitHub](https://github.com/elastic/integrations/blob/main/packages/tenable_io/data_stream/vulnerability/agent/stream/httpjson.yml.hbs) to add (not sure of syntax) ```auto - set: target: body.filters.state value: '[open,reopened,fixed]' ``` CC: @jamie.hynds Thanks ---
**Author:** ![jamie.hynds](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamie.hynds/32/84205_2.png) [@jamie.hynds](https://discuss.elastic.co/u/jamie.hynds)\ **Post date:** [March 24, 2023, 11:00am UTC](https://discuss.elastic.co/t/tenable-io-integration-missing-fixed-vulnerabilities/328351/2 "2023-03-24T11:00:56Z")
Thanks for flagging this @marrc.rousseau - we're investigating this on our side and will report back shortly 🙂 ---
**Author:** ![marrc.rousseau](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@marrc.rousseau](https://discuss.elastic.co/u/marrc.rousseau)\ **Post date:** [March 24, 2023, 11:39am UTC](https://discuss.elastic.co/t/tenable-io-integration-missing-fixed-vulnerabilities/328351/3 "2023-03-24T11:39:42Z")
Thanks @jamie.hynds Quick update : API documentation seems to confirm what I saw: [https://developer.tenable.com/reference/exports-vulns-request-export](https://developer.tenable.com/reference/exports-vulns-request-export) > state > array of strings > (...) > This parameter is required if your request includes `first_found`, `last_found`, or `last_fixed`parameters. If your request omits this parameter, the export includes default states `open` and `reopened` only. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 21, 2023, 11:40am UTC](https://discuss.elastic.co/t/tenable-io-integration-missing-fixed-vulnerabilities/328351/4 "2023-04-21T11:40:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.