# Splunk Tenable Cloud Security Skill

> Query and triage Tenable Cloud Security posture findings in Splunk via the official Splunk MCP Server.

- Type: Skill
- Author: rrossetti-splunk
- License: Apache-2.0
- Trust tier: vetted (passed the Exchange Inspector security review process)
- Vetted on: 2026-09-23
- Vetted commit: ebae3496f5490c01006b1c783f0129649d762195. The security review covers that commit only; anything pushed after it is unreviewed
- Commits since vetted: 0 (0 means the reviewed code is current)
- Last reviewed: 2026-09-23
- Source repository: https://github.com/rrossetti-splunk/splunk-tenable-cloud-security-skill
- Repo state: not archived
- Last push: 2026-08-17T20:31:30Z
- Stars: 2 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Splunk, Tenable
- Domains: cloud-security, security-operations
- Tags: splunk, tenable, cloud-security, posture, spl, mcp
- Date added: 2026-08-17
- Compatible platforms: Claude Code, Claude Desktop, Cursor, Codex, GitHub Copilot
- Invocation: `/splunk-tenable-cloud-security`
- Listing page: https://exchange.tenable.com/skills/splunk-tenable-cloud-security-skill
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/splunk-tenable-cloud-security-skill.md

Query and triage **Tenable Cloud Security posture findings** already ingested in Splunk using production-safe, count-first SPL via the official Splunk MCP Server.

## What it does

- Provides three workflows for finding inventory, cluster/workload triage, and Tenable policy/account exposure
- Enforces count-first SPL guardrails with explicit time bounds and read-only defaults
- Parses `resources{}{}` fields and rolls up findings by cluster, workload, account, and policy
- Routes through Splunk MCP discovery tools with a documented CLI fallback when MCP is unavailable

## How it works

The skill packages routing logic in `SKILL.md` with progressive disclosure into `references/` and `workflows/`. The agent discovers your Splunk environment via MCP, validates Tenable posture field mappings, runs bounded SPL queries, and returns structured triage output. It integrates with upstream Splunk Agent Skills for SPL optimization and CLI fallback without forking their content.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/splunk-tenable-cloud-security-skill.json. The full index and how to read it: https://exchange.tenable.com/llms.txt