[Tenable.io] Tweaks to Tenable.io integration

[jamiehynds]

Based on feedback from Tenable, some tweaks need to be applied in order to get our integration validated.

• Asset & Vuln data streams pull frequency : Adjust the default interval to 24 hours and adjust titles from 'logs' to 'data', e.g. Collect asset logs from Tenable.io becomes ' Collect asset data from Tenable.io'

• Plugin Data Pull - Adjust initial & daily pull to 24hr, set to default off

• Scanner Pull - Remove

• Scans pull - Adjust cadence to 24hr, set to default off

Tenable has also rebranded Tenable.io to Tenable Vulnerability Management. Can please adjust the title, description and all references of Tenable.io to Tenable Vulnerability Management.

The logo for the integration also needs to be changed:

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[jamiehynds]

Sorry @efd6 , while we're working on this package - two additional changes if you don't mind.

• @timestamp needs to be changed from "tenable_io.vulnerability.indexed" (aka. tenable_io.vulnerability.first_found) to "tenable_io.vulnerability.last_found"

• Fingerprint needs to be enabled again. Probably on the same fields as Tenable.sc is using.

The vulnerability data is unusable today. Especially for dashboards, because @timestamp is the time that the vulnerability was FIRST seen. This can be years ago. cc @LaZyDK

Another issue rasied here, but not sure how we tackle it: #5762

[LaZyDK]

For now we have used a custom pipeline to fix the data in Tenable.io to look and behave like Tenable.sc.

[
  {
    "fingerprint": {
      "fields": [
        "tenable_io.vulnerability.plugin.id",
        "host.ip",
        "tenable_io.vulnerability.last_found",
        "tenable_io.vulnerability.port.value",
        "tenable_io.vulnerability.plugin.modification_date"
      ],
      "target_field": "_id",
      "method": "MurmurHash3",
      "ignore_failure": true
    }
  },
  {
    "set": {
      "ignore_failure": true,
      "field": "@timestamp",
      "copy_from": "tenable_io.vulnerability.last_found"
    }
  }
]

[efd6]

No worries.

[LaZyDK]

Above closes #5762