Trending is a Tenable Security Center Director feature that tracks vulnerability counts over time and displays the results as line and area charts in dashboards and reports. Trending gives you a historical view of how your vulnerability data changes day over day, so you can measure progress toward remediation goals and identify patterns in your security posture.

How Trending Works

When you add a line or area chart component to a dashboard or report, Tenable Security Center Director automatically registers the underlying query with the Trending service. Each day, the Trending service executes all registered queries against your current cumulative vulnerability data and stores the results as a daily data point. Over time, these data points form the trend lines visible in your charts.

Trending uses the sumseverity tool for query execution, which aggregates vulnerability counts by severity level (Critical, High, Medium, Low, Info). If a query uses a tool that is not directly supported for trending, Tenable Security Center Director automatically converts it to severity-based aggregation when calculating trend data. The original query tool is preserved for all other uses. A note appears in the UI wherever this conversion applies.

Tenable Security Center Director deduplicates trend execution: if multiple charts reference queries that are logically identical (same filters, organization, and group context), the Trending service executes the query once and shares the results across all matching charts.

Why It's Important

Trending allows you to answer questions that point-in-time vulnerability data cannot: Are we reducing our critical vulnerability count week over week? Did a recent patch cycle have a measurable impact? How does severity distribution shift after a new scan policy is applied?

Without trending, dashboards and reports show only the current state of your environment. With trending, they show the direction and rate of change — information that is essential for demonstrating remediation progress to stakeholders and for identifying regressions quickly.

Requirements and Considerations

New charts start from a single data point. When you create a new trending chart, it begins with one data point representing the current day's vulnerability data. Historical data from before the chart was created is not available. The trend grows by one data point each day as the Trending service runs its scheduled queries.

Editing a chart's query resets its trend data. If you change the query associated with an existing trending chart, the chart resets to a single data point for the current day. Previous trend data for the old query definition is no longer displayed. If you need to preserve existing trend history, avoid modifying the query attached to a trending chart.

Remote repositories must sync at least every 24 hours. If you use remote repositories as data sources for trending charts, configure the remote repository's Update Schedule to sync at least once every 24 hours. Repositories that sync less frequently produce gaps in trending data because the Trending service runs on a daily schedule and requires up-to-date data at execution time. For more information, see Remote Repositories.

Offline repositories may produce gaps in trending data. If you use offline repositories and do not import updated data daily, trending charts that reference that repository's data may have missing data points for days when no import occurred. Tenable recommends reviewing your import schedule if trending accuracy is important for offline repository data.

Trending queries cannot be deleted while in use. If a query is referenced by one or more trending charts in a dashboard or report, you cannot delete the query directly. Remove the query from all trending chart components before deleting it.

For more information, see Dashboards, Reports, and Repositories.