Tenable.io

A comprehensive asset-centric solution to accurately track resources while accommodating dynamic assets such as cloud, mobile devices, containers, and web applications. Fetch capabilities are only available for certain licenses.

Vulnerability Management · Tenable Vulnerability Management (formerly Tenable.io)

Details

IDTenable.io
ProviderTenable
CategoryVulnerability Management
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM Exposure Management

README

A comprehensive asset-centric solution to accurately track resources while accommodating dynamic assets such as cloud, mobile devices, containers, and web applications.
This integration was integrated and tested with January 2023 release of Tenable.io.

Configure Tenable Vulnerability Management on Cortex XSOAR/XSIAM

  1. After installing the Tenable Vulnerability Management (formerly Tenable.io) content pack, do one of the following:
  • Cortex XSIAM: Go to Settings > Configurations > Automation & Feed Integrations.
  • Cortex XSOAR 8: Go to Settings & Info > Instances.
  • Cortex XSOAR 6: Go to Settings > Integrations > Servers & Services.

  1. Search for Tenable Vulnerability Management.
    Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    URL Tenable URL. True
    Access Key Tenable API access key. True
    Secret Key Tenable API secret key. True
    Events Fetch Interval Fetch interval in minutes for events. False
    Assets Fetch Interval Fetch interval in minutes for assets and vulnerabilities. False
    Severity The severity of the vulnerabilities to include in the export. False
    First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)   False
    Max Fetch The maximum number of audit logs to retrieve for each event type. For more information about event types see the help section. False
    Trust any certificate (not secure)   False
    Use system proxy settings   False

  2. Click Test to validate the URLs, token, and connection.

Permissions

Command Name Required Permissions
tenable-io-list-scans BASIC [16] user permissions and CAN VIEW [16] scan permissions.
tenable-io-launch-scan SCAN OPERATOR [24] user permissions.
tenable-io-get-scan-report BASIC [16] user permissions.
tenable-io-get-vulnerability-details BASIC [16] user permissions.
tenable-io-get-vulnerabilities-by-asset BASIC [16] user permissions.
tenable-io-get-scan-status BASIC [16] user permissions and CAN VIEW [16] scan permissions.
tenable-io-resume-scan SCAN OPERATOR [24] user permissions and CAN EXECUTE [32] scan permissions.
tenable-io-pause-scan SCAN OPERATOR [24] user permissions and CAN EXECUTE [32] scan permissions.
tenable-io-get-asset-details BASIC [16] user permissions.
tenable-io-export-assets ADMINISTRATOR [64] user permissions.
tenable-io-export-vulnerabilities ADMINISTRATOR [64] user permissions.
tenable-io-list-scan-filters BASIC [16] user permissions
tenable-io-get-scan-history SCAN OPERATOR [24] user permissions and CAN VIEW [16] scan permissions
tenable-io-export-scan SCAN OPERATOR [24] user permissions and CAN VIEW [16] scan permissions

Concurrency Limits

Limitations Commands name
Three concurrent requests per Tenable.io customer instance.
Note: This limit is subject to change.		 tenable-io-list-scans
tenable-io-launch-scan
tenable-io-get-scan-report
tenable-io-get-vulnerability-details
tenable-io-get-vulnerabilities-by-asset
tenable-io-get-scan-status
tenable-io-resume-scan
tenable-io-pause-scan
tenable-io-get-asset-details
Two concurrent asset exports per container. Tenable.io also prevents duplicate exports from running concurrently.
For example, export requests with the same filters.		 tenable-io-export-assets
tenable-io-export-vulnerabilities

Notes

  • Fetch assets and vulnerabilities (Beta) command fetches assets and vulnerabilities from the last 90 days only.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

tenable-io-list-scans

Retrieves scans from the Tenable platform.

Base Command

tenable-io-list-scans

Input

Argument Name Description Required
folderId The ID of the folder whose scans should be listed. Scans are stored
in specific folders on Tenable, e.g.: folderId=8.		 Optional
lastModificationDate Limit the results to those that have only changed since this time. Date format will be YYYY-MM-DD format or relational expressions like “7 days ago”. Optional

Context Output

Path Type Description
TenableIO.Scan.Id number The unique ID of the scan.
TenableIO.Scan.Name string The name of the scan.
TenableIO.Scan.Target string The targets to scan.
TenableIO.Scan.Status string The status of the scan (completed, aborted, imported, pending, running, resuming, canceling, cancelled, pausing, paused, stopping, stopped).
TenableIO.Scan.StartTime date The scheduled start time for the scan.
TenableIO.Scan.EndTime date The scheduled end time for the scan.
TenableIO.Scan.Enabled boolean If true, the schedule for the scan is enabled.
TenableIO.Scan.Type string The type of scan (local, remote, or agent).
TenableIO.Scan.Owner string The owner of the scan.
TenableIO.Scan.Scanner string The scanner assigned for the scan.
TenableIO.Scan.Policy string The policy assigned for the scan.
TenableIO.Scan.CreationDate date The creation date for the scan in Unix time.
TenableIO.Scan.LastModificationDate date The last modification date for the scan in Unix time.
TenableIO.Scan.FolderId number The unique ID of the folder where the scan has been stored.

Command example


#### Context Example

```json
{
    "TenableIO": {
        "Scan": [
            {
                "CreationDate": "2024-11-07T11:11:05Z",
                "Enabled": false,
                "EndTime": "2024-11-07T11:11:05Z",
                "FolderId": 5,
                "Id": 10,
                "LastModificationDate": "2024-05-07T11:11:05Z",
                "Name": "some_name",
                "Owner": "some_owner",
                "Policy": "Host Discovery",
                "StartTime": "2024-11-07T11:11:05Z",
                "Status": "aborted",
                "Targets": "1.1.1.1, 0.0.0.0",
                "Type": "remote"
            },
        ]
    }
}

Human Readable Output

Tenable.io - List of Scans

FolderId Id Name Targets Status StartTime EndTime Enabled Type Owner Scanner Policy CreationDate LastModificationDate
5 10 some_name 1.1.1.1, 0.0.0.0 aborted Thu Nov 07 11:11:05 2024 Thu Nov 07 11:11:05 2024 false remote some_owner   Host Discovery Thu Nov 07 11:11:05 2024 Thu Nov 07 11:11:05 2024

tenable-io-launch-scan

Launches a scan with existing or custom targets. You can specify custom targets in the command arguments.

Base Command

tenable-io-launch-scan

Input

Argument Name Description Required
scanId The ID of the scan to launch. Required
scanTargets If specified, targets to be scanned instead of the default. This value can be an array where each index is a target, or an array with a single index of comma-separated targets. Optional

Context Output

Path Type Description
TenableIO.Scan.Id number The unique ID of the scan.
TenableIO.Scan.Targets string The targets to scan.
TenableIO.Scan.Status string The status of the scan (completed, aborted, imported, pending, running, resuming, canceling, cancelled, pausing, paused, stopping, stopped).

Command example

!tenable-io-launch-scan scanId="10"

Context Example

{
    "TenableIO": {
        "Scan": {
            "Id": "10",
            "Status": "pending",
            "Targets": "target_1,target_2,target_3"
        }
    }
}

The requested scan was launched successfully

Id Targets Status
10 target_1,target_2,target_3 pending

tenable-io-get-scan-report

Retrieves a scan report for the specified scan.

Base Command

tenable-io-get-scan-report

Input

Argument Name Description Required
scanId The ID of the scan to retrieve. Required
detailed If true, the report will contain remediation and host information for the specified scan. Otherwise, the report will only contain vulnerabilities. Possible values: “yes” and “no”. Possible values are: yes, no. Default is no. Optional
info Whether to return the basic details of the specified scan. Possible values: “yes” and “no”. Possible values are: yes, no. Default is no. Optional

Context Output

Path Type Description
TenableIO.Scan.Id number The unique ID of the scan.
TenableIO.Scan.Name string The name of the scan.
TenableIO.Scan.Targets string The targets to scan.
TenableIO.Scan.Status string The status of the scan (“completed”, “aborted”, “imported”, “pending”, “running”, “resuming”, “canceling”, “cancelled”, “pausing”, “paused”, “stopping”, “stopped”).
TenableIO.Scan.StartTime string The scheduled start time for the scan.
TenableIO.Scan.EndTime string The scheduled end time for the scan.
TenableIO.Scan.Scanner string The scanner assigned for the scan.
TenableIO.Scan.Policy string The policy assigned to the scan.
TenableIO.Vulnerabilities.Id string The unique ID of the vulnerability.
TenableIO.Vulnerabilities.Name string The name of the vulnerability.
TenableIO.Vulnerabilities.Severity number The severity level of the vulnerability.
TenableIO.Vulnerabilities.Description string The description of the vulnerability.
TenableIO.Vulnerabilities.Synopsis string A brief summary of the vulnerability.
TenableIO.Vulnerabilities.Solution string Information on how to fix the vulnerability.
TenableIO.Vulnerabilities.FirstSeen date When the vulnerability was first seen.
TenableIO.Vulnerabilities.LastSeen date When the vulnerability was last seen.
TenableIO.Vulnerabilities.VulnerabilityOccurences number A count of the vulnerability occurrences.
TenableIO.Assets.Hostname string The name of the host.
TenableIO.Assets.Score number The overall score for the host.
TenableIO.Assets.Critical number The percentage of critical findings on the host.
TenableIO.Assets.High number The number of high findings on the host.
TenableIO.Assets.Medium number The number of medium findings on the host.
TenableIO.Assets.Low number The number of low findings on the host.
TenableIO.Remediations.Id string The unique ID of the remediation.
TenableIO.Remediations.Description string Specific information related to the vulnerability and steps to remediate.
TenableIO.Remediations.AffectedHosts number The number of hosts affected.
TenableIO.Remediations.AssociatedVulnerabilities number The number of vulnerabilities associated with the remedy.

Command example

!tenable-io-get-scan-report scanId="10"

Context Example

{
    "TenableIO": {
        "Vulnerabilities": [
            {
                "Description": "description",
                "FirstSeen": "2024-11-07T11:11:05Z",
                "Id": 00000,
                "LastSeen": "2024-11-07T11:11:05Z",
                "Name": "some_name",
                "Severity": "None",
                "Solution": "Solution",
                "Synopsis": "Synopsis",
                "VulnerabilityOccurences": 26
            },
            {
                "Description": "description",
                "FirstSeen": "2024-11-07T11:11:05Z",
                "Id": 11111,
                "LastSeen": "2024-11-07T11:11:05Z",
                "Name": "some_name",
                "Severity": "None",
                "Synopsis": "Synopsis",
                "VulnerabilityOccurences": 12
            },
        ]
    }
}

Human Readable Output

Vulnerabilities

Id Name Severity Description Synopsis Solution FirstSeen LastSeen VulnerabilityOccurences
00000 some_name None description Synopsis Solution 2024-11-07T11:11:05Z 2024-11-07T11:11:05Z 26
11111 some_name None description Synopsis   2024-11-07T11:11:05Z 2024-11-07T11:11:05Z 12

tenable-io-get-vulnerability-details

Retrieves details for the specified vulnerability.

Base Command

tenable-io-get-vulnerability-details

Input

Argument Name Description Required
vulnerabilityId The unique ID of the vulnerability. Required

Context Output

Path Type Description
TenableIO.Vulnerabilities.Name string The name of the vulnerability.
TenableIO.Vulnerabilities.Severity number Integer [0-4] indicating how severe the vulnerability is, where 0 is info only.
TenableIO.Vulnerabilities.Type string The type of the vulnerability.
TenableIO.Vulnerabilities.Family string Object containing plugin information such as family, type, and publication and modification dates.
TenableIO.Vulnerabilities.Description string The description of the vulnerability.
TenableIO.Vulnerabilities.Synopsis string A brief summary of the vulnerability.
TenableIO.Vulnerabilities.Solution string Information on how to fix the vulnerability.
TenableIO.Vulnerabilities.FirstSeen date When the vulnerability was first seen.
TenableIO.Vulnerabilities.LastSeen date When the vulnerability was last seen.
TenableIO.Vulnerabilities.PublicationDate date The publication date of the vulnerability.
TenableIO.Vulnerabilities.ModificationDate date The last modification date for the vulnerability in Unix time.
TenableIO.Vulnerabilities.VulnerabilityOccurences number A count of the vulnerability occurrences.
TenableIO.Vulnerabilities.CvssVector string The Common Vulnerability Scoring System vector.
TenableIO.Vulnerabilities.CvssBaseScore string The Common Vulnerability Scoring System allotted base score.
TenableIO.Vulnerabilities.Cvss3Vector string The Common Vulnerability Scoring System version 3 vector.
TenableIO.Vulnerabilities.Cvss3BaseScore string The Common Vulnerability Scoring System version 3 allotted base score.

Command example

!tenable-io-get-vulnerability-details vulnerabilityId=fake_id

Context Example

{
    "TenableIO": {
        "Vulnerabilities": {
            "Description": "Description",
            "Family": "General",
            "FirstSeen": "2024-11-07T11:11:05Z",
            "LastSeen": "2024-11-07T11:11:05Z",
            "ModificationDate": "2024-11-07T11:11:05Z",
            "Name": "Name",
            "PublicationDate": "2024-11-07T11:11:05Z",
            "Severity": "None",
            "Synopsis": "Synopsis",
            "Type": "remote",
            "VulnerabilityOccurences": 1
        }
    }
}

Human Readable Output

Vulnerability details - fake_id

Name Severity Type Family Description Synopsis FirstSeen LastSeen PublicationDate ModificationDate VulnerabilityOccurences
Name None remote General Description Synopsis 2024-11-07T11:11:05Z 2024-11-07T11:11:05Z 2024-11-07T11:11:05Z 2024-11-07T11:11:05Z 1

tenable-io-get-vulnerabilities-by-asset

Gets a list of up to 5000 of the vulnerabilities recorded for a specified asset.

Base Command

tenable-io-get-vulnerabilities-by-asset

Input

Argument Name Description Required
hostname Hostname of the asset. Optional
ip IP of the asset. Optional
dateRange The number of days of data prior to and including today that should be returned. Optional

Context Output

Path Type Description
TenableIO.Assets.Hostname number Hostname of the asset.
TenableIO.Assets.Vulnerabilities number A list of all the vulnerability IDs associated with the asset.
TenableIO.Vulnerabilities.Id number The vulnerability unique ID.
TenableIO.Vulnerabilities.Name string The name of the vulnerability.
TenableIO.Vulnerabilities.Severity number Integer [0-4] indicating how severe the vulnerability is, where 0 is info only.
TenableIO.Vulnerabilities.Family string The vulnerability family.
TenableIO.Vulnerabilities.VulnerabilityOccurences number The number of times the vulnerability was found.
TenableIO.Vulnerabilities.VulnerabilityState string The current state of the reported vulnerability (“Active”, “Fixed”, “New”, etc.).

Command example

!tenable-io-get-vulnerabilities-by-asset hostname="debian8628.aspadmin.net"

Context Example

{
    "TenableIO": {
        "Assets": {
            "Hostname": "debian8628.aspadmin.net",
            "Vulnerabilities": [
                11111,
                22222,
            ]
        },
        "Vulnerabilities": [
            {
                "Family": "General",
                "Id": 11111,
                "Name": "Name_01",
                "Severity": "None",
                "VulnerabilityOccurences": 2,
                "VulnerabilityState": "Active"
            },
            {
                "Family": "General",
                "Id": 22222,
                "Name": "Name_02",
                "Severity": "None",
                "VulnerabilityOccurences": 2,
                "VulnerabilityState": "Active"
            },
        ]
    }
}

Human Readable Output

Vulnerabilities for asset debian8628.aspadmin.net

Id Name Severity Family VulnerabilityOccurences VulnerabilityState
11111 Name_01 None General 2 Active
22222 Name_02 None General 2 Active

tenable-io-get-scan-status

Checks the status of a specific scan using the scan ID. Possible values: “Running”, “Completed”, and “Empty” (Ready to run).

Base Command

tenable-io-get-scan-status

Input

Argument Name Description Required
scanId The unique ID of the scan. Required

Context Output

Path Type Description
TenableIO.Scan.Id string The unique ID of the scan specified.
TenableIO.Scan.Status string The status of the scan specified.

Command example

!tenable-io-get-scan-status scanId="10"

Context Example

{
    "TenableIO": {
        "Scan": {
            "Id": "10",
            "Status": "aborted"
        }
    }
}

Human Readable Output

Scan status for 10

Id Status
10 aborted

tenable-io-resume-scan

Resumes all scans inputted as an array. Will resume scans whose status is ‘Paused’.

Base Command

tenable-io-resume-scan

Input

Argument Name Description Required
scanId Comma-separated list of scan IDs. Required

Context Output

Path Type Description
TenableIO.Scan.Id String The unique ID of the scan.
TenableIO.Scan.Status String The status of the scan (completed, aborted, imported, pending, running, resuming, canceling, cancelled, pausing, paused, stopping, stopped).

Command example

!tenable-io-resume-scan scanId="13"

Context Example

{
    "TenableIO": {
        "Scan": {
            "Id": "13",
            "Status": "Resuming"
        }
    }
}

Human Readable Output

The requested scan was resumed successfully

Id Status
13 Resuming

tenable-io-pause-scan

Pauses all scans inputted as an array. Will pause scans whose status is ‘Running’.

Base Command

tenable-io-pause-scan

Input

Argument Name Description Required
scanId Comma-separated list of scan IDs. Required

Context Output

Path Type Description
TenableIO.Scan.Id String The unique id of the scan.
TenableIO.Scan.Status String The status of the scan (completed, aborted, imported, pending, running, resuming, canceling, cancelled, pausing, paused, stopping, stopped).

Command example

!tenable-io-pause-scan scanId="10"

Context Example

{
    "TenableIO": {
        "Scan": {
            "Id": "10",
            "Status": "Pausing"
        }
    }
}

Human Readable Output

The requested scan was paused successfully

Id Status
13 Pausing

tenable-io-get-asset-details

Retrieves details for the specified asset including custom attributes.

Base Command

tenable-io-get-asset-details

Input

Argument Name Description Required
ip IP Address of the asset. Required

Context Output

Path Type Description
TenableIO.AssetDetails.attributes unknown Array of custom attributes of asset.
TenableIO.AssetDetails.counts unknown Array of audit statuses and vulnerabilities by type.
TenableIO.AssetDetails.created_at date Date asset was created.
TenableIO.AssetDetails.first_seen date Date asset was first seen.
TenableIO.AssetDetails.fqdn unknown Array of fully-qualified domain names.
TenableIO.AssetDetails.id string GUID of tenable.io asset.
TenableIO.AssetDetails.interfaces unknown Array of interface information.
TenableIO.AssetDetails.ipv4 unknown Array of IPv4 addresses.
TenableIO.AssetDetails.operating_system unknown Array of operating systems.
TenableIO.AssetDetails.tags unknown Array of tags added to asset.
TenableIO.AssetDetails.updated_at date Date the asset was last updated.

Command example

!tenable-io-get-asset-details ip=1.3.2.1"

Context Example

{
    "TenableIO": {
        "AssetDetails": {
            "agent_name": [],
            "attributes": [],
            "aws_availability_zone": [],
            "aws_ec2_instance_ami_id": [],
            "aws_ec2_instance_group_name": [],
            "aws_ec2_instance_id": [],
            "aws_ec2_instance_state_name": [],
            "aws_ec2_instance_type": [],
            "aws_ec2_name": [],
            "aws_ec2_product_code": [],
            "aws_owner_id": [],
            "aws_region": [],
            "aws_subnet_id": [],
            "aws_vpc_id": [],
            "azure_location": [],
            "azure_resource_group": [],
            "azure_resource_id": [],
            "azure_subscription_id": [],
            "azure_type": [],
            "azure_vm_id": [],
            "bigfix_asset_id": [],
            "bios_uuid": [],
            "counts": {
                "audits": {
                    "statuses": [
                        {
                            "count": 0,
                            "level": 1,
                            "name": "Passed"
                        },
                        {
                            "count": 0,
                            "level": 2,
                            "name": "Warning"
                        },
                        {
                            "count": 0,
                            "level": 3,
                            "name": "Failed"
                        }
                    ],
                    "total": 0
                },
                "vulnerabilities": {
                    "severities": [
                        {
                            "count": 17,
                            "level": 0,
                            "name": "Info"
                        },
                        {
                            "count": 0,
                            "level": 1,
                            "name": "Low"
                        },
                        {
                            "count": 0,
                            "level": 2,
                            "name": "Medium"
                        },
                        {
                            "count": 0,
                            "level": 3,
                            "name": "High"
                        },
                        {
                            "count": 1,
                            "level": 4,
                            "name": "Critical"
                        }
                    ],
                    "total": 18
                }
            },
            "created_at": "2024-11-07T11:11:05Z",
            "exposure_confidence_value": null,
            "first_seen": "2024-11-07T11:11:05Z",
            "fqdn": [
                "test.com"
            ],
            "gcp_instance_id": [],
            "gcp_project_id": [],
            "gcp_zone": [],
            "has_agent": false,
            "hostname": [
                "test.com"
            ],
            "id": "fake_asset_id",
            "installed_software": [
                "cpe:/a:test:0.0.0",
            ],
            "interfaces": [
                {
                    "fqdn": [
                        "test.com"
                    ],
                    "ipv4": [
                        "1.3.2.1"
                    ],
                    "ipv6": [],
                    "mac_address": [],
                    "name": "UNKNOWN"
                }
            ],
            "ipv4": [
                "1.3.2.1"
            ],
            "ipv6": [],
            "last_authenticated_scan_date": null,
            "last_licensed_scan_date": "2024-11-07T11:11:05Z",
            "last_scan_id": "fake_scan_id",
            "last_scan_target": "test.com'",
            "last_schedule_id": "fake_schedule_id",
            "last_seen": "2024-11-07T11:11:05Z",
            "mac_address": [],
            "mcafee_epo_agent_guid": [],
            "mcafee_epo_guid": [],
            "netbios_name": [],
            "network_name": "Default",
            "operating_system": [
                "Linux Kernel 2.6"
            ],
            "qualys_asset_id": [],
            "qualys_host_id": [],
            "security_protection_level": null,
            "security_protections": [],
            "servicenow_sysid": [],
            "sources": [
                {
                    "first_seen": "2024-11-07T11:11:05.739Z",
                    "last_seen": "2024-11-07T11:11:05.739Z",
                    "name": "name"
                }
            ],
            "ssh_fingerprint": [],
            "system_type": [
                "general-purpose"
            ],
            "tags": [
                {
                    "added_at": "2024-11-07T11:11:05Z",
                    "added_by": "fake_id",
                    "source": "static",
                    "tag_key": "some_key",
                    "tag_uuid": "fake_uuid",
                    "tag_value": "test.com"
                }
            ],
            "tenable_uuid": [],
            "time_end": "2024-11-07T11:11:05Z",
            "time_start": "2024-11-07T11:11:05Z",
            "updated_at": "2024-11-07T11:11:05Z",
            "uuid": "fake_asset_id"
        }
    }
}

Human Readable Output

Asset Info for 1.3.2.1

attributes fqdn interfaces ipv4 id last_seen
  test.com {‘name’: ‘UNKNOWN’, ‘fqdn’: [‘test.com’], ‘mac_address’: [], ‘ipv4’: [‘1.3.2.1’], ‘ipv6’: []} 1.3.2.1 fake_asset_id 2024-11-07T11:11:05.739Z

tenable-io-export-assets

Retrieves details for the specified asset to include custom attributes.

Limitations

When inserting invalid arguments, an error message could be returned.

Base Command

tenable-io-export-assets

Input

Argument Name Description Required
chunkSize Specifies the number of assets per exported chunk. The range is 100-10000. Default is 100. Optional
intervalInSeconds The number of seconds until the next run. Default is 10. Optional
timeOut The timeout for the polling in seconds. Default is 600. Optional
createdAt When specified, the results returned in the list are limited to assets created later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.’. Optional
updatedAt When specified, the results returned in the list are limited to assets updated later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.’. Optional
terminatedAt When specified, the results returned in the list are limited to assets terminated later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.’. Optional
isTerminated When set to true, returns assets which have any value for the terminatedAt attribute. Optional
deletedAt When specified, the results returned in the list are limited to assets deleted later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.’. Optional
isDeleted When set to true, returns assets which have any value for the deletedAt attribute. Possible values are: true, false. Optional
isLicensed Specifies whether the asset is included in the asset count for the Tenable.io instance. If true, returns only licensed assets. If false, returns only unlicensed assets. Possible values are: true, false. Optional
firstScanTime When specified, the results returned in the list are limited to assets with a first scan time later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.’. Optional
lastAuthenticatedScanTime When specified, the results returned in the list are limited to assets with a last credentialed scan time later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.’. Optional
lastAssessed When specified, the results returned in the list are limited to assets with a last assessed time later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.’. Optional
serviceNowSysId If true, returns all assets that have a ServiceNow Sys ID, regardless of value. If false, returns all assets that do not have a ServiceNow Sys ID. Possible values are: true, false. Optional
sources A comma-separated list of sources. Possible values are: AWS, NESSUS_AGENT, PVS,NESSUS_SCAN, WAS. When specified, the results returned in the list are limited to assets that have the specified source. Optional
hasPluginResults If true, returns all assets that have a plugin results associated with it. Possible values are: true, false. Optional
tagCategory When specified, the results returned in the list are limited to assets with the specified tag category. Optional
tagValue When specified, the results returned in the list are limited to assets with the specified tag value. Can be comma-delimited for multiple items. Optional
exportUuid The export uuid. Optional

Context Output

Path Type Description
TenableIO.Asset.id String The UUID of the asset in Tenable.io. Use this value as the unique key for the asset.
TenableIO.Asset.has_agent Boolean Specifies whether a Nessus agent scan identified the asset.
TenableIO.Asset.has_plugin_results Boolean Specifies whether the asset has plugin results associated with it.
TenableIO.Asset.created_at Date The time and date when Tenable.io created the asset record.
TenableIO.Asset.terminated_at Date The time and date when a user terminated the Amazon Web Service (AWS) virtual machine instance of the asset.
TenableIO.Asset.terminated_by String The user who terminated the AWS instance of the asset.
TenableIO.Asset.updated_at Date The time and date when the asset record was last updated.
TenableIO.Asset.deleted_at Date The time and date when a user deleted the asset record. When a user deletes an asset record, Tenable.io retains the record until the asset ages out of the license count.
TenableIO.Asset.deleted_by String The user who deleted the asset record.
TenableIO.Asset.first_seen Date The time and date when a scan first identified the asset.
TenableIO.Asset.last_seen Date The time and date of the scan that most recently identified the asset.
TenableIO.Asset.first_scan_time Date The time and date of the first scan run against the asset.
TenableIO.Asset.last_scan_time Date The time and date of the last scan run against the asset.
TenableIO.Asset.last_authenticated_scan_date Date The time and date of the last credentialed scan run on the asset.
TenableIO.Asset.last_licensed_scan_date Date The time and date of the last scan that identified the asset as licensed. Tenable.io categorizes an asset as licensed if a scan of that asset has returned results from a non-discovery plugin within the last 90 days.
TenableIO.Asset.last_scan_id String The UUID of the scan configuration used during the last scan of the asset.
TenableIO.Asset.last_schedule_id String The schedule id for the last scan of the asset.
TenableIO.Asset.azure_vm_id String The unique identifier of the Microsoft Azure virtual machine instance. For more information, see “Accessing and Using Azure VM Unique ID” in the Microsoft Azure documentation.
TenableIO.Asset.azure_resource_id String The unique identifier of the resource in the Azure Resource Manager. For more information, see the Azure Resource Manager Documentation.
TenableIO.Asset.gcp_project_id String The unique identifier of the virtual machine instance in Google Cloud Platform (GCP).
TenableIO.Asset.gcp_zone String The customized name of the project to which the virtual machine instance belongs in GCP. For more information see “Creating and Managing Projects” in the GCP documentation.
TenableIO.Asset.gcp_instance_id String The zone where the virtual machine instance runs in GCP. For more information, see “Regions and Zones” in the GCP documentation.
TenableIO.Asset.aws_ec2_instance_ami_id String The unique identifier of the Linux AMI image in Amazon Elastic Compute Cloud (Amazon EC2). For more information, see the Amazon Elastic Compute Cloud Documentation.
TenableIO.Asset.aws_ec2_instance_id String The unique identifier of the Linux instance in Amazon EC2. For more information, see the Amazon Elastic Compute Cloud Documentation.
TenableIO.Asset.agent_uuid String The unique identifier of the Nessus agent that identified the asset.
TenableIO.Asset.bios_uuid String The BIOS UUID of the asset.
TenableIO.Asset.network_id String The ID of the network object associated with scanners that identified the asset.
TenableIO.Asset.network_name String The ID of the network object associated with scanners that identified the asset.
TenableIO.Asset.aws_owner_id String The canonical user identifier for the AWS account associated with the virtual machine instance.
TenableIO.Asset.aws_availability_zone String The availability zone where Amazon Web Services hosts the virtual machine instance.
TenableIO.Asset.aws_region String The region where AWS hosts the virtual machine instance.
TenableIO.Asset.aws_vpc_id String The unique identifier for the virtual public cloud that hosts the AWS virtual machine instance.
TenableIO.Asset.aws_ec2_instance_group_name String The virtual machine instance’s group in AWS.
TenableIO.Asset.aws_ec2_instance_state_name String The state of the virtual machine instance in AWS at the time of the scan.
TenableIO.Asset.aws_ec2_instance_type String The type of instance in AWS EC2.
TenableIO.Asset.aws_subnet_id String The unique identifier of the AWS subnet where the virtual machine instance was running at the time of the scan.
TenableIO.Asset.aws_ec2_product_code String The product code associated with the AMI used to launch the virtual machine instance in AWS EC2.
TenableIO.Asset.aws_ec2_name String The name of the virtual machine instance in AWS EC2.
TenableIO.Asset.mcafee_epo_guid String The unique identifier of the asset in McAfee ePolicy Orchestrator (ePO).
TenableIO.Asset.mcafee_epo_agent_guid String The unique identifier of the McAfee ePO agent that identified the asset.
TenableIO.Asset.servicenow_sysid String The unique record identifier of the asset in ServiceNow.
TenableIO.Asset.bigfix_asset_id String The unique identifiers of the asset in HCL BigFix.
TenableIO.Asset.agent_names String The names of any Nessus agents that scanned and identified the asset.
TenableIO.Asset.installed_software String A list of Common Platform Enumeration (CPE) values that represent software applications a scan identified as present on an asset.
TenableIO.Asset.ipv4s String The IPv4 addresses that scans have associated with the asset record.
TenableIO.Asset.ipv6s String The IPv6 addresses that scans have associated with the asset record.
TenableIO.Asset.fqdns String The fully-qualified domain names that scans have associated with the asset record.
TenableIO.Asset.mac_addresses String The MAC addresses that scans have associated with the asset record.
TenableIO.Asset.netbios_names String The NetBIOS names that scans have associated with the asset record.
TenableIO.Asset.operating_systems String The operating systems that scans have associated with the asset record.
TenableIO.Asset.system_types String The system types as reported by Plugin ID 54615. Possible values include router, general-purpose, scan-host, and embedded.
TenableIO.Asset.hostnames String The hostnames that scans have associated with the asset record.
TenableIO.Asset.ssh_fingerprints String The SSH key fingerprints that scans have associated with the asset record.
TenableIO.Asset.qualys_asset_ids String The Asset ID of the asset in Qualys. For more information, see the Qualys documentation.
TenableIO.Asset.qualys_host_ids String The Host ID of the asset in Qualys. For more information, see the Qualys documentation.
TenableIO.Asset.manufacturer_tpm_ids String The manufacturer’s unique identifiers of the Trusted Platform Module (TPM) associated with the asset.
TenableIO.Asset.symantec_ep_hardware_keys String The hardware keys for the asset in Symantec Endpoint Protection.
TenableIO.Asset.sources.name String The name of the entity that reported the asset details. Sources can include sensors, connectors, and API imports.
TenableIO.Asset.sources.first_seen Date The ISO timestamp when the source first reported the asset.
TenableIO.Asset.sources.last_seen Date The ISO timestamp when the source last reported the asset.
TenableIO.Asset.tags.uuid String The UUID of the tag.
TenableIO.Asset.tags.key String The tag category (the first half of the category:value pair).
TenableIO.Asset.tags.value String The tag value (the second half of the category:value pair).
TenableIO.Asset.tags.added_by String The UUID of the user who assigned the tag to the asset.
TenableIO.Asset.tags.added_at Date The ISO timestamp when the tag was assigned to the asset.
TenableIO.Asset.network_interfaces.name String The name of the interface.
TenableIO.Asset.network_interfaces.mac_address String The MAC addresses of the interface.
TenableIO.Asset.network_interfaces.ipv6 String One or more IPv6 addresses belonging to the interface.
TenableIO.Asset.network_interfaces.fqdns String One or more FQDNs belonging to the interface.
TenableIO.Asset.network_interfaces.ipv4s String One or more IPv4 addresses belonging to the interface.
TenableIO.Asset.acr_score String The Asset Criticality Rating (ACR) for the asset.
TenableIO.Asset.exposure_score String The Asset Exposure Score (AES) for the asset.

Command example

!tenable-io-export-assets chunkSize=500

Context Example

{
    "TenableIO": {
        "Asset": [
            {
                "created_at": "2024-11-07T11:11:05Z",
                "first_scan_time": "2024-11-07T11:11:05Z",
                "first_seen": "2024-11-07T11:11:05Z",
                "fqdns": [
                    "test.com"
                ],
                "has_agent": false,
                "has_plugin_results": true,
                "hostnames": [
                    "test.com"
                ],
                "id": "fake_uuid",
                "installed_software": [],
                "ipv4s": [
                    "1.3.2.1"
                ],
                "last_licensed_scan_date": "2024-11-07T11:11:05Z",
                "last_scan_id": "fake_uuid",
                "last_scan_time": "2024-11-07T11:11:05Z",
                "last_schedule_id": "fake_uuid",
                "last_seen": "2024-11-07T11:11:05Z",
                "network_id": "00000000-0000-0000-0000-000000000000",
                "network_interfaces": [
                    {
                        "aliased": null,
                        "fqdns": [
                            "test.com"
                        ],
                        "ipv4s": [
                            "1.3.2.1"
                        ],
                        "ipv6s": [],
                        "mac_addresses": [],
                        "name": "UNKNOWN",
                        "virtual": null
                    }
                ],
                "network_name": "Default",
                "operating_systems": [
                    "Linux Kernel 2.6"
                ],
                "sources": [
                    {
                        "first_seen": "2024-11-07T11:11:05Z",
                        "last_seen": "2024-11-07T11:11:05Z",
                        "name": "NESSUS_SCAN"
                    }
                ],
                "system_types": [
                    "general-purpose"
                ],
                "tags": [
                    {
                        "added_at": "2024-11-07T11:11:05Z",
                        "added_by": "fake_uuid",
                        "key": "some_key",
                        "uuid": "fake_uuid",
                        "value": "test.com"
                    }
                ],
                "updated_at": "2024-11-07T11:11:05Z"
            },
            {
                "created_at": "2024-11-07T11:11:05Z",
                "first_scan_time": "2024-11-07T11:11:05Z",
                "first_seen": "2024-11-07T11:11:05Z",
                "fqdns": [
                    "test.net"
                ],
                "has_agent": false,
                "has_plugin_results": true,
                "hostnames": [
                    "test.net"
                ],
                "id": "fake_uuid",
                "installed_software": [],
                "ipv4s": [
                    "1.3.2.1"
                ],
                "last_licensed_scan_date": "2024-11-07T11:11:05Z",
                "last_scan_id": "fake_uuid",
                "last_scan_time": "2024-11-07T11:11:05Z",
                "last_schedule_id": "fake_uuid",
                "last_seen": "2024-11-07T11:11:05Z",
                "network_id": "00000000-0000-0000-0000-000000000000",
                "network_interfaces": [
                    {
                        "aliased": null,
                        "fqdns": [
                            "test.net"
                        ],
                        "ipv4s": [
                            "1.3.2.1"
                        ],
                        "ipv6s": [],
                        "mac_addresses": [],
                        "name": "UNKNOWN",
                        "virtual": null
                    }
                ],
                "network_name": "Default",
                "operating_systems": [
                    "Linux Kernel 2.6"
                ],
                "sources": [
                    {
                        "first_seen": "2024-11-07T11:11:05Z",
                        "last_seen": "2024-11-07T11:11:05Z",
                        "name": "NESSUS_SCAN"
                    }
                ],
                "ssh_fingerprints": [
                    "fake_ssh_fingerprints"
                ],
                "system_types": [
                    "general-purpose"
                ],
                "tags": [
                    {
                        "added_at": "2024-11-07T11:11:05Z",
                        "added_by": "fake_uuid",
                        "key": "some_key",
                        "uuid": "fake_uuid",
                        "value": "test.com"
                    }
                ],
                "updated_at": "2024-11-07T11:11:05Z"
            },
        ]
    }
}

Human Readable Output

Export Assets Results

ASSET ID DNS NAME (FQDN) SYSTEM TYPE OPERATING SYSTEM IPV4 ADDRESS NETWORK FIRST SEEN LAST SEEN LAST LICENSED SCAN SOURCE TAGS
fake_uuid test.com general-purpose Linux Kernel 2.6 1.3.2.1 Default 2024-11-07T11:11:05Z 2024-11-07T11:11:05Z 2024-11-07T11:11:05Z NESSUS_SCAN some_key:test.com
fake_uuid test.net general-purpose Linux Kernel 2.6 1.3.2.1 Default 2024-11-07T11:11:05Z 2024-11-07T11:11:05Z 2024-11-07T11:11:05Z NESSUS_SCAN some_key:test.com

tenable-io-export-vulnerabilities

Retrieves details for the specified asset to include custom attributes.

Limitations

When inserting invalid arguments, an error message could be returned.

Base Command

tenable-io-export-vulnerabilities

Input

Argument Name Description Required
numAssets The number of assets used to chunk the vulnerabilities. The range for number of assets in a chunk is 50-5000. Default is 50. Optional
intervalInSeconds The number of seconds until the next run. Default is 10. Optional
timeOut The timeout for the polling in seconds. Default is 600. Optional
includeUnlicensed Specifies whether or not to include unlicensed assets. Possible values are: true, false. Optional
cidrRange When specified, restricts the search for vulnerabilities to assets assigned an IP address within the specified CIDR range. Optional
firstFound When specified, the results returned in the list are limited to vulnerabilities that were first found between the specified date and now. Date format will be epoch date format or relational expressions like “7 days ago”. Optional
lastFixed When specified, the results returned in the list are limited to vulnerabilities that were fixed between the specified date and now. Date format will be epoch date format or relational expressions like “7 days ago”. Optional
lastFound When specified, the results returned in the list are limited to vulnerabilities that were last found between the specified date and now. Date format will be epoch date format or relational expressions like “7 days ago”. Optional
networkId The ID of the network object associated with scanners that detected the vulnerabilities you want to export. Optional
pluginId A comma-separated list of plugin IDs for which you want to filter the vulnerabilities. Optional
pluginType The plugin type for which you want to filter the vulnerabilities. If not set, export includes all vulnerabilities regardless of plugin type. Possible values are: remote, local, combined, settings, summary, third-party, reputation. Optional
severity The severity of the vulnerabilities to include in the export. Defaults to all severity levels. The severity of a vulnerability is defined using the Common Vulnerability Scoring System (CVSS) base score. Supported array values are: info, low, medium, high, critical. Optional
since The start date for the range of data you want to export. Date format will be epoch date format or relational expressions like “7 days ago”. Note: This filter cannot be used in conjunction with the firstFound, lastFound, or lastFixed. Optional
state A comma-separated list of states of the vulnerabilities you want the export to include. Supported, case-insensitive values are: open, reopened, fixed. This parameter is required if your request includes firstFound, lastFound, or lastFixed parameters. If your request omits this parameter, the export includes default states open and reopened only. Optional
tagCategory When specified, the results returned in the list are limited to assets with the specified tag category. Optional
tagValue When specified, the results returned in the list are limited to assets with the specified tag value. Can be comma-delimited for multiple items. Optional
vprScoreOperator An operator that determines the limitation on Vulnerability Priority Rating (VPR), scores value specified at vprScoreValue argument. Supported values are: equal, not equal, lt-lesser, lte-lesser than or equal , gt-greater than , gte-greater than or equal. Possible values are: gte, gt, lte, lt, equal, not equal. Optional
vprScoreValue When specified, the results returned in the list are limited to vulnerabilities with the specified Vulnerability Priority Rating (VPR), score or scores according to the score operator (vprScoreOperator) argument. Optional
vprScoreRange When specified, the results returned in the list are limited to vulnerabilities with the specified Vulnerability Priority Rating (VPR) score range. Example value: 2.5-3.5. Optional
exportUuid The export UUID. Optional
should_push_events Set this argument to True in order to create vulnerabilities, otherwise the command will only display the vulnerabilities. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
TenableIO.Vulnerability.asset.agent_uuid String The UUID of the agent that performed the scan where the vulnerability was found.
TenableIO.Vulnerability.asset.bios_uuid String The BIOS UUID of the asset where the vulnerability was found.
TenableIO.Vulnerability.asset.device_type String The type of asset where the vulnerability was found.
TenableIO.Vulnerability.asset.fqdn String The fully-qualified domain name of the asset where a scan found the vulnerability.
TenableIO.Vulnerability.asset.hostname String The host name of the asset where a scan found the vulnerability.
TenableIO.Vulnerability.asset.uuid String The UUID of the asset where a scan found the vulnerability.
TenableIO.Vulnerability.asset.ipv6 String The IPv6 address of the asset where a scan found the vulnerability.
TenableIO.Vulnerability.asset.last_authenticated_results Date The last date credentials that were used successfully to scan the asset.
TenableIO.Vulnerability.asset.last_unauthenticated_results Date The last date when the asset was scanned without using credentials
TenableIO.Vulnerability.asset.mac_address String The MAC address of the asset where a scan found the vulnerability.
TenableIO.Vulnerability.asset.netbios_name String The NETBIOS name of the asset where a scan found the vulnerability.
TenableIO.Vulnerability.asset.netbios_workgroup String The NETBIOS workgroup of the asset where a scan found the vulnerability.
TenableIO.Vulnerability.asset.operating_system String The operating system of the asset where a scan found the vulnerability.
TenableIO.Vulnerability.asset.network_id String The ID of the network object associated with scanners that identified the asset.
TenableIO.Vulnerability.asset.tracked Boolean A value specifying whether Tenable.io tracks the asset in the asset management system.
TenableIO.Vulnerability.output String The text output of the Nessus scanner.
TenableIO.Vulnerability.plugin.bid Number The Bugtraq ID for the plugin.
TenableIO.Vulnerability.plugin.canvas_package String The name of the CANVAS exploit pack that includes the vulnerability.
TenableIO.Vulnerability.plugin.checks_for_default_account Boolean A value specifying whether the plugin checks for default accounts.
TenableIO.Vulnerability.plugin.checks_for_malware Boolean A value specifying whether the plugin checks for malware.
TenableIO.Vulnerability.plugin.cpe String The Common Platform Enumeration (CPE) number for the plugin.
TenableIO.Vulnerability.plugin.cve String The Common Vulnerability and Exposure (CVE) ID for the plugin.
TenableIO.Vulnerability.plugin.cvss3_base_score Number The CVSSv3 base score (intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments).
TenableIO.Vulnerability.plugin.cvss3_temporal_score Number The CVSSv3 temporal score (characteristics of a vulnerability that change over time but not among user environments).
TenableIO.Vulnerability.plugin.cvss3_temporal_vector.exploitability String The CVSSv3 Exploit Maturity Code (E) for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss3_temporal_vector.remediation_level String The CVSSv3 Remediation Level (RL) temporal metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss3_temporal_vector.report_confidence String The CVSSv3 Report Confidence (RC) temporal metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss3_temporal_vector.raw String The complete CVSSv3 temporal vector metrics and result values for the vulnerability the plugin covers in a condensed and coded format.
TenableIO.Vulnerability.plugin.cvss3_vector.access_vector String The CVSSv3 Attack Vector (AV) metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss3_vector.access_complexity String The CVSSv3 Access Complexity (AC) metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss3_vector.authentication String The CVSSv3 Authentication (Au) metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss3_vector.confidentiality_impact String The CVSSv3 integrity impact metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss3_vector.integrity_impact String The CVSSv3 integrity impact metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss3_vector.availability_impact String The CVSSv3 availability impact metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss3_vector.raw String The complete cvss3_vector metrics and result values for the vulnerability the plugin covers in a condensed and coded format.
TenableIO.Vulnerability.plugin.cvss_temporal_vector.exploitability String The CVSSv2 Exploitability (E) temporal metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss_temporal_vector.remediation_level String The CVSSv2 Remediation Level (RL) temporal metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss_temporal_vector.report_confidence String The CVSSv2 Report Confidence (RC) temporal metric for the vulnerability the plugin covers
TenableIO.Vulnerability.plugin.cvss_temporal_vector.raw String The complete CVSS temporal vector metrics and result values for the vulnerability the plugin covers in a condensed and coded format.
TenableIO.Vulnerability.plugin.cvss_vector.access_vector String The CVSSv2 Access Vector (AV) metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss_vector.access_complexity String The CVSSv2 Access Complexity (AC) metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss_vector.authentication String The CVSSv2 Authentication (Au) metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss_vector.confidentiality_impact String The CVSSv2 confidentiality impact metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss_vector.integrity_impact String The CVSSv2 integrity impact metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss_vector.availability_impact String The CVSSv2 availability impact metric for the vulnerability the plugin covers.
TenableIO.Vulnerability.plugin.cvss_vector.raw String The complete CVSSv2 vector metrics and result values for the vulnerability the plugin covers in a condensed and coded format.
TenableIO.Vulnerability.plugin.cvss_base_score Number The CVSSv2 base score (intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments).
TenableIO.Vulnerability.plugin.cvss_temporal_score Number The CVSSv2 temporal score (characteristics of a vulnerability that change over time but not among user environments).
TenableIO.Vulnerability.plugin.d2_elliot_name String The name of the exploit in the D2 Elliot Web Exploitation framework.
TenableIO.Vulnerability.plugin.description String Full text description of the vulnerability.
TenableIO.Vulnerability.plugin.exploit_available Boolean A value specifying whether a public exploit exists for the vulnerability.
TenableIO.Vulnerability.plugin.exploit_framework_canvas Boolean A value specifying whether an exploit exists in the Immunity CANVAS framework.
TenableIO.Vulnerability.plugin.exploit_framework_core Boolean A value specifying whether an exploit exists in the CORE Impact framework.
TenableIO.Vulnerability.plugin.exploit_framework_d2_elliot Boolean A value specifying whether an exploit exists in the D2 Elliot Web Exploitation framework.
TenableIO.Vulnerability.plugin.exploit_framework_exploithub Boolean A value specifying whether an exploit exists in the ExploitHub framework.
TenableIO.Vulnerability.plugin.exploit_framework_metasploit Boolean A value specifying whether an exploit exists in the Metasploit framework.
TenableIO.Vulnerability.plugin.exploitability_ease String Description of how easy it is to exploit the issue.
TenableIO.Vulnerability.plugin.exploited_by_malware Boolean Whether the vulnerability discovered by this plugin is known to be exploited by malware.
TenableIO.Vulnerability.plugin.exploited_by_nessus Boolean A value specifying whether Nessus exploited the vulnerability during the process of identification.
TenableIO.Vulnerability.plugin.exploithub_sku String The SKU number of the exploit in the ExploitHub framework.
TenableIO.Vulnerability.plugin.family String The family to which the plugin belongs.
TenableIO.Vulnerability.plugin.family_id Number The ID of the plugin family.
TenableIO.Vulnerability.plugin.has_patch Boolean A value specifying whether the vendor has published a patch for the vulnerability.
TenableIO.Vulnerability.plugin.id Number The ID of the plugin that identified the vulnerability.
TenableIO.Vulnerability.plugin.in_the_news Boolean A value specifying whether this plugin has received media attention (for example, ShellShock, Meltdown).
TenableIO.Vulnerability.plugin.metasploit_name String The name of the related exploit in the Metasploit framework.
TenableIO.Vulnerability.plugin.ms_bulletin String The Microsoft security bulletin that the plugin covers.
TenableIO.Vulnerability.plugin.name String The name of the plugin that identified the vulnerability.
TenableIO.Vulnerability.plugin.patch_publication_date String The date on which the vendor published a patch for the vulnerability.
TenableIO.Vulnerability.plugin.modification_date Date The date on which the plugin was last modified.
TenableIO.Vulnerability.plugin.publication_date Date The date on which the plugin was published.
TenableIO.Vulnerability.plugin.risk_factor String The risk factor associated with the plugin. Possible values are: Low, Medium, High, or Critical.
TenableIO.Vulnerability.plugin.see_also String Links to external websites that contain helpful information about the vulnerability.
TenableIO.Vulnerability.plugin.solution String Remediation information for the vulnerability.
TenableIO.Vulnerability.plugin.stig_severity String Security Technical Implementation Guide (STIG) severity code for the vulnerability.
TenableIO.Vulnerability.plugin.synopsis String Brief description of the plugin or vulnerability.
TenableIO.Vulnerability.plugin.type String The general type of plugin check (for example, local or remote).
TenableIO.Vulnerability.plugin.unsupported_by_vendor Boolean Whether software found by this plugin is unsupported by the software’s vendor (for example, Windows 95 or Firefox 3).
TenableIO.Vulnerability.plugin.usn String Ubuntu security notice that the plugin covers.
TenableIO.Vulnerability.plugin.version String The version of the plugin used to perform the check.
TenableIO.Vulnerability.plugin.vuln_publication_date Date The publication date of the plugin.
TenableIO.Vulnerability.plugin.xrefs.type String References to third-party information about the vulnerability, exploit, or update associated with the plugin.
TenableIO.Vulnerability.plugin.xrefs.id String References to third-party information about the vulnerability, exploit, or update associated with the plugin.
TenableIO.Vulnerability.plugin.vpr.score Number The Vulnerability Priority Rating (VPR) for the vulnerability.
TenableIO.Vulnerability.plugin.vpr.drivers.age_of_vuln Number A range representing the number of days since the National Vulnerability Database (NVD) published the vulnerability.
TenableIO.Vulnerability.plugin.vpr.drivers.age_of_vuln.lower_bound Number The lower bound of the range.
TenableIO.Vulnerability.plugin.vpr.drivers.age_of_vuln.upper_bound Number The upper bound of the range.
TenableIO.Vulnerability.plugin.vpr.drivers.exploit_code_maturity String The relative maturity of a possible exploit for the vulnerability based on the existence, sophistication, and prevalence of exploit intelligence from internal and external sources.
TenableIO.Vulnerability.plugin.vpr.drivers.cvss3_impact_score Number The NVD-provided CVSSv3 impact score for the vulnerability.
TenableIO.Vulnerability.plugin.vpr.drivers.cvss_impact_score_predicted Boolean A value specifying whether Tenable.io predicted the CVSSv3 impact score for the vulnerability.
TenableIO.Vulnerability.plugin.vpr.drivers.threat_intensity_last28 String The relative intensity based on the number and frequency of recently observed threat events related to this vulnerability: Very Low, Low, Medium, High, or Very High.
TenableIO.Vulnerability.plugin.vpr.drivers.threat_recency String A range representing the number of days since a threat event occurred for the vulnerability.
TenableIO.Vulnerability.plugin.vpr.drivers.threat_recency.lower_bound String The lower bound of the range.
TenableIO.Vulnerability.plugin.vpr.drivers.threat_recency.upper_bound String The upper bound of the range.
TenableIO.Vulnerability.plugin.vpr.drivers.threat_sources_last28 String A list of all sources (for example, social media channels, the dark web, etc.) where threat events related to this vulnerability occurred.
TenableIO.Vulnerability.plugin.vpr.drivers.product_coverage String The relative number of unique products affected by the vulnerability: ‘Low’, ‘Medium’, ‘High’, or ‘Very High’.
TenableIO.Vulnerability.plugin.vpr.updated Date The ISO timestamp when Tenable.io last imported the VPR for this vulnerability.
TenableIO.Vulnerability.port.port Number The port the scanner used to communicate with the asset.
TenableIO.Vulnerability.port.protocol String The protocol the scanner used to communicate with the asset.
TenableIO.Vulnerability.port.service String The service the scanner used to communicate with the asset.
TenableIO.Vulnerability.recast_reason String The text that appears in the Comment field of the recast rule in the Tenable.io user interface.
TenableIO.Vulnerability.recast_rule_uuid String The UUID of the recast rule that applies to the plugin.
TenableIO.Vulnerability.scan.completed_at Date The ISO timestamp when the scan completed.
TenableIO.Vulnerability.scan.schedule_uuid String The schedule UUID for the scan that found the vulnerability.
TenableIO.Vulnerability.scan.started_at Date The ISO timestamp when the scan started.
TenableIO.Vulnerability.scan.uuid String The UUID of the scan that found the vulnerability.
TenableIO.Vulnerability.severity String The severity of the vulnerability as defined using the Common Vulnerability Scoring System (CVSS) base score.
TenableIO.Vulnerability.severity_id Number The code for the severity assigned when a user recast the risk associated with the vulnerability.
TenableIO.Vulnerability.severity_default_id Number The code for the severity originally assigned to a vulnerability before a user recast the risk associated with the vulnerability.
TenableIO.Vulnerability.severity_modification_type String The type of modification a user made to the vulnerability’s severity.
TenableIO.Vulnerability.first_found Date The ISO date when a scan first detected the vulnerability on the asset.
TenableIO.Vulnerability.last_fixed Date The ISO date when a scan no longer detects the previously detected vulnerability on the asset.
TenableIO.Vulnerability.last_found Date The ISO date when a scan last detected the vulnerability on the asset.
TenableIO.Vulnerability.state String The state of the vulnerability as determined by the Tenable.io state service.
TenableIO.Vulnerability.indexed Date The date and time (in Unix time) when the vulnerability was indexed into Tenable.io.

Command example

!tenable-io-export-vulnerabilities numAssets=500

Context Example

{
    "TenableIO": {
        "Vulnerability": [
            {
                "asset": {
                    "device_type": "general-purpose",
                    "fqdn": "fqdn",
                    "hostname": "1.1.1.1",
                    "ipv4": "1.1.1.1",
                    "last_unauthenticated_results": "2024-11-07T11:11:05.906Z",
                    "network_id": "00000000-0000-0000-0000-000000000000",
                    "operating_system": [
                        "Linux Kernel 3.13 on Ubuntu 14.04 (trusty)"
                    ],
                    "tracked": true,
                    "uuid": "fake_uuid"
                },
                "first_found": "2024-11-07T11:11:05.906Z",
                "indexed": "2024-11-07T11:11:05.906Z",
                "last_fixed": "2024-11-07T11:11:05.906Z", 
                "last_found": "2024-11-07T11:11:05.906Z",
                "output": "outputs",
                "plugin": {
                    "checks_for_default_account": false,
                    "checks_for_malware": false,
                    "cvss3_base_score": 0,
                    "cvss3_temporal_score": 0,
                    "cvss_base_score": 0,
                    "cvss_temporal_score": 0,
                    "description": "Description",
                    "exploit_available": false,
                    "exploit_framework_canvas": false,
                    "exploit_framework_core": false,
                    "exploit_framework_d2_elliot": false,
                    "exploit_framework_exploithub": false,
                    "exploit_framework_metasploit": false,
                    "exploited_by_malware": false,
                    "exploited_by_nessus": false,
                    "family": "General",
                    "family_id": 30,
                    "has_patch": false,
                    "id": 00000,
                    "in_the_news": false,
                    "modification_date": "2024-11-07T11:11:05Z",
                    "name": "Name",
                    "publication_date": "2024-11-07T11:11:05Z",
                    "risk_factor": "None",
                    "see_also": [
                        ""
                    ],
                    "solution": "N/A",
                    "synopsis": "synopsis",
                    "type": "remote",
                    "unsupported_by_vendor": false,
                    "version": "$Revision: 1.16 $"
                },
                "port": {
                    "port": 0,
                    "protocol": "TCP"
                },
                "scan": {
                    "completed_at": "2024-11-07T11:11:05.906Z",
                    "schedule_uuid": "fake_uuid",
                    "started_at": "2024-11-07T11:11:05.906Z",
                    "uuid": "fake_uuid"
                },
                "severity": "info",
                "severity_default_id": 0,
                "severity_id": 0,
                "severity_modification_type": "NONE",
                "state": "OPEN"
            },
            {
                "asset": {
                    "device_type": "general-purpose",
                    "fqdn": "fqdn",
                    "hostname": "1.3.2.1",
                    "ipv4": "1.3.2.1",
                    "last_unauthenticated_results": "2024-11-07T11:11:05Z",
                    "network_id": "00000000-0000-0000-0000-000000000000",
                    "operating_system": [
                        "Nutanix"
                    ],
                    "tracked": true,
                    "uuid": "fake_uuid"
                },
                "first_found": "2024-11-07T11:11:05.906Z",
                "indexed": "2024-11-07T11:11:05.906Z",
                "last_fixed": "2024-11-07T11:11:05.906Z",
                "last_found": "2024-11-07T11:11:05.906Z",
                "output": "outputs",
                "plugin": {
                    "checks_for_default_account": false,
                    "checks_for_malware": false,
                    "cvss3_base_score": 0,
                    "cvss3_temporal_score": 0,
                    "cvss_base_score": 0,
                    "cvss_temporal_score": 0,
                    "description": "Description",
                    "exploit_available": false,
                    "exploit_framework_canvas": false,
                    "exploit_framework_core": false,
                    "exploit_framework_d2_elliot": false,
                    "exploit_framework_exploithub": false,
                    "exploit_framework_metasploit": false,
                    "exploited_by_malware": false,
                    "exploited_by_nessus": false,
                    "family": "SMTP problems",
                    "family_id": 12,
                    "has_patch": false,
                    "id": 00000,
                    "in_the_news": false,
                    "modification_date": "2024-11-07T11:11:05Z",
                    "name": "Name",
                    "publication_date": "2024-11-07T11:11:05Z",
                    "risk_factor": "None",
                    "see_also": [],
                    "solution": "N/A",
                    "synopsis": "synopsis.",
                    "type": "remote",
                    "unsupported_by_vendor": false,
                    "version": "1.12"
                },
                "port": {
                    "port": 25,
                    "protocol": "TCP",
                    "service": "smtp"
                },
                "scan": {
                    "completed_at": "2024-11-07T11:11:05.906Z",
                    "schedule_uuid": "fake_uuid",
                    "started_at": "2024-11-07T11:11:05.906Z",
                    "uuid": "fake_uuid"
                },
                "severity": "info",
                "severity_default_id": 0,
                "severity_id": 0,
                "severity_modification_type": "NONE",
                "state": "OPEN"
            },
        ]
    }
}

Human Readable Output

Export Vulnerabilities Results

ASSET ID ASSET NAME IPV4 ADDRESS OPERATING SYSTEM SYSTEM TYPE DNS NAME (FQDN) SEVERITY PLUGIN ID PLUGIN NAME VULNERABILITY PRIORITY RATING CVSSV2 BASE SCORECVE PROTOCOL PORT FIRST SEEN LAST SEEN DESCRIPTION SOLUTION
fake_uuid 1.1.1.1 1.1.1.1 Linux Kernel 3.13 on Ubuntu 14.04 (trusty) general-purpose fqdn info 00000 Name     TCP 22 2024-11-07T11:11:05.906Z 2024-11-07T11:11:05.906Z Description N/A
fake_uuid 1.3.2.1 1.3.2.1 Nutanix general-purpose fqdn info 00000 Name     TCP 0 2024-11-07T11:11:05.906Z 2024-11-07T11:11:05.906Z Description N/A

tenable-io-list-scan-filters

Lists the filtering, sorting, and pagination capabilities available for scan records on endpoints/commands that support them.

Base Command

tenable-io-list-scan-filters

Input

There are no inputs for this command.

Context Output

Path Type Description
TenableIO.ScanFilter.name String The name of the scan filter.
TenableIO.ScanFilter.readable_name String The readable name of the scan filter.
TenableIO.ScanFilter.control.type String The type of control associated with the scan filter.
TenableIO.ScanFilter.control.regex String The regular expression used by the scan filter.
TenableIO.ScanFilter.control.readable_regex String An example expression that the filter’s regular expression would match.
TenableIO.ScanFilter.operators String The operators available for the scan filter.
TenableIO.ScanFilter.group_name String The group name associated with the scan filter.

Command example


#### Context Example

```json
{
    "TenableIO": {
        "ScanFilter": [
            {
                "control": {
                    "readable_regex": "01234567-abcd-ef01-2345-6789abcdef01",
                    "regex": "[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}(,[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12})*",
                    "type": "entry"
                },
                "group_name": null,
                "name": "host.id",
                "operators": [
                    "eq",
                    "neq",
                    "match",
                    "nmatch"
                ],
                "readable_name": "Asset ID"
            },
            {
                "control": {
                    "maxlength": 18,
                    "readable_regex": "NUMBER",
                    "regex": "^[0-9]+(,[0-9]+)*",
                    "type": "entry"
                },
                "group_name": null,
                "name": "plugin.attributes.bid",
                "operators": [
                    "eq",
                    "neq",
                    "match",
                    "nmatch"
                ],
                "readable_name": "Bugtraq ID"
            }
        ]
    }
}

Human Readable Output

Tenable IO Scan Filters

Filter name Filter Readable name Filter Control type Filter regex Readable regex Filter operators
host.id Asset ID entry [0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}(,[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12})* 01234567-abcd-ef01-2345-6789abcdef01 eq,
neq,
match,
nmatch
plugin.attributes.bid Bugtraq ID entry ^[0-9]+(,[0-9]+)* NUMBER eq,
neq,
match,
nmatch

tenable-io-get-scan-history

Lists the individual runs of the specified scan.

Base Command

tenable-io-get-scan-history

Input

Argument Name Description Required
scanId The ID of the scan of which to get the runs. Required
sortFields A comma-separated list of fields by which to sort, in the order defined by “sortOrder”. Possible values are: start_date, end_date, status. Optional
sortOrder A comma-separated list of directions in which to sort the fields defined by “sortFields”.
If multiple directions are chosen, they will be sequentially matched with “sortFields”.
If only one direction is chosen it will be used to sort all values in “sortFields”.
For example:
If sortFields is “start_date,status” and sortOrder is “asc,desc”,
then start_date is sorted in ascending order and status in descending order.
If sortFields is “start_date,status” and sortOrder is simply “asc”,
then both start_date and status are sorted in ascending order.
. Possible values are: asc, desc. Default is asc.		 Optional
excludeRollover Whether to exclude rollover scans from the scan history. Possible values are: true, false. Default is false. Optional
page The page number of scan records to retrieve (used for pagination) starting from 1. The page size is defined by the “pageSize” argument. Optional
pageSize The number of scan records per page to retrieve (used for pagination). The page number is defined by the “page” argument. Optional
limit The maximum number of records to retrieve. If “pageSize” is defined, this argument is ignored. Default is 50. Optional

Context Output

Path Type Description
TenableIO.ScanHistory.time_end Number The end time of the scan.
TenableIO.ScanHistory.scan_uuid String The UUID (Universally Unique Identifier) of the scan.
TenableIO.ScanHistory.id Number The ID of the scan history.
TenableIO.ScanHistory.is_archived Boolean Indicates whether the scan is archived or not.
TenableIO.ScanHistory.time_start Number The start time of the scan.
TenableIO.ScanHistory.visibility String The visibility of the scan.
TenableIO.ScanHistory.targets.custom Boolean Indicates whether custom targets were used in the scan.
TenableIO.ScanHistory.targets.default Boolean Indicates whether the default targets were used in the scan.
TenableIO.ScanHistory.status String The status of the scan.

Command example

!tenable-io-get-scan-history scanId=16 excludeRollover=true sortFields=end_date,status sortOrder=desc page=2 pageSize=4

Context Example

{
    "TenableIO": {
        "ScanHistory": [
            {
                "id": 17235445,
                "is_archived": true,
                "reindexing": null,
                "scan_uuid": "69a55b8e-0d52-427a-81e0-7dfe4dc6eda6",
                "status": "completed",
                "targets": {
                    "custom": null,
                    "default": false
                },
                "time_end": 1677425182,
                "time_start": 1677424566,
                "visibility": "public"
            },
            {
                "id": 17235342,
                "is_archived": true,
                "reindexing": null,
                "scan_uuid": "2c592d52-df56-42e0-9f18-d892bdeb1e18",
                "status": "completed",
                "targets": {
                    "custom": null,
                    "default": false
                },
                "time_end": 1677424556,
                "time_start": 1677423906,
                "visibility": "public"
            },
            {
                "id": 17235033,
                "is_archived": true,
                "reindexing": null,
                "scan_uuid": "44586b4f-1051-415c-b375-db86f6bd8c13",
                "status": "completed",
                "targets": {
                    "custom": null,
                    "default": false
                },
                "time_end": 1677423865,
                "time_start": 1677423247,
                "visibility": "public"
            },
            {
                "id": 17234969,
                "is_archived": true,
                "reindexing": null,
                "scan_uuid": "06c12bf7-436f-489d-bb04-aae511ea9f5c",
                "status": "completed",
                "targets": {
                    "custom": null,
                    "default": false
                },
                "time_end": 1677423205,
                "time_start": 1677422585,
                "visibility": "public"
            }
        ]
    }
}

Human Readable Output

Tenable IO Scan History

History id History uuid Status Is archived Targets default Visibility Time start Time end
17235445 69a55b8e-0d52-427a-81e0-7dfe4dc6eda6 completed true false public 1677424566 1677425182
17235342 2c592d52-df56-42e0-9f18-d892bdeb1e18 completed true false public 1677423906 1677424556
17235033 44586b4f-1051-415c-b375-db86f6bd8c13 completed true false public 1677423247 1677423865
17234969 06c12bf7-436f-489d-bb04-aae511ea9f5c completed true false public 1677422585 1677423205

tenable-io-export-scan

Export and download a scan report.
Scan results older than 35 days are supported in Nessus and CSV formats only, and filters cannot be applied.
Scans that are actively running cannot be exported (run “tenable-io-list-scans” to view scan statuses)

Base Command

tenable-io-export-scan

Input

Argument Name Description Required
scanId The identifier for the scan to export. Run the “tenable-io-list-scans” command to get all available scans. Required
historyId The unique identifier of the historical data to export. Run the “tenable-io-get-scan-history” command to get history IDs. Optional
historyUuid The UUID of the historical data to export. Run the “tenable-io-get-scan-history” command to get history UUIDs. Optional
format The file format to export the scan in. Scans can be export in the HTML and PDF formats for up to 35 days.
For scans that are older than 35 days, only the Nessus and CSV formats are supported.
The “chapters” argument must be defined if the chosen format is HTML or PDF.
. Possible values are: Nessus, HTML, PDF, CSV. Default is CSV.		 Required
chapters A comma-separated list of chapters to include in the export. This argument is required if the file format is PDF or HTML. Possible values are: vuln_hosts_summary, vuln_by_host, compliance_exec, remediations, vuln_by_plugin, compliance. Optional
filter A comma-separated list of filters, in the format of “name quality value” to apply to the exported scan report.
Example: “port.protocol eq tcp, plugin_id eq 1234567”
Note: when used literally, commas and spaces should be escaped. (i.e. “\\,” for comma and “\\s” for space)
Filters cannot be applied to scans older than 35 days.
Run “tenable-io-list-scan-filters” to get all available filters, (“Filter name” (name), “Filter operators” (quality) and “Readable regex” (value) in response).
For more information: https://developer.tenable.com/docs/scan-export-filters-tio
.		 Optional
filterSearchType For multiple filters, specifies whether to use the AND or the OR logical operator. Possible values are: AND, OR. Default is AND. Optional
assetId The ID of the asset scanned. Optional

Context Output

Path Type Description
InfoFile.Size number The size of the file in bytes.
InfoFile.Name string The name of the file.
InfoFile.EntryID string The War Room entry ID of the file.
InfoFile.Info string The format and encoding of the file.
InfoFile.Type string The type of the file.
InfoFile.Extension unknown The file extension of the file.

Command example

!tenable-io-export-scan scanId=16 format=HTML chapters="compliance_exec,remediations,vuln_by_plugin" historyId=19540157 historyUuid=f7eaad37-23bd-4aac-a979-baab0e9a465b filterSearchType=OR filter="port.protocol eq tcp, plugin_id eq 1234567" assetId=10

Human Readable Output

Preparing scan report:

Returned file: scan_16_SSE-144f3dc6-cb2d-42fc-b6cc-dd20b807735f-html.html Download

tenable-io-get-audit-logs

Returns audit logs extracted from Tenable io.

Base Command

tenable-io-get-audit-logs

Input

Argument Name Description Required
should_push_events Set this argument to True in order to create events, otherwise the command will only display the events. Possible values are: true, false. Default is false. Required
limit The maximum number of alerts to return (maximum value - 5000). Optional
from_date Return events that occurred after the specified date. Optional
to_date Return events that occurred before the specified date. Optional
actor_id Return events that contain the specified actor UUID. Optional
target_id Return events matching the specified target UUID. Optional

Context Output

There is no context output for this command.

Command example

!tenable-io-get-audit-logs limit=1

Human Readable Output

Audit Logs List

Action Actor Crud Description Fields Id Is Anonymous Is Failure Received Target
user.create id: test c   {‘key’: ‘X-Access-Type’, ‘value’: ‘apikey’},
{‘key’: ‘X-Forwarded-For’, ‘value’: ‘1.2.3.4’},
{‘key’: ‘X-Request-Uuid’, ‘value’: ‘12:12:12:12:12’}		 12 true false 2022-05-18T16:33:02Z id: 12-1-1-1-1
name: test@test.com
type: User

<~PLATFORM>

License Requirements

The following configuration parameters require the Cortex XSIAM license:

  • Fetch events

The following configuration parameters require Cortex XSIAM with the Exposure Management add-on:

  • Fetch assets and vulnerabilities

</~PLATFORM>

Configuration parameters

  • url — Server URL (required)
  • access-key — Access key
  • credentials_access_key — (required)
  • secret-key — Secret key
  • credentials_secret_key — (required)
  • unsecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetchEvents — Fetch events
  • isFetchAssets — Fetch assets and vulnerabilities
  • first_fetch — Events first fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Events max fetch
  • eventFetchInterval — Events Fetch Interval
  • assetsFetchInterval — Assets and vulnerabilities fetch interval

Commands (15)

  • tenable-io-export-assets

    Retrieves details for the specified asset to include custom attributes.

  • tenable-io-export-scan

    Export and download a scan report. Scan results older than 35 days are supported in Nessus and CSV formats only, and filters cannot be applied. Scans that are actively running cannot be exported (run "tenable-io-list-scans" to view scan statuses).

  • tenable-io-export-vulnerabilities

    Retrieves details for the specified asset to include custom attributes.

  • tenable-io-get-asset-details

    Retrieves details for the specified asset including custom attributes.

  • tenable-io-get-audit-logs

    Returns audit logs extracted from Tenable io.

  • tenable-io-get-scan-history

    Lists the individual runs of the specified scan.

  • tenable-io-get-scan-report

    Retrieves a scan report for the specified scan.

  • tenable-io-get-scan-status

    Checks the status of a specific scan using the scan ID. Possible values: "Running", "Completed", and "Empty" (Ready to run).

  • tenable-io-get-vulnerabilities-by-asset

    Gets a list of up to 5000 of the vulnerabilities recorded for a specified asset.

  • tenable-io-get-vulnerability-details

    Retrieves details for the specified vulnerability.

  • tenable-io-launch-scan

    Launches a scan with existing or custom targets. You can specify custom targets in the command arguments.

  • tenable-io-list-scan-filters

    Lists the filtering, sorting, and pagination capabilities available for scan records on endpoints/commands that support them.

  • tenable-io-list-scans

    Retrieves scans from the Tenable platform.

  • tenable-io-pause-scan

    Pauses all scans inputted as an array. Will pause scans whose status is 'Running'.

  • tenable-io-resume-scan

    Resumes all scans inputted as an array. Will resume scans whose status is 'Paused'.

Source

Tenable_io.py Tenable_io_test.py Tenable_io.yml Tenable_io_description.md command_examples.txt
Download History Raw 
category: Vulnerability Management
provider: Tenable
sectionorder:
- Connect
- Collect
commonfields:
  id: Tenable.io
  version: -1
configuration:
- defaultvalue: https://cloud.tenable.com/
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Access key
  name: access-key
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: Access Key
  name: credentials_access_key
  hiddenusername: true
  type: 9
  required: true
  section: Connect
- display: Secret key
  name: secret-key
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: Secret Key
  name: credentials_secret_key
  hiddenusername: true
  type: 9
  required: true
  section: Connect
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  advanced: true
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  advanced: true
  section: Connect
- display: Fetch events
  name: isFetchEvents
  type: 8
  required: false
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Fetch assets and vulnerabilities
  name: isFetchAssets
  type: 8
  required: false
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
  - exposure_management
- defaultvalue: 7 days
  display: Events first fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  required: false
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- additionalinfo: The maximum number of audit logs to retrieve for each event type. For more information about event types see the help section.
  defaultvalue: '1000'
  display: Events max fetch
  name: max_fetch
  type: 0
  required: false
  advanced: true
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- defaultvalue: '1'
  display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  required: false
  advanced: true
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- defaultvalue: '720'
  display: Assets and vulnerabilities fetch interval
  name: assetsFetchInterval
  type: 19
  required: false
  advanced: true
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
  - exposure_management
description: A comprehensive asset-centric solution to accurately track resources while accommodating dynamic assets such as cloud, mobile devices, containers, and web applications. Fetch capabilities are only available for certain licenses.
display: Tenable Vulnerability Management (formerly Tenable.io)
name: Tenable.io
script:
  commands:
  - arguments:
    - description: |-
        The ID of the folder whose scans should be listed. Scans are stored
        in specific folders on Tenable, e.g.: folderId=8.
      name: folderId
    - description: 'Limit the results to those that have only changed since this time. Date format will be YYYY-MM-DD format or relational expressions like “7 days ago”.'
      name: lastModificationDate
    description: Retrieves scans from the Tenable platform.
    name: tenable-io-list-scans
    outputs:
    - contextPath: TenableIO.Scan.Id
      description: The unique ID of the scan.
      type: number
    - contextPath: TenableIO.Scan.Name
      description: The name of the scan.
      type: string
    - contextPath: TenableIO.Scan.Target
      description: The targets to scan.
      type: string
    - contextPath: TenableIO.Scan.Status
      description: The status of the scan (completed, aborted, imported, pending, running, resuming, canceling, cancelled, pausing, paused, stopping, stopped).
      type: string
    - contextPath: TenableIO.Scan.StartTime
      description: The scheduled start time for the scan.
      type: date
    - contextPath: TenableIO.Scan.EndTime
      description: The scheduled end time for the scan.
      type: date
    - contextPath: TenableIO.Scan.Enabled
      description: If true, the schedule for the scan is enabled.
      type: boolean
    - contextPath: TenableIO.Scan.Type
      description: The type of scan (local, remote, or agent).
      type: string
    - contextPath: TenableIO.Scan.Owner
      description: The owner of the scan.
      type: string
    - contextPath: TenableIO.Scan.Scanner
      description: The scanner assigned for the scan.
      type: string
    - contextPath: TenableIO.Scan.Policy
      description: The policy assigned for the scan.
      type: string
    - contextPath: TenableIO.Scan.CreationDate
      description: The creation date for the scan in Unix time.
      type: date
    - contextPath: TenableIO.Scan.LastModificationDate
      description: The last modification date for the scan in Unix time.
      type: date
    - contextPath: TenableIO.Scan.FolderId
      description: The unique ID of the folder where the scan has been stored.
      type: number
  - arguments:
    - default: true
      description: The ID of the scan to launch.
      name: scanId
      required: true
    - description: If specified, targets to be scanned instead of the default. This value can be an array where each index is a target, or an array with a single index of comma-separated targets.
      name: scanTargets
    description: Launches a scan with existing or custom targets. You can specify custom targets in the command arguments.
    name: tenable-io-launch-scan
    outputs:
    - contextPath: TenableIO.Scan.Id
      description: The unique ID of the scan.
      type: number
    - contextPath: TenableIO.Scan.Targets
      description: The targets to scan.
      type: string
    - contextPath: TenableIO.Scan.Status
      description: The status of the scan (completed, aborted, imported, pending, running, resuming, canceling, cancelled, pausing, paused, stopping, stopped).
      type: string
  - arguments:
    - default: true
      description: The ID of the scan to retrieve.
      name: scanId
      required: true
    - auto: PREDEFINED
      defaultValue: 'no'
      description: 'If true, the report will contain remediation and host information for the specified scan. Otherwise, the report will only contain vulnerabilities. Possible values: "yes" and "no".'
      name: detailed
      predefined:
      - 'yes'
      - 'no'
    - auto: PREDEFINED
      defaultValue: 'no'
      description: 'Whether to return the basic details of the specified scan. Possible values: "yes" and "no".'
      name: info
      predefined:
      - 'yes'
      - 'no'
    description: Retrieves a scan report for the specified scan.
    name: tenable-io-get-scan-report
    outputs:
    - contextPath: TenableIO.Scan.Id
      description: The unique ID of the scan.
      type: number
    - contextPath: TenableIO.Scan.Name
      description: The name of the scan.
      type: string
    - contextPath: TenableIO.Scan.Targets
      description: The targets to scan.
      type: string
    - contextPath: TenableIO.Scan.Status
      description: 'The status of the scan ("completed", "aborted", "imported", "pending", "running", "resuming", "canceling", "cancelled", "pausing", "paused", "stopping", "stopped").'
      type: string
    - contextPath: TenableIO.Scan.StartTime
      description: The scheduled start time for the scan.
      type: string
    - contextPath: TenableIO.Scan.EndTime
      description: The scheduled end time for the scan.
      type: string
    - contextPath: TenableIO.Scan.Scanner
      description: The scanner assigned for the scan.
      type: string
    - contextPath: TenableIO.Scan.Policy
      description: The policy assigned to the scan.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Id
      description: The unique ID of the vulnerability.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Name
      description: The name of the vulnerability.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Severity
      description: The severity level of the vulnerability.
      type: number
    - contextPath: TenableIO.Vulnerabilities.Description
      description: The description of the vulnerability.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Synopsis
      description: A brief summary of the vulnerability.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Solution
      description: Information on how to fix the vulnerability.
      type: string
    - contextPath: TenableIO.Vulnerabilities.FirstSeen
      description: When the vulnerability was first seen.
      type: date
    - contextPath: TenableIO.Vulnerabilities.LastSeen
      description: When the vulnerability was last seen.
      type: date
    - contextPath: TenableIO.Vulnerabilities.VulnerabilityOccurences
      description: A count of the vulnerability occurrences.
      type: number
    - contextPath: TenableIO.Assets.Hostname
      description: The name of the host.
      type: string
    - contextPath: TenableIO.Assets.Score
      description: The overall score for the host.
      type: number
    - contextPath: TenableIO.Assets.Critical
      description: The percentage of critical findings on the host.
      type: number
    - contextPath: TenableIO.Assets.High
      description: The number of high findings on the host.
      type: number
    - contextPath: TenableIO.Assets.Medium
      description: The number of medium findings on the host.
      type: number
    - contextPath: TenableIO.Assets.Low
      description: The number of low findings on the host.
      type: number
    - contextPath: TenableIO.Remediations.Id
      description: The unique ID of the remediation.
      type: string
    - contextPath: TenableIO.Remediations.Description
      description: Specific information related to the vulnerability and steps to remediate.
      type: string
    - contextPath: TenableIO.Remediations.AffectedHosts
      description: The number of hosts affected.
      type: number
    - contextPath: TenableIO.Remediations.AssociatedVulnerabilities
      description: The number of vulnerabilities associated with the remedy.
      type: number
  - arguments:
    - default: true
      description: The unique ID of the vulnerability.
      name: vulnerabilityId
      required: true
    description: Retrieves details for the specified vulnerability.
    name: tenable-io-get-vulnerability-details
    outputs:
    - contextPath: TenableIO.Vulnerabilities.Name
      description: The name of the vulnerability.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Severity
      description: Integer [0-4] indicating how severe the vulnerability is, where 0 is info only.
      type: number
    - contextPath: TenableIO.Vulnerabilities.Type
      description: The type of the vulnerability.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Family
      description: Object containing plugin information such as family, type, and publication and modification dates.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Description
      description: The description of the vulnerability.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Synopsis
      description: A brief summary of the vulnerability.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Solution
      description: Information on how to fix the vulnerability.
      type: string
    - contextPath: TenableIO.Vulnerabilities.FirstSeen
      description: When the vulnerability was first seen.
      type: date
    - contextPath: TenableIO.Vulnerabilities.LastSeen
      description: When the vulnerability was last seen.
      type: date
    - contextPath: TenableIO.Vulnerabilities.PublicationDate
      description: The publication date of the vulnerability.
      type: date
    - contextPath: TenableIO.Vulnerabilities.ModificationDate
      description: The last modification date for the vulnerability in Unix time.
      type: date
    - contextPath: TenableIO.Vulnerabilities.VulnerabilityOccurences
      description: A count of the vulnerability occurrences.
      type: number
    - contextPath: TenableIO.Vulnerabilities.CvssVector
      description: The Common Vulnerability Scoring System vector.
      type: string
    - contextPath: TenableIO.Vulnerabilities.CvssBaseScore
      description: The Common Vulnerability Scoring System allotted base score.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Cvss3Vector
      description: The Common Vulnerability Scoring System version 3 vector.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Cvss3BaseScore
      description: The Common Vulnerability Scoring System version 3 allotted base score.
      type: string
  - arguments:
    - description: Hostname of the asset.
      name: hostname
    - description: IP of the asset.
      name: ip
    - description: The number of days of data prior to and including today that should be returned.
      name: dateRange
    description: Gets a list of up to 5000 of the vulnerabilities recorded for a specified asset.
    name: tenable-io-get-vulnerabilities-by-asset
    outputs:
    - contextPath: TenableIO.Assets.Hostname
      description: Hostname of the asset.
      type: number
    - contextPath: TenableIO.Assets.Vulnerabilities
      description: A list of all the vulnerability IDs associated with the asset.
      type: number
    - contextPath: TenableIO.Vulnerabilities.Id
      description: The vulnerability unique ID.
      type: number
    - contextPath: TenableIO.Vulnerabilities.Name
      description: The name of the vulnerability.
      type: string
    - contextPath: TenableIO.Vulnerabilities.Severity
      description: Integer [0-4] indicating how severe the vulnerability is, where 0 is info only.
      type: number
    - contextPath: TenableIO.Vulnerabilities.Family
      description: The vulnerability family.
      type: string
    - contextPath: TenableIO.Vulnerabilities.VulnerabilityOccurences
      description: The number of times the vulnerability was found.
      type: number
    - contextPath: TenableIO.Vulnerabilities.VulnerabilityState
      description: 'The current state of the reported vulnerability ("Active", "Fixed", "New", etc.).'
      type: string
  - arguments:
    - default: true
      description: The unique ID of the scan.
      name: scanId
      required: true
    description: |-
      Checks the status of a specific scan using the scan ID. Possible values: "Running", "Completed", and "Empty" (Ready to run).
    name: tenable-io-get-scan-status
    outputs:
    - contextPath: TenableIO.Scan.Id
      description: The unique ID of the scan specified.
      type: string
    - contextPath: TenableIO.Scan.Status
      description: The status of the scan specified.
      type: string
  - arguments:
    - description: Comma-separated list of scan IDs.
      isArray: true
      name: scanId
      required: true
    description: Resumes all scans inputted as an array. Will resume scans whose status is 'Paused'.
    name: tenable-io-resume-scan
    outputs:
    - contextPath: TenableIO.Scan.Id
      description: The unique ID of the scan.
      type: String
    - contextPath: TenableIO.Scan.Status
      description: The status of the scan (completed, aborted, imported, pending, running, resuming, canceling, cancelled, pausing, paused, stopping, stopped).
      type: String
  - arguments:
    - description: Comma-separated list of scan IDs.
      isArray: true
      name: scanId
      required: true
    description: Pauses all scans inputted as an array. Will pause scans whose status is 'Running'.
    name: tenable-io-pause-scan
    outputs:
    - contextPath: TenableIO.Scan.Id
      description: The unique id of the scan.
      type: String
    - contextPath: TenableIO.Scan.Status
      description: The status of the scan (completed, aborted, imported, pending, running, resuming, canceling, cancelled, pausing, paused, stopping, stopped).
      type: String
  - arguments:
    - description: IP Address of the asset.
      name: ip
      required: true
    description: Retrieves details for the specified asset including custom attributes.
    name: tenable-io-get-asset-details
    outputs:
    - contextPath: TenableIO.AssetDetails.attributes
      description: Array of custom attributes of asset.
      type: unknown
    - contextPath: TenableIO.AssetDetails.counts
      description: Array of audit statuses and vulnerabilities by type.
      type: unknown
    - contextPath: TenableIO.AssetDetails.created_at
      description: Date asset was created.
      type: date
    - contextPath: TenableIO.AssetDetails.first_seen
      description: Date asset was first seen.
      type: date
    - contextPath: TenableIO.AssetDetails.fqdn
      description: Array of fully-qualified domain names.
      type: unknown
    - contextPath: TenableIO.AssetDetails.id
      description: GUID of tenable.io asset.
      type: string
    - contextPath: TenableIO.AssetDetails.interfaces
      description: Array of interface information.
    - contextPath: TenableIO.AssetDetails.ipv4
      description: Array of IPv4 addresses.
      type: unknown
    - contextPath: TenableIO.AssetDetails.operating_system
      description: Array of operating systems.
      type: unknown
    - contextPath: TenableIO.AssetDetails.tags
      description: Array of tags added to asset.
      type: unknown
    - contextPath: TenableIO.AssetDetails.updated_at
      description: Date the asset was last updated.
      type: date
  - arguments:
    - description: Specifies the number of assets per exported chunk. The range is 100-10000. Tenable does not recommend using a chunk size larger than 5000 as the potential for an error increases above this amount.
      defaultValue: 100
      name: chunkSize
    - description: The interval in seconds between each poll.
      defaultValue: 10
      name: intervalInSeconds
    - description: The timeout for the polling in seconds.
      defaultValue: 600
      name: timeOut
    - description: When specified, the results returned in the list are limited to assets created later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.'
      name: createdAt
    - description: When specified, the results returned in the list are limited to assets updated later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.'
      name: updatedAt
    - description: When specified, the results returned in the list are limited to assets terminated later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.'
      name: terminatedAt
    - description: When set to true, returns assets which have any value for the terminatedAt attribute.
      name: isTerminated
    - description: When specified, the results returned in the list are limited to assets deleted later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.'
      name: deletedAt
    - auto: PREDEFINED
      description: When set to true, returns assets which have any value for the deletedAt attribute.
      name: isDeleted
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Specifies whether the asset is included in the asset count for the Tenable.io instance. If true, returns only licensed assets. If false, returns only unlicensed assets.
      name: isLicensed
      predefined:
      - 'true'
      - 'false'
    - description: When specified, the results returned in the list are limited to assets with a first scan time later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.'
      name: firstScanTime
    - description: When specified, the results returned in the list are limited to assets with a last credentialed scan time later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.'
      name: lastAuthenticatedScanTime
    - description: When specified, the results returned in the list are limited to assets with a last assessed time later than the date specified. Date format will be epoch date format or relational expressions like “7 days ago”.'
      name: lastAssessed
    - auto: PREDEFINED
      description: If true, returns all assets that have a ServiceNow Sys ID, regardless of value. If false, returns all assets that do not have a ServiceNow Sys ID.
      name: serviceNowSysId
      predefined:
      - 'true'
      - 'false'
    - description: 'A comma-separated list of sources. Commonly used values are: AWS, NESSUS_AGENT, PVS,NESSUS_SCAN, WAS. When specified, the results returned in the list are limited to assets that have the specified source.'
      name: sources
      isArray: true
    - auto: PREDEFINED
      description: If true, returns all assets that have a plugin results associated with it.
      name: hasPluginResults
      predefined:
      - 'true'
      - 'false'
    - description: When specified, the results returned in the list are limited to assets with the specified tag category.
      name: tagCategory
    - description: When specified, the results returned in the list are limited to assets with the specified tag value. Can be comma-delimited for multiple items.
      name: tagValue
    - name: exportUuid
      description: The export UUID.
      hidden: true
    polling: true
    description: Retrieves details for the specified asset to include custom attributes.
    name: tenable-io-export-assets
    outputs:
    - contextPath: TenableIO.Asset.id
      description: The UUID of the asset in Tenable.io. Use this value as the unique key for the asset.
      type: String
    - contextPath: TenableIO.Asset.has_agent
      description: Specifies whether a Nessus agent scan identified the asset.
      type: Boolean
    - contextPath: TenableIO.Asset.has_plugin_results
      description: Specifies whether the asset has plugin results associated with it.
      type: Boolean
    - contextPath: TenableIO.Asset.created_at
      description: The time and date when Tenable.io created the asset record.
      type: Date
    - contextPath: TenableIO.Asset.terminated_at
      description: The time and date when a user terminated the Amazon Web Service (AWS) virtual machine instance of the asset.
      type: Date
    - contextPath: TenableIO.Asset.terminated_by
      description: The user who terminated the AWS instance of the asset.
      type: String
    - contextPath: TenableIO.Asset.updated_at
      description: The time and date when the asset record was last updated.
      type: Date
    - contextPath: TenableIO.Asset.deleted_at
      description: The time and date when a user deleted the asset record. When a user deletes an asset record, Tenable.io retains the record until the asset ages out of the license count.
      type: Date
    - contextPath: TenableIO.Asset.deleted_by
      description: The user who deleted the asset record.
      type: String
    - contextPath: TenableIO.Asset.first_seen
      description: The time and date when a scan first identified the asset.
      type: Date
    - contextPath: TenableIO.Asset.last_seen
      description: The time and date of the scan that most recently identified the asset.
      type: Date
    - contextPath: TenableIO.Asset.first_scan_time
      description: The time and date of the first scan run against the asset.
      type: Date
    - contextPath: TenableIO.Asset.last_scan_time
      description: The time and date of the last scan run against the asset.
      type: Date
    - contextPath: TenableIO.Asset.last_authenticated_scan_date
      description: The time and date of the last credentialed scan run on the asset.
      type: Date
    - contextPath: TenableIO.Asset.last_licensed_scan_date
      description: The time and date of the last scan that identified the asset as licensed. Tenable.io categorizes an asset as licensed if a scan of that asset has returned results from a non-discovery plugin within the last 90 days.
      type: Date
    - contextPath: TenableIO.Asset.last_scan_id
      description: The UUID of the scan configuration used during the last scan of the asset.
      type: String
    - contextPath: TenableIO.Asset.last_schedule_id
      description: The schedule id for the last scan of the asset.
      type: String
    - contextPath: TenableIO.Asset.azure_vm_id
      description: The unique identifier of the Microsoft Azure virtual machine instance. For more information, see "Accessing and Using Azure VM Unique ID" in the Microsoft Azure documentation.
      type: String
    - contextPath: TenableIO.Asset.azure_resource_id
      description: The unique identifier of the resource in the Azure Resource Manager. For more information, see the Azure Resource Manager Documentation.
      type: String
    - contextPath: TenableIO.Asset.gcp_project_id
      description: The unique identifier of the virtual machine instance in Google Cloud Platform (GCP).
      type: String
    - contextPath: TenableIO.Asset.gcp_zone
      description: The customized name of the project to which the virtual machine instance belongs in GCP. For more information see "Creating and Managing Projects" in the GCP documentation.
      type: String
    - contextPath: TenableIO.Asset.gcp_instance_id
      description: The zone where the virtual machine instance runs in GCP. For more information, see "Regions and Zones" in the GCP documentation.
      type: String
    - contextPath: TenableIO.Asset.aws_ec2_instance_ami_id
      description: The unique identifier of the Linux AMI image in Amazon Elastic Compute Cloud (Amazon EC2). For more information, see the Amazon Elastic Compute Cloud Documentation.
      type: String
    - contextPath: TenableIO.Asset.aws_ec2_instance_id
      description: The unique identifier of the Linux instance in Amazon EC2. For more information, see the Amazon Elastic Compute Cloud Documentation.
      type: String
    - contextPath: TenableIO.Asset.agent_uuid
      description: The unique identifier of the Nessus agent that identified the asset.
      type: String
    - contextPath: TenableIO.Asset.bios_uuid
      description: The BIOS UUID of the asset.
      type: String
    - contextPath: TenableIO.Asset.network_id
      description: The ID of the network object associated with scanners that identified the asset.
      type: String
    - contextPath: TenableIO.Asset.network_name
      description: The ID of the network object associated with scanners that identified the asset.
      type: String
    - contextPath: TenableIO.Asset.aws_owner_id
      description: The canonical user identifier for the AWS account associated with the virtual machine instance.
      type: String
    - contextPath: TenableIO.Asset.aws_availability_zone
      description: The availability zone where Amazon Web Services hosts the virtual machine instance.
      type: String
    - contextPath: TenableIO.Asset.aws_region
      description: The region where AWS hosts the virtual machine instance.
      type: String
    - contextPath: TenableIO.Asset.aws_vpc_id
      description: The unique identifier for the virtual public cloud that hosts the AWS virtual machine instance.
      type: String
    - contextPath: TenableIO.Asset.aws_ec2_instance_group_name
      description: The virtual machine instance's group in AWS.
      type: String
    - contextPath: TenableIO.Asset.aws_ec2_instance_state_name
      description: The state of the virtual machine instance in AWS at the time of the scan.
      type: String
    - contextPath: TenableIO.Asset.aws_ec2_instance_type
      description: The type of instance in AWS EC2.
      type: String
    - contextPath: TenableIO.Asset.aws_subnet_id
      description: The unique identifier of the AWS subnet where the virtual machine instance was running at the time of the scan.
      type: String
    - contextPath: TenableIO.Asset.aws_ec2_product_code
      description: The product code associated with the AMI used to launch the virtual machine instance in AWS EC2.
      type: String
    - contextPath: TenableIO.Asset.aws_ec2_name
      description: The name of the virtual machine instance in AWS EC2.
      type: String
    - contextPath: TenableIO.Asset.mcafee_epo_guid
      description: The unique identifier of the asset in McAfee ePolicy Orchestrator (ePO).
      type: String
    - contextPath: TenableIO.Asset.mcafee_epo_agent_guid
      description: The unique identifier of the McAfee ePO agent that identified the asset.
      type: String
    - contextPath: TenableIO.Asset.servicenow_sysid
      description: The unique record identifier of the asset in ServiceNow.
      type: String
    - contextPath: TenableIO.Asset.bigfix_asset_id
      description: The unique identifiers of the asset in HCL BigFix.
      type: String
    - contextPath: TenableIO.Asset.agent_names
      description: The names of any Nessus agents that scanned and identified the asset.
      type: String
    - contextPath: TenableIO.Asset.installed_software
      description: A list of Common Platform Enumeration (CPE) values that represent software applications a scan identified as present on an asset.
      type: String
    - contextPath: TenableIO.Asset.ipv4s
      description: The IPv4 addresses that scans have associated with the asset record.
      type: String
    - contextPath: TenableIO.Asset.ipv6s
      description: The IPv6 addresses that scans have associated with the asset record.
      type: String
    - contextPath: TenableIO.Asset.fqdns
      description: The fully-qualified domain names that scans have associated with the asset record.
      type: String
    - contextPath: TenableIO.Asset.mac_addresses
      description: The MAC addresses that scans have associated with the asset record.
      type: String
    - contextPath: TenableIO.Asset.netbios_names
      description: The NetBIOS names that scans have associated with the asset record.
      type: String
    - contextPath: TenableIO.Asset.operating_systems
      description: The operating systems that scans have associated with the asset record.
      type: String
    - contextPath: TenableIO.Asset.system_types
      description: The system types as reported by Plugin ID 54615. Possible values include router, general-purpose, scan-host, and embedded.
      type: String
    - contextPath: TenableIO.Asset.hostnames
      description: The hostnames that scans have associated with the asset record.
      type: String
    - contextPath: TenableIO.Asset.ssh_fingerprints
      description: The SSH key fingerprints that scans have associated with the asset record.
      type: String
    - contextPath: TenableIO.Asset.qualys_asset_ids
      description: The Asset ID of the asset in Qualys. For more information, see the Qualys documentation.
      type: String
    - contextPath: TenableIO.Asset.qualys_host_ids
      description: The Host ID of the asset in Qualys. For more information, see the Qualys documentation.
      type: String
    - contextPath: TenableIO.Asset.manufacturer_tpm_ids
      description: The manufacturer's unique identifiers of the Trusted Platform Module (TPM) associated with the asset.
      type: String
    - contextPath: TenableIO.Asset.symantec_ep_hardware_keys
      description: The hardware keys for the asset in Symantec Endpoint Protection.
      type: String
    - contextPath: TenableIO.Asset.sources.name
      description: The name of the entity that reported the asset details. Sources can include sensors, connectors, and API imports.
      type: String
    - contextPath: TenableIO.Asset.sources.first_seen
      description: The ISO timestamp when the source first reported the asset.
      type: Date
    - contextPath: TenableIO.Asset.sources.last_seen
      description: The ISO timestamp when the source last reported the asset.
      type: Date
    - contextPath: TenableIO.Asset.tags.uuid
      description: The UUID of the tag.
      type: String
    - contextPath: TenableIO.Asset.tags.key
      description: The tag category (the first half of the category:value pair).
      type: String
    - contextPath: TenableIO.Asset.tags.value
      description: The tag value (the second half of the category:value pair).
      type: String
    - contextPath: TenableIO.Asset.tags.added_by
      description: The UUID of the user who assigned the tag to the asset.
      type: String
    - contextPath: TenableIO.Asset.tags.added_at
      description: The ISO timestamp when the tag was assigned to the asset.
      type: Date
    - contextPath: TenableIO.Asset.network_interfaces.name
      description: The name of the interface.
      type: String
    - contextPath: TenableIO.Asset.network_interfaces.mac_address
      description: The MAC addresses of the interface.
      type: String
    - contextPath: TenableIO.Asset.network_interfaces.ipv6
      description: One or more IPv6 addresses belonging to the interface.
      type: String
    - contextPath: TenableIO.Asset.network_interfaces.fqdns
      description: One or more FQDNs belonging to the interface.
      type: String
    - contextPath: TenableIO.Asset.network_interfaces.ipv4s
      description: One or more IPv4 addresses belonging to the interface.
      type: String
    - contextPath: TenableIO.Asset.acr_score
      description: The Asset Criticality Rating (ACR) for the asset.
      type: String
    - contextPath: TenableIO.Asset.exposure_score
      description: The Asset Exposure Score (AES) for the asset.
      type: String
  - arguments:
    - description: The number of assets used to chunk the vulnerabilities. The range for number of assets in a chunk is 50-5000.
      defaultValue: 50
      name: numAssets
    - description: The interval in seconds between each poll.
      defaultValue: 10
      name: intervalInSeconds
    - description: The timeout for the polling in seconds.
      defaultValue: 50
      name: timeOut
    - auto: PREDEFINED
      description: Specifies whether or not to include unlicensed assets.
      name: includeUnlicensed
      predefined:
      - 'true'
      - 'false'
    - description: When specified, restricts the search for vulnerabilities to assets assigned an IP address within the specified CIDR range.
      name: cidrRange
    - description: 'When specified, the results returned in the list are limited to vulnerabilities that were first found between the specified date and now. Date format will be epoch date format or relational expressions like “7 days ago”.'
      name: firstFound
    - description: 'When specified, the results returned in the list are limited to vulnerabilities that were fixed between the specified date and now. Date format will be epoch date format or relational expressions like “7 days ago”.'
      name: lastFixed
    - description: 'When specified, the results returned in the list are limited to vulnerabilities that were last found between the specified date and now. Date format will be epoch date format or relational expressions like “7 days ago”.'
      name: lastFound
    - description: The ID of the network object associated with scanners that detected the vulnerabilities you want to export.
      name: networkId
      defaultValue: '00000000-0000-0000-0000-000000000000'
    - description: A comma-separated list of plugin IDs for which you want to filter the vulnerabilities.
      name: pluginId
      isArray: true
    - auto: PREDEFINED
      description: The plugin type for which you want to filter the vulnerabilities. If not set, export includes all vulnerabilities regardless of plugin type.
      name: pluginType
      predefined:
      - 'remote'
      - 'local'
      - 'combined'
      - 'settings'
      - 'summary'
      - 'third-party'
      - 'reputation'
    - description: 'A comma-separated list of severities of the vulnerabilities to include in the export. Defaults to all severity levels. The severity of a vulnerability is defined using the Common Vulnerability Scoring System (CVSS) base score. Supported array values are: info, low, medium, high, critical.'
      name: severity
      isArray: true
    - description: 'The start date for the range of data you want to export. Date format will be epoch date format or relational expressions like “7 days ago”. Note: This filter cannot be used in conjunction with the firstFound, lastFound, or lastFixed.'
      name: since
      isArray: true
    - description: 'A comma-separated list of states of the vulnerabilities you want the export to include. Supported, case-insensitive values are: open, reopened, fixed. This parameter is required if your request includes firstFound, lastFound, or lastFixed parameters. If your request omits this parameter, the export includes default states open and reopened only.'
      name: state
      isArray: true
    - description: When specified, the results returned in the list are limited to assets with the specified tag category.
      name: tagCategory
    - description: When specified, the results returned in the list are limited to assets with the specified tag value. Can be comma-delimited for multiple items.
      name: tagValue
      isArray: true
    - auto: PREDEFINED
      description: 'An operator that determines the limitation on Vulnerability Priority Rating (VPR), scores value specified at vprScoreValue argument. Supported values are: equal, not equal, lt-lesser, lte-lesser than or equal , gt-greater than , gte-greater than or equal.'
      name: vprScoreOperator
      predefined:
      - 'gte'
      - 'gt'
      - 'lte'
      - 'lt'
      - 'equal'
      - 'not equal'
    - description: 'When specified, the results returned in the list are limited to vulnerabilities with the specified Vulnerability Priority Rating (VPR), score or scores according to the score operator (vprScoreOperator) argument. VPR values range are 0.1-10.0.'
      name: vprScoreValue
      isArray: true
    - description: 'When specified, the results returned in the list are limited to vulnerabilities with the specified Vulnerability Priority Rating (VPR) score range. Example value: 2.5-3.5.'
      name: vprScoreRange
    - name: exportUuid
      description: The export UUID.
      hidden: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to create vulnerabilities, otherwise the command will only display the vulnerabilities.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: false
    polling: true
    description: Retrieves details for the specified asset to include custom attributes.
    name: tenable-io-export-vulnerabilities
    outputs:
    - contextPath: TenableIO.Vulnerability.asset.agent_uuid
      description: The UUID of the agent that performed the scan where the vulnerability was found.
      type: String
    - contextPath: TenableIO.Vulnerability.asset.bios_uuid
      description: The BIOS UUID of the asset where the vulnerability was found.
      type: String
    - contextPath: TenableIO.Vulnerability.asset.device_type
      description: The type of asset where the vulnerability was found.
      type: String
    - contextPath: TenableIO.Vulnerability.asset.fqdn
      description: The fully-qualified domain name of the asset where a scan found the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.asset.hostname
      description: The host name of the asset where a scan found the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.asset.uuid
      description: The UUID of the asset where a scan found the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.asset.ipv6
      description: The IPv6 address of the asset where a scan found the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.asset.last_authenticated_results
      description: The last date credentials that were used successfully to scan the asset.
      type: Date
    - contextPath: TenableIO.Vulnerability.asset.last_unauthenticated_results
      description: The last date when the asset was scanned without using credentials.
      type: Date
    - contextPath: TenableIO.Vulnerability.asset.mac_address
      description: The MAC address of the asset where a scan found the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.asset.netbios_name
      description: The NETBIOS name of the asset where a scan found the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.asset.netbios_workgroup
      description: The NETBIOS workgroup of the asset where a scan found the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.asset.operating_system
      description: The operating system of the asset where a scan found the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.asset.network_id
      description: The ID of the network object associated with scanners that identified the asset.
      type: String
    - contextPath: TenableIO.Vulnerability.asset.tracked
      description: A value specifying whether Tenable.io tracks the asset in the asset management system.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.output
      description: The text output of the Nessus scanner.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.bid
      description: The Bugtraq ID for the plugin.
      type: Number
    - contextPath: TenableIO.Vulnerability.plugin.canvas_package
      description: The name of the CANVAS exploit pack that includes the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.checks_for_default_account
      description: A value specifying whether the plugin checks for default accounts.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.checks_for_malware
      description: A value specifying whether the plugin checks for malware.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.cpe
      description: The Common Platform Enumeration (CPE) number for the plugin.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cve
      description: The Common Vulnerability and Exposure (CVE) ID for the plugin.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_base_score
      description: The CVSSv3 base score (intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments).
      type: Number
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_temporal_score
      description: The CVSSv3 temporal score (characteristics of a vulnerability that change over time but not among user environments).
      type: Number
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_temporal_vector.exploitability
      description: The CVSSv3 Exploit Maturity Code (E) for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_temporal_vector.remediation_level
      description: The CVSSv3 Remediation Level (RL) temporal metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_temporal_vector.report_confidence
      description: The CVSSv3 Report Confidence (RC) temporal metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_temporal_vector.raw
      description: The complete CVSSv3 temporal vector metrics and result values for the vulnerability the plugin covers in a condensed and coded format.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_vector.access_vector
      description: The CVSSv3 Attack Vector (AV) metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_vector.access_complexity
      description: The CVSSv3 Access Complexity (AC) metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_vector.authentication
      description: The CVSSv3 Authentication (Au) metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_vector.confidentiality_impact
      description: The CVSSv3 integrity impact metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_vector.integrity_impact
      description: The CVSSv3 integrity impact metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_vector.availability_impact
      description: The CVSSv3 availability impact metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss3_vector.raw
      description: The complete cvss3_vector metrics and result values for the vulnerability the plugin covers in a condensed and coded format.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss_temporal_vector.exploitability
      description: The CVSSv2 Exploitability (E) temporal metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss_temporal_vector.remediation_level
      description: The CVSSv2 Remediation Level (RL) temporal metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss_temporal_vector.report_confidence
      description: The CVSSv2 Report Confidence (RC) temporal metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss_temporal_vector.raw
      description: The complete CVSS temporal vector metrics and result values for the vulnerability the plugin covers in a condensed and coded format.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss_vector.access_vector
      description: The CVSSv2 Access Vector (AV) metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss_vector.access_complexity
      description: The CVSSv2 Access Complexity (AC) metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss_vector.authentication
      description: The CVSSv2 Authentication (Au) metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss_vector.confidentiality_impact
      description: The CVSSv2 confidentiality impact metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss_vector.integrity_impact
      description: The CVSSv2 integrity impact metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss_vector.availability_impact
      description: The CVSSv2 availability impact metric for the vulnerability the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss_vector.raw
      description: The complete CVSSv2 vector metrics and result values for the vulnerability the plugin covers in a condensed and coded format.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.cvss_base_score
      description: The CVSSv2 base score (intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments).
      type: Number
    - contextPath: TenableIO.Vulnerability.plugin.cvss_temporal_score
      description: The CVSSv2 temporal score (characteristics of a vulnerability that change over time but not among user environments).
      type: Number
    - contextPath: TenableIO.Vulnerability.plugin.d2_elliot_name
      description: The name of the exploit in the D2 Elliot Web Exploitation framework.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.description
      description: Full text description of the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.exploit_available
      description: A value specifying whether a public exploit exists for the vulnerability.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.exploit_framework_canvas
      description: A value specifying whether an exploit exists in the Immunity CANVAS framework.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.exploit_framework_core
      description: A value specifying whether an exploit exists in the CORE Impact framework.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.exploit_framework_d2_elliot
      description: A value specifying whether an exploit exists in the D2 Elliot Web Exploitation framework.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.exploit_framework_exploithub
      description: A value specifying whether an exploit exists in the ExploitHub framework.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.exploit_framework_metasploit
      description: A value specifying whether an exploit exists in the Metasploit framework.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.exploitability_ease
      description: Description of how easy it is to exploit the issue.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.exploited_by_malware
      description: Whether the vulnerability discovered by this plugin is known to be exploited by malware.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.exploited_by_nessus
      description: A value specifying whether Nessus exploited the vulnerability during the process of identification.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.exploithub_sku
      description: The SKU number of the exploit in the ExploitHub framework.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.family
      description: The family to which the plugin belongs.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.family_id
      description: The ID of the plugin family.
      type: Number
    - contextPath: TenableIO.Vulnerability.plugin.has_patch
      description: A value specifying whether the vendor has published a patch for the vulnerability.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.id
      description: The ID of the plugin that identified the vulnerability.
      type: Number
    - contextPath: TenableIO.Vulnerability.plugin.in_the_news
      description: A value specifying whether this plugin has received media attention (for example, ShellShock, Meltdown).
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.metasploit_name
      description: The name of the related exploit in the Metasploit framework.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.ms_bulletin
      description: The Microsoft security bulletin that the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.name
      description: The name of the plugin that identified the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.patch_publication_date
      description: The date on which the vendor published a patch for the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.modification_date
      description: The date on which the plugin was last modified.
      type: Date
    - contextPath: TenableIO.Vulnerability.plugin.publication_date
      description: The date on which the plugin was published.
      type: Date
    - contextPath: TenableIO.Vulnerability.plugin.risk_factor
      description: 'The risk factor associated with the plugin. Possible values are: Low, Medium, High, or Critical.'
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.see_also
      description: Links to external websites that contain helpful information about the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.solution
      description: Remediation information for the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.stig_severity
      description: Security Technical Implementation Guide (STIG) severity code for the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.synopsis
      description: Brief description of the plugin or vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.type
      description: The general type of plugin check (for example, local or remote).
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.unsupported_by_vendor
      description: Whether software found by this plugin is unsupported by the software's vendor (for example, Windows 95 or Firefox 3).
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.usn
      description: Ubuntu security notice that the plugin covers.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.version
      description: The version of the plugin used to perform the check.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.vuln_publication_date
      description: The publication date of the plugin.
      type: Date
    - contextPath: TenableIO.Vulnerability.plugin.xrefs.type
      description: References to third-party information about the vulnerability, exploit, or update associated with the plugin.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.xrefs.id
      description: References to third-party information about the vulnerability, exploit, or update associated with the plugin.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.vpr.score
      description: The Vulnerability Priority Rating (VPR) for the vulnerability.
      type: Number
    - contextPath: TenableIO.Vulnerability.plugin.vpr.drivers.age_of_vuln
      description: A range representing the number of days since the National Vulnerability Database (NVD) published the vulnerability.
      type: Number
    - contextPath: TenableIO.Vulnerability.plugin.vpr.drivers.age_of_vuln.lower_bound
      description: The lower bound of the range.
      type: Number
    - contextPath: TenableIO.Vulnerability.plugin.vpr.drivers.age_of_vuln.upper_bound
      description: The upper bound of the range.
      type: Number
    - contextPath: TenableIO.Vulnerability.plugin.vpr.drivers.exploit_code_maturity
      description: The relative maturity of a possible exploit for the vulnerability based on the existence, sophistication, and prevalence of exploit intelligence from internal and external sources.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.vpr.drivers.cvss3_impact_score
      description: The NVD-provided CVSSv3 impact score for the vulnerability.
      type: Number
    - contextPath: TenableIO.Vulnerability.plugin.vpr.drivers.cvss_impact_score_predicted
      description: A value specifying whether Tenable.io predicted the CVSSv3 impact score for the vulnerability.
      type: Boolean
    - contextPath: TenableIO.Vulnerability.plugin.vpr.drivers.threat_intensity_last28
      description: 'The relative intensity based on the number and frequency of recently observed threat events related to this vulnerability: Very Low, Low, Medium, High, or Very High.'
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.vpr.drivers.threat_recency
      description: A range representing the number of days since a threat event occurred for the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.vpr.drivers.threat_recency.lower_bound
      description: The lower bound of the range.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.vpr.drivers.threat_recency.upper_bound
      description: The upper bound of the range.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.vpr.drivers.threat_sources_last28
      description: A list of all sources (for example, social media channels, the dark web, etc.) where threat events related to this vulnerability occurred.
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.vpr.drivers.product_coverage
      description: "The relative number of unique products affected by the vulnerability: 'Low', 'Medium', 'High', or 'Very High'."
      type: String
    - contextPath: TenableIO.Vulnerability.plugin.vpr.updated
      description: The ISO timestamp when Tenable.io last imported the VPR for this vulnerability.
      type: Date
    - contextPath: TenableIO.Vulnerability.port.port
      description: The port the scanner used to communicate with the asset.
      type: Number
    - contextPath: TenableIO.Vulnerability.port.protocol
      description: The protocol the scanner used to communicate with the asset.
      type: String
    - contextPath: TenableIO.Vulnerability.port.service
      description: The service the scanner used to communicate with the asset.
      type: String
    - contextPath: TenableIO.Vulnerability.recast_reason
      description: The text that appears in the Comment field of the recast rule in the Tenable.io user interface.
      type: String
    - contextPath: TenableIO.Vulnerability.recast_rule_uuid
      description: The UUID of the recast rule that applies to the plugin.
      type: String
    - contextPath: TenableIO.Vulnerability.scan.completed_at
      description: The ISO timestamp when the scan completed.
      type: Date
    - contextPath: TenableIO.Vulnerability.scan.schedule_uuid
      description: The schedule UUID for the scan that found the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.scan.started_at
      description: The ISO timestamp when the scan started.
      type: Date
    - contextPath: TenableIO.Vulnerability.scan.uuid
      description: The UUID of the scan that found the vulnerability.
      type: String
    - contextPath: TenableIO.Vulnerability.severity
      description: The severity of the vulnerability as defined using the Common Vulnerability Scoring System (CVSS) base score.
      type: String
    - contextPath: TenableIO.Vulnerability.severity_id
      description: The code for the severity assigned when a user recast the risk associated with the vulnerability.
      type: Number
    - contextPath: TenableIO.Vulnerability.severity_default_id
      description: The code for the severity originally assigned to a vulnerability before a user recast the risk associated with the vulnerability.
      type: Number
    - contextPath: TenableIO.Vulnerability.severity_modification_type
      description: The type of modification a user made to the vulnerability's severity.
      type: String
    - contextPath: TenableIO.Vulnerability.first_found
      description: The ISO date when a scan first detected the vulnerability on the asset.
      type: Date
    - contextPath: TenableIO.Vulnerability.last_fixed
      description: The ISO date when a scan no longer detects the previously detected vulnerability on the asset.
      type: Date
    - contextPath: TenableIO.Vulnerability.last_found
      description: The ISO date when a scan last detected the vulnerability on the asset.
      type: Date
    - contextPath: TenableIO.Vulnerability.state
      description: The state of the vulnerability as determined by the Tenable.io state service.
      type: String
    - contextPath: TenableIO.Vulnerability.indexed
      description: The date and time (in Unix time) when the vulnerability was indexed into Tenable.io.
      type: Date
  - arguments: []
    description: Lists the filtering, sorting, and pagination capabilities available for scan records on endpoints/commands that support them.
    name: tenable-io-list-scan-filters
    outputs:
    - contextPath: TenableIO.ScanFilter.name
      description: The name of the scan filter.
      type: String
    - contextPath: TenableIO.ScanFilter.readable_name
      description: The readable name of the scan filter.
      type: String
    - contextPath: TenableIO.ScanFilter.control.type
      description: The type of control associated with the scan filter.
      type: String
    - contextPath: TenableIO.ScanFilter.control.regex
      description: The regular expression used by the scan filter.
      type: String
    - contextPath: TenableIO.ScanFilter.control.readable_regex
      description: An example expression that the filter's regular expression would match.
      type: String
    - contextPath: TenableIO.ScanFilter.operators
      description: The operators available for the scan filter.
      type: String
    - contextPath: TenableIO.ScanFilter.group_name
      description: The group name associated with the scan filter.
      type: String
  - arguments:
    - name: scanId
      description: The ID of the scan of which to get the runs.
      required: true
    - name: sortFields
      description: A comma-separated list of fields by which to sort, in the order defined by "sortOrder".
      isArray: true
      auto: PREDEFINED
      predefined:
      - start_date
      - end_date
      - status
    - name: sortOrder
      description: |
        A comma-separated list of directions in which to sort the fields defined by "sortFields".
        If multiple directions are chosen, they will be sequentially matched with "sortFields".
        If only one direction is chosen it will be used to sort all values in "sortFields".
        For example:
          If sortFields is "start_date,status" and sortOrder is "asc,desc",
          then start_date is sorted in ascending order and status in descending order.
          If sortFields is "start_date,status" and sortOrder is simply "asc",
          then both start_date and status are sorted in ascending order.
      isArray: true
      defaultValue: asc
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - name: excludeRollover
      description: Whether to exclude rollover scans from the scan history.
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: page
      description: The page number of scan records to retrieve (used for pagination) starting from 1. The page size is defined by the "pageSize" argument.
    - name: pageSize
      description: The number of scan records per page to retrieve (used for pagination). The page number is defined by the "page" argument.
    - name: limit
      description: The maximum number of records to retrieve. If "pageSize" is defined, this argument is ignored.
      defaultValue: '50'
    description: Lists the individual runs of the specified scan.
    name: tenable-io-get-scan-history
    outputs:
    - contextPath: TenableIO.ScanHistory.time_end
      description: The end time of the scan.
      type: Number
    - contextPath: TenableIO.ScanHistory.scan_uuid
      description: The UUID (Universally Unique Identifier) of the scan.
      type: String
    - contextPath: TenableIO.ScanHistory.id
      description: The ID of the scan history.
      type: Number
    - contextPath: TenableIO.ScanHistory.is_archived
      description: Indicates whether the scan is archived or not.
      type: Boolean
    - contextPath: TenableIO.ScanHistory.time_start
      description: The start time of the scan.
      type: Number
    - contextPath: TenableIO.ScanHistory.visibility
      description: The visibility of the scan.
      type: String
    - contextPath: TenableIO.ScanHistory.targets.custom
      description: Indicates whether custom targets were used in the scan.
      type: Boolean
    - contextPath: TenableIO.ScanHistory.targets.default
      description: Indicates whether the default targets were used in the scan.
      type: Boolean
    - contextPath: TenableIO.ScanHistory.status
      description: The status of the scan.
      type: String
  - arguments:
    - name: scanId
      description: The identifier for the scan to export. Run the "tenable-io-list-scans" command to get all available scans.
      required: true
    - name: historyId
      description: The unique identifier of the historical data to export. Run the "tenable-io-get-scan-history" command to get history IDs.
    - name: historyUuid
      description: The UUID of the historical data to export. Run the "tenable-io-get-scan-history" command to get history UUIDs.
    - name: format
      required: true
      description: |
        The file format to export the scan in. Scans can be export in the HTML and PDF formats for up to 35 days.
         For scans that are older than 35 days, only the Nessus and CSV formats are supported.
         The "chapters" argument must be defined if the chosen format is HTML or PDF.
      defaultValue: CSV
      auto: PREDEFINED
      predefined:
      - Nessus
      - HTML
      - PDF
      - CSV
    - name: chapters
      description: A comma-separated list of chapters to include in the export. This argument is required if the file format is PDF or HTML.
      isArray: true
      auto: PREDEFINED
      predefined:
      - vuln_hosts_summary
      - vuln_by_host
      - compliance_exec
      - remediations
      - vuln_by_plugin
      - compliance
    - name: filter
      description: |
        A comma-separated list of filters, in the format of "name quality value" to apply to the exported scan report.
         Example: "port.protocol eq tcp, plugin_id eq 1234567"
         Note: when used literally, commas and spaces should be escaped. (i.e. "\\," for comma and "\\s" for space)
         Filters cannot be applied to scans older than 35 days.
         Run "tenable-io-list-scan-filters" to get all available filters, ("Filter name" (name), "Filter operators" (quality) and "Readable regex" (value) in response).
         For more information: https://developer.tenable.com/docs/scan-export-filters-tio
      isArray: true
    - name: filterSearchType
      description: For multiple filters, specifies whether to use the AND or the OR logical operator.
      defaultValue: AND
      auto: PREDEFINED
      predefined:
      - AND
      - OR
    - name: assetId
      description: The ID of the asset scanned.
    - name: fileId
      description: ''
      hidden: true
    - name: hide_polling_output
      description: ''
      hidden: true
    polling: true
    description: |-
      Export and download a scan report.
      Scan results older than 35 days are supported in Nessus and CSV formats only, and filters cannot be applied.
      Scans that are actively running cannot be exported (run "tenable-io-list-scans" to view scan statuses).
    name: tenable-io-export-scan
    outputs:
    - contextPath: InfoFile.Size
      description: The size of the file in bytes.
      type: number
    - contextPath: InfoFile.Name
      description: The name of the file.
      type: string
    - contextPath: InfoFile.EntryID
      description: The War Room entry ID of the file.
      type: string
    - contextPath: InfoFile.Info
      description: The format and encoding of the file.
      type: string
    - contextPath: InfoFile.Type
      description: The type of the file.
      type: string
    - contextPath: InfoFile.Extension
      description: The file extension of the file.
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to create events, otherwise the command will only display the events.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The maximum number of alerts to return (maximum value - 5000).
      name: limit
    - description: Return events that occurred after the specified date.
      name: from_date
    - description: Return events that occurred before the specified date.
      name: to_date
    - description: Return events that contain the specified actor UUID.
      name: actor_id
    - description: Return events matching the specified target UUID.
      name: target_id
    description: Returns audit logs extracted from Tenable io.
    name: tenable-io-get-audit-logs
  runonce: false
  script: '-'
  isfetchevents: true
  isfetchassets: true
  subtype: python3
  type: python
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- Tenable.io test
fromversion: 5.0.0
supportedModules:
- agentix
- xsiam
- exposure_management