StartAgenticValidation
Ad-hoc entry point for Tenzai exposure validation. On the first click it gathers exposure context (optionally enriching from the ASM service, or parsing the socket from the exposure name), creates a Tenzai validation scan (folding in the Cortex issue Description), and marks the issue Running. It then polls (via ScheduledCommand) until the scan is terminal and writes the verdict — status, exploit validation, assessment details, reproduction, fix guidance, credit usage, reference URL — back onto the issue.
python · Tenzai
Details
| ID | StartAgenticValidation |
|---|---|
| Language | python |
| From Version | 6.10.0 |
| Docker Image | demisto/python3:3.12.14.13053055 |
| Tags | incident-action-button |
README
Ad-hoc entry point for Tenzai exposure validation, invoked from the Start Tenzai Validation button on the Tenzai issue layout (the Validate tab).
On the first click it gathers the exposure context (optionally enriching from the ASM service via asm-get-external-service, or parsing the host:port from the exposure name), triggers a Tenzai validation assessment with tenzai-trigger-validation-check, and sets Tenzai Assessment Status to Running. It then drives the whole loop itself: a self-scheduling ScheduledCommand polls tenzai-fetch-validation-check until the assessment reaches a terminal status, then writes the verdict — status, exploit validation, assessment details, reproduction, fix guidance, credit usage, and reference URL — back onto the issue. It does not change the issue severity.
Transient fetch failures are retried on the next poll; if the polling window (MAX_POLLS) is exhausted without a verdict the status is set to Error rather than left on Running. A second click while a validation is already Running on the issue is a no-op (no duplicate assessment).
When run from the Tenzai Agentic Issue Validation playbook, the playbook passes poll=false: the script then only triggers and marks the issue Running, and the playbook owns the poll + write-back so the loop is not run twice.
Inputs
| Argument | Description |
|---|---|
| service_id | ASM ExternalService id; used to enrich the target when target is not provided. |
| target | The exposure target (IP or FQDN). If omitted, derived from the ASM service or parsed from exposure_name. |
| exposure_name | Human-readable exposure name (typically the issue name). |
| supporting_data | Free-text context (CVEs, rule, classification). |
| alert_internal_id | The Cortex issue/alert id for result correlation. |
| application_type / port / protocol / service_classification | Optional raw fields forwarded to Tenzai. |
| poll | Whether the script polls to completion and writes the verdict itself. Defaults to true (the button); the playbook passes false. |
Outputs
| Path | Description |
|---|---|
| Tenzai.ValidationCheck.checkId | The Tenzai validation assessment id. |
| Tenzai.ValidationCheck.status | The assessment status (Running while polling; Complete/Error when terminal). |
| Tenzai.ValidationCheck.validated | Whether the exposure was validated as exploitable (on terminal completion). |
| Tenzai.ValidationCheck.evidence | Markdown assessment details (on terminal completion). |
| Tenzai.ValidationCheck.reproduction | Markdown reproduction steps (on terminal completion). |
| Tenzai.ValidationCheck.guidance | Remediation or mitigation guidance (on terminal completion). |
| Tenzai.ValidationCheck.creditUsage | Approximate Tenzai credit/ACU cost of the assessment (on terminal completion). |
| Tenzai.ValidationCheck.referenceUrl | Deep link to the assessment results in Tenzai (on terminal completion). |
comment: |- Ad-hoc entry point for Tenzai exposure validation. On the first click it gathers exposure context (optionally enriching from the ASM service, or parsing the socket from the exposure name), creates a Tenzai validation scan (folding in the Cortex issue Description), and marks the issue Running. It then polls (via ScheduledCommand) until the scan is terminal and writes the verdict — status, exploit validation, assessment details, reproduction, fix guidance, credit usage, reference URL — back onto the issue. commonfields: id: StartAgenticValidation version: -1 name: StartAgenticValidation args: - name: service_id description: The Cortex ASM ExternalService id (asmserviceid). Used to enrich the target when 'target' is not provided. - name: target description: The exposure target (IP address or FQDN). If omitted, it is derived by enriching the Cortex ASM service. - name: exposure_name description: The human-readable name for the exposure (typically the issue/alert name). - name: issue_description description: The Cortex issue Description, folded into the Tenzai application guidelines for the scan. - name: supporting_data description: The free-text context (inferred CVEs, attack-surface rule, classification) for the assessment objective. - name: alert_internal_id description: The Cortex issue/alert id to correlate the results back to. - name: application_type description: The optional Tenzai application type hint. auto: PREDEFINED predefined: - WEB_APP - NETWORK_SERVICE - NETWORK_HOST - name: port description: The exposed service port. type: number - name: protocol description: The exposed service protocol. - name: service_classification description: The Cortex ASM service classification. - name: category description: Whether the exposure is a CVE or a misconfiguration. Inferred from the CVE id when omitted. auto: PREDEFINED predefined: - cve - misconfiguration - name: cve_id description: The CVE identifier for the exposure. Auto-filled from the Cortex ASM service's inferred CVEs when omitted. - name: rule_id description: The external source's rule identifier for the exposure (e.g. a Cortex attack-surface rule id). - name: severity description: The severity as reported by Cortex (free text), attached to the exposure reference. - name: cwe description: The CWE identifier for the exposure when Cortex supplies one. - name: guidelines description: The optional analyst guidelines for this assessment (free text). Appended to the synthesized scan guidelines; the exposure focus and the single-target scope lock are always kept. - name: scan_id_internal description: Internal use only — the scan id carried across scheduled poll re-runs. Not for manual use. hidden: true - name: poll_count description: Internal use only — the poll iteration carried across scheduled poll re-runs. Not for manual use. hidden: true - name: terminal_retry_count description: Internal use only — the post-terminal enrichment-retry iteration carried across scheduled poll re-runs. Not for manual use. hidden: true - name: write_only description: Internal use only — when true (the playbook path, after its own poll), fetch the verdict and persist it via the shared writer; reschedules only to wait for lead enrichment, never to poll scan status. Requires scan_id_internal. hidden: true - name: alert_id description: Internal use only — the Cortex alert id carried across the poll loop to scope the verdict to this alert's lead. Not for manual use. hidden: true - name: cve description: Internal use only — the exposure CVE carried across the poll loop for lead correlation. Not for manual use. hidden: true - name: rule_id description: Internal use only — the Cortex rule id carried across the poll loop for lead correlation. Not for manual use. hidden: true - name: poll description: Whether the script drives the poll loop and writes the verdict itself (default true, for the ad-hoc button). The playbook passes false and owns polling/write-back. auto: PREDEFINED predefined: - "true" - "false" defaultValue: "true" outputs: - contextPath: Tenzai.Scan.id description: The Tenzai validation scan id. type: String - contextPath: Tenzai.Scan.status description: The scan status (Running while polling; Complete or Error when terminal). type: String - contextPath: Tenzai.Scan.validated description: Whether the exposure was validated as exploitable (set on terminal completion). type: Boolean - contextPath: Tenzai.Scan.evidence description: The markdown assessment details (set on terminal completion). type: String - contextPath: Tenzai.Scan.reproduction description: The markdown reproduction steps (set on terminal completion). type: String - contextPath: Tenzai.Scan.guidance description: The remediation or mitigation guidance (set on terminal completion). type: String - contextPath: Tenzai.Scan.creditUsage description: The approximate Tenzai credit/ACU cost of the scan (set on terminal completion). type: Number - contextPath: Tenzai.Scan.referenceUrl description: The deep link to the scan results in Tenzai (set on terminal completion). type: String - contextPath: Tenzai.Scan.applicationId description: The Tenzai application id the scan ran under (set on terminal completion). type: String - contextPath: Tenzai.Scan.duration description: The wall-clock duration of the scan, in whole seconds (set on terminal completion). type: Number - contextPath: Tenzai.Scan.exposureStatus description: The exposure lead's terminal status (e.g. MATERIALIZED, INVALIDATED, BLOCKED) — the literal lead status shown in the panel's Status cell (set on terminal completion). type: String - contextPath: Tenzai.Scan.startedAt description: The date when the assessment started, as a full ISO-8601 timestamp (e.g., 2024-01-15T12:34:56Z; the exposure lead's earliest OPEN status-history entry; set on terminal completion). type: Date - contextPath: Tenzai.Scan.cwe description: The exposure lead's CWE classification, e.g. CWE-79 (set on terminal completion). type: String - contextPath: Tenzai.Scan.owaspCategory description: The exposure lead's OWASP category, e.g. A03 (set on terminal completion). type: String - contextPath: Tenzai.Scan.leadRationale description: The markdown Description/Conclusion narrative for a CVE exposure lead (set on terminal completion). type: String - contextPath: Tenzai.Scan.timeline description: The exposure lead's status history — one entry per status change (status + time; set on terminal completion). type: Unknown - contextPath: Tenzai.Scan.alertId description: The originating Cortex alert id the exposure lead was seeded with (carried so the playbook can scope the verdict to this alert's lead). type: String - contextPath: Tenzai.Scan.cve description: The CVE id the exposure lead was seeded with, when the exposure is a CVE. type: String - contextPath: Tenzai.Scan.ruleId description: The Cortex rule id the exposure lead was seeded with, when supplied. type: String polling: true timeout: 3m0s scripttarget: 0 subtype: python3 type: python runas: DBotWeakRole dockerimage: demisto/python3:3.12.14.13053055 enabled: true runonce: false script: '' tags: - incident-action-button fromversion: 6.10.0 tests: - No tests (auto formatted)