Additional Information

Helpful Tips

The integration performs the following sequence on each scan:

  1. The scanner authenticates to the Nutanix Prism Central API with the values in the Nutanix Prism Central credential, using either the v4 API for pc.2024.3 and later or the v3 API for earlier versions.

  2. Tenable collects cluster data and reports the result in Integration Status (204872).

  3. If Discover Hosts or Discover Virtual Machines is enabled, Tenable enumerates the hosts or virtual machines and adds them to the scan targets.

  4. Tenable reports the collected data in Nutanix Data Collection (160185) and uses it to check Nutanix AOS and AHV for known vulnerabilities.

Practical guidance:

  • Cluster information retrieval and hypervisor host collection run primarily against a single target (the Nutanix Prism Central host), meaning that a failure to authenticate to the target affects all subsequent vulnerability detections.

  • Disable Discover Virtual Machines in very large environments where virtual machine inventory is not needed, to reduce scan duration and request volume.

Testing Integration Connectivity

Use the following curl commands to troubleshoot the Prism Central API endpoints that the integration uses. In each command, replace ip_address, username, and password with your own values. Tenable recommends that you run these commands from the terminal of the host that runs the scanner. Each pair of commands includes one command for API v4 and one for API v3. Use the API v3 commands only for Nutanix Prism Central versions earlier than pc.2024.3.

If the commands connect to the web server and the server returns an error, compare the result with the example error responses. If the commands cannot connect to the web server, the -v (--verbose) option helps identify general connection errors.

Collecting Cluster Data

Collect cluster data (API v4)

Copy 
curl -kv --request GET \
  --url https://ip_address:9440/api/clustermgmt/v4.0/config/clusters \
  --header 'Accept: application/json' \
  -u 'username:password'

Example successful response:

Copy 
{
  "data": [
    {
      "$reserved": {
        "$fv": "v4.r1"
      },
      "$objectType": "clustermgmt.v4.config.Cluster"
      ...
    }]
}

Example error response:

Copy 
{
  "timestamp": "2025-08-18T20:25:52.448+00:00",
  "status": 400,
  "error": "Bad Request",
  "message": "Bad Request",
  "path": "/api/clustermgmt/v4.0/config/clusters"
}

Collect cluster data (API v3)

Copy 
curl -kv --request POST \
  --url https://ip_address:9440/api/nutanix/v3/clusters/list \
  --header 'Accept: application/json' \
  -u 'username:password' \
  --header 'Content-Type: application/json' \
  --data '{
    "kind": "cluster",
    "length": 1,
    "offset": 0,
    "sort_attribute": "uuid",
    "sort_order": "ASCENDING"
}'

Example successful response:

Copy 
{
  "api_version": "3.1",
  "metadata": {...},
  "entities": [
    {...}
  ]
}

Example error response:

Copy 
{
  "kind": "cluster",
  "code": 0,
  "message_list": [
    {...}
  ],
  "state": "string",
  "api_version": "3.1.0"
}

Collecting hypervisor hosts and virtual machines

The following commands test the API functions that enumerate hypervisor hosts and virtual machines for auto-discovery. You are less likely to need them for troubleshooting. Interpret success and error responses the same way as for the cluster commands.

Collect hypervisor hosts (API v4)

Copy 
curl -kv --request GET \
  --url https://ip_address:9440/api/clustermgmt/v4.0/config/hosts \
  --header 'Accept: application/json' \
  -u 'username:password'

Collect hypervisor hosts (API v3)

Copy 
curl -kv --request POST \
  --url https://ip_address:9440/api/nutanix/v3/hosts/list \
  --header 'Accept: application/json' \
  -u 'username:password' \
  --header 'Content-Type: application/json' \
  --data '{
    "kind": "host",
    "length": 1,
    "offset": 0,
    "sort_attribute": "uuid",
    "sort_order": "ASCENDING"
}'

Collect virtual machines (API v4)

Copy 
curl -kv --request GET \
  --url https://ip_address:9440/api/vmm/v4.0/ahv/config/vms \
  --header 'Accept: application/json' \
  -u 'username:password'

Collect virtual machines (API v3)

Copy 
curl -kv --request POST \
  --url https://ip_address:9440/api/nutanix/v3/vms/list \
  --header 'Accept: application/json' \
  -u 'username:password' \
  --header 'Content-Type: application/json' \
  --data '{
    "kind": "vm",
    "length": 1,
    "offset": 0,
    "sort_attribute": "uuid",
    "sort_order": "ASCENDING"
}'