Tenable Security Center API: Accept Risk Rule

/acceptRiskRule

Methods
GET

Gets the list of Accept Risk Rules across all reps, plugins and orgs, unless filters are provided.

Fields Parameter
Expand

The fields parameter should be specified along the query string, and it takes the syntax

    ?fields=<field>,...

Allowed Fields

*id
**repository
**organization
**user
**plugin
**hostType
**hostValue
**port
**protocol
**expires
**status
comments
createdTime
modifiedTime

Legend

* = always comes back
** = comes back if fields list not specified on GET all

redFont =  field is a JSON object ( e.g. "repository" :{ "id" : <id>, "name" : <name> } )

Filters
Expand
1
2
3
repositoryIDs=<number>,... DEFAULT 0 (i.e. all Repositories)
pluginID=<number> | <string> "all" DEFAULT "all" (i.e. all Plugins)
port=<number> | <string> "all" DEFAULT "all" (i.e. all Ports)

Session User is role "1" (administrator)

1
organizationIDs=<number>,... | <string> "all" DEFAULT "all" (i.e. all Organizations)

Session User is not role "1" (administrator)

1
organizationIDs=<number>,... | <string> "all" DEFAULT :sessionOrgID:


Paginated results:

By default, the result set encompasses all Accept Risk Rule

To obtain paginated results, a parameter value should be included in the request as follows:

?paginated=true

Additionally, for paginated results, the following parameters can be sent:

startOffset <number> (positive integer) DEFAULT 0,
endOffset <number> (integer >= startOffset) DEFAULT 50,
sortDirection <string> "ASC" | "DESC" DEFAULT "DESC",
sortField <string> "userID" | "pluginID" | "port" | "protocol" | "expires" | "createdTime",

Example Response
Expand
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
 {
    "type" : "regular",
    "response" : [
        {
            "id" : "3",
            "hostType" : "all",
            "hostValue" : "",
            "port" : "any",
            "protocol" : "any",
            "expires" : "-1",
            "status" : "0",
            "repository" : {
                "id" : "17",
                "name" : "New Fields Repo",
                "description" : "",
                "type" : "Local",
                "uuid" : "A2FF7E13-2C0E-470E-A3C9-E077FE065A54"         },
            "organization" : {
                "id" : "8",
                "name" : "Org",
                "description" : "Testing for Policies with New Schema",
                "uuid" : "FF00F4D0-5B9F-4A26-998C-19430295284A"         },
            "user" : {
                "id" : "1",
                "username" : "head",
                "firstname" : "Security Manager",
                "lastname" : "",
                "uuid" : "96F2AD1B-1B83-462E-908A-84E6054F6B64"         },
            "plugin" : {
                "id" : "0",
                "name" : "Open Port",
                "description" : "",
                "type" : "active"           }
        }
    ],
    "error_code" : 0,
    "error_msg" : "",
    "warnings" : [],
    "timestamp" : 1410275054
}

POST

Adds an Accept Risk Rule to one repository.

Request Parameters
Expand
1
2
3
4
5
6
7
8
{
    "repositories" : [
        {
            "id" : <number>       }...
    ],
    "plugin" : {
        "id" : <number>   },
    ...

hostType for Universal Repository type

1
2
3
...
"hostType" : <string> "all" | "asset" | "ip" | "hostUUID",
...

hostType for Agent Repository type

1
2
3
...
"hostType" : <string> "all" | "asset" | "uuid",
...

hostType for IPv4 or IPv6 Repository type

1
2
3
...
"hostType" : <string> "all" | "asset" | "ip" ,
...
1
2
3
4
5
6
    "port" : <number:1..65535> | <string> "any" DEFAULT "any",
    "protocol" : <number:1..> | <string> "any" DEFAULT "any",
    "comments" : <string> DEFAULT "",
    "expires" : <number> (integer >= -1) DEFAULT -1 (not set)
    ...
}

hostType "asset"

The "hostValue" parameter should contain a usable, accessible Asset ID.

1
2
3
4
...
    "hostValue" : {
        "id" : <number>   }
...

hostType "ip"

The "hostValue" parameter should contain a newline-separated and/or comma-separated list of IPs.

1
2
...
    "hostValue" : <string>...

hostType "uuid"

The "hostValue" parameter should contain a newline-separated and/or comma-separated list of UUIDs.

1
2
...
    "hostValue" : <string>...

hostType "hostUUID"

The "hostValue" parameter should contain a newline-separated and/or comma-separated list of UUIDs.

1
2
...
    "hostValue" : <string>...
Example Response
Expand
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
 {
    "type" : "regular",
    "response" : [
        {
            "id" : "3",
            "hostType" : "all",
            "hostValue" : "",
            "port" : "any",
            "protocol" : "any",
            "comments" : "",
            "expires" : "-1",
            "status" : "0",
            "createdTime" : "1410275013",
            "modifiedTime" : "1410275013",
            "repository" : {
                "id" : "17",
                "name" : "New Fields Repo",
                "description" : "",
                "type" : "Local",
                "uuid" : "A2FF7E13-2C0E-470E-A3C9-E077FE065A54"         },
            "organization" : {
                "id" : "8",
                "name" : "Org",
                "description" : "Testing for Policies with New Schema",
                "uuid" : "FF00F4D0-5B9F-4A26-998C-19430295284A"         },
            "user" : {
                "id" : "1",
                "username" : "head",
                "firstname" : "Security Manager",
                "lastname" : "",
                "uuid" : "96F2AD1B-1B83-462E-908A-84E6054F6B64"         },
            "plugin" : {
                "id" : "0",
                "name" : "Open Port",
                "description" : "",
                "type" : "active"           }
        }
    ],
    "error_code" : 0,
    "error_msg" : "",
    "warnings" : [],
    "timestamp" : 1410275013
}

/acceptRiskRule/{id}

Methods
GET

Gets the Accept Risk Rule associated with {id}.

Fields Parameter
Expand

The fields parameter should be specified along the query string, and it takes the syntax

    ?fields=<field>,...

Allowed Fields

*id
**repository
**organization
**user
**plugin
**hostType
**hostValue
**port
**protocol
**expires
**status
comments
createdTime
modifiedTime

Legend

* = always comes back
** = comes back if fields list not specified on GET all

redFont =  field is a JSON object ( e.g. "repository" :{ "id" : <id>, "name" : <name> } )

Request Query Parameters

None

Example Response
Expand
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
{
    "type" : "regular",
    "response" : {
        "id" : "3",
        "hostType" : "all",
        "hostValue" : "",
        "port" : "any",
        "protocol" : "any",
        "comments" : "",
        "expires" : "-1",
        "status" : "0",
        "createdTime" : "1410275013",
        "modifiedTime" : "1410275013",
        "repository" : {
            "id" : "17",
            "name" : "New Fields Repo",
            "description" : "",
            "type" : "Local",
            "uuid" : "A2FF7E13-2C0E-470E-A3C9-E077FE065A54"     },
        "organization" : {
            "id" : "8",
            "name" : "Org",
            "description" : "Testing for Policies with New Schema",
            "uuid" : "FF00F4D0-5B9F-4A26-998C-19430295284A"     },
        "user" : {
            "id" : "1",
            "username" : "head",
            "firstname" : "Security Manager",
            "lastname" : "",
            "uuid" : "96F2AD1B-1B83-462E-908A-84E6054F6B64"     },
        "plugin" : {
            "id" : "0",
            "name" : "Open Port",
            "description" : "",
            "type" : "active"       }
    },
    "error_code" : 0,
    "error_msg" : "",
    "warnings" : [],
    "timestamp" : 1410275074
}


DELETE

Deletes the Accept Risk Rule associated with {id}, depending on access and permissions.

Request Parameters

None

Example Response
Expand
1
2
3
4
5
6
7
8
{
    "type" : "regular",
    "response" : "",
    "error_code" : 0,
    "error_msg" : "",
    "warnings" : [],
    "timestamp" : 1403100582
}

/acceptRiskRule/apply

Methods
POST

Applies all rules for the given repository or all (id: 0)

Request Query Parameters
Expand
1
2
3
4
{
    "repository" : {
        "id" : <number>   }
}
Example Response
Expand
1
2
3
4
5
6
7
8
{
    "type" : "regular",
    "response" : "",
    "error_code" : 0,
    "error_msg" : "",
    "warnings" : [],
    "timestamp" : 1410279161
}