Tenable Security Center API: Hosts

 

/hosts

Methods
GET

Gets the list of Hosts identified from all scan results that are on T.sc.

Fields Parameter
Expand

The fields parameter should be specified along the query string, and it takes the syntax

    ?fields=<field>,...

The limit parameter should be an integer greater than 0

    ?limit=<number>,...

The startOffset parameter should an integer greater than 0

    ?startOffset=<number>,...

The endOffset parameter should an integer greater than 0

    ?endOffset=<number>,...

The pagination parameter should a boolean

    ?pagination=<boolean>,..

Allowed Fields

**id
**uuid
*tenableUUID
*name
*ipAddress
*os
*firstSeen
*lastSeen
macAddress
source
repID
netBios
netBiosWorkgroup
createdTime
modifiedTime
acr
aes

Legend

* = always comes back
** = comes back if fields list not specified on GET all
red field is a JSON object e.g. "SCI" : {"id" : "2", "name" : "SCI Name", "description" : "Description"} )

Example Response
Expand
{
    "type": "regular",
    "response": [
        {
            "id": "154",
            "uuid": "68262460-941b-4762-906e-47298f79911e",
            "tenableUUID": "58bd0909-f66d-4248-8c20-2501b208bb65",
            "name": "Aerified",
            "ipAddress": "201.22.196.102",
            "os": "Linux",
            "firstSeen": "1770798",
            "lastSeen": "1685038",
        },
        {
            "id": "47",
            "uuid": "e9344880-c32f-458c-b78e-211ce81d10cb",
            "tenableUUID": "dce3a590-70f0-4530-9843-5d3c83666f75",
            "name": "Windows 10",
            "ipAddress": "90.248.112.168",
            "os": "Windows 10",
            "firstSeen": "1755893",
            "lastSeen": "1221376",
        }
    ],
    "error_code": 0,
    "error_msg": "",
    "warnings": [],
    "timestamp": 1626889388
}

/hosts/{uuid}/acr

Methods
PATCH

Override the Asset Criticality Rating score and reasons for the specified Host.

Request Body Parameter
Expand
{
"overwrittenScore": <int> 4,
"reasoning": [
{
"id": <int> 1-6,
"label" <string> "Why score was changed"
}
],
"notes": <string> "Some details on the score change",
"overwritten": <string> "true" | "false"
}
Example Response
Expand
{
    "type": "regular",
    "response":{
        "id": "95",
        "uuid": "c2953a1a-c19c-4128-b518-8b0ccc33cb3d",
        "tenableUUID": null,
        "name": "172.26.48.1",
        "ipAddress": "172.26.48.1",
        "os": null,
        "firstSeen": "1632765212",
        "lastSeen": "1632765212",
        "dns": null,
        "fqdnIndex": "0",
        "netBios": null,
        "netBiosWorkgroup": null,
        "macAddress": null,
        "systemType": "general-purpose",
        "createdTime": "1632765212",
        "modifiedTime": "1632765212",
        "source": [
            {
                "type": "Nessus Scan"
            }
        ],
        "repository": {
            "id": "1",
            "name": "Repo",
            "description": ""
        },
        "acr": {
            "hostUUID": "c2953a1a-c19c-4128-b518-8b0ccc33cb3d",
            "score": "9.0",
            "overwritten": "true",
            "notes": "We changed this because....",
            "overwrittenScore": "10.0",
            "lastEditedUserID": "1",
            "lastEditedOrgID": "1",
            "lastEvaluatedTime": "1",
            "internetExposure": null,
            "capability": null,
            "reasoning": [
                {
                    "id": "4"
                }
            ],
            "user": {
                "id": "1",
                "username": "qahead",
                "firstname": "",
                "lastname": "",
                "email": ""
            }
        }
    },
    "error_code": 0,
    "error_msg": "",
    "warnings": [],
    "timestamp": 1632923227
}

/hosts/search

Methods
POST

Gets the Asset Criticality Rating score and reasons for the specified Host.

Fields Parameter
Expand

Search the list of Hosts identified from all scan results that are on T.sc.

Fields Parameter
Expand

The fields parameter should be specified along the query string, and it takes the syntax

    ?fields=<field>,...

The limit parameter should be an integer greater than 0

    ?limit=<number>,...

The startOffset parameter should be an integer greater than 0

    ?startOffset=<number>,...

The endOffset parameter should be  an integer greater than 0

    ?endOffset=<number>,...

The pagination parameter should a boolean

    ?pagination=<boolean>,...

Allowed Fields

**id
**uuid
*tenableUUID
*name
*ipAddress
*os
*firstSeen
*lastSeen
macAddress
source
repID
netBios
netBiosWorkgroup
createdTime
modifiedTime
acr
aes

Legend

* = always comes back
** = comes back if fields list not specified on GET all
redfield is a JSON object ( e.g. "SCI" : {"id" : "2", "name" : "SCI Name", "description" : "Description"} )

Example Request
Expand
{
"filters": {
"and": [
{
"property": "systemType",
"operator": "eq",
"value": "general_purpose,general-purpose"
},
{
"property": "ip",
"operator": "eq",
"value": "172.26.48.0-172.26.48.100"
},
{
"property": "repositoryAll",
"operator": "eq",
"value": "2,1"
},
{
"property": "assetCriticalityRating",
"operator": "eq",
"value": "1-5"
},
{
"property": "assetExposureScore",
"operator": "eq",
"value": "100-1000"
},
{
"property": "sourceType",
"operator": "eq",
"value": "'Nessus Scan','Agent Scan'"
},
{
"property": "hostid",
"operator": "eq",
"value": "74d580c7-4da4-427f-9282-591d99d3ba25,60847aad-f0b1-426c-8bf0-1e8d92da85c4"
}
]
}
}
Example Response
Expand


{
"type": "regular",
"response": {
"totalRecords": "1",
"returnedRecords": 1,
"startOffset": "0",
"endOffset": "50",
"results": [
{
"name": "SHAREPOINT2016",
"ipAddress": "172.xx.xx.xx",
"os": "Microsoft Windows 10",
"macAddress": null,
"firstSeen": "1655319261",
"lastSeen": "1655319261",
"netBios": "SHAREPOINT2016",
"dns": "sharepoint2016.target.com",
"id": "7",
"uuid": "xxxx-xxxx-xxxx-xxxx-xxxx",
"source": [
{
"type": "Nessus Scan"
}
],
"repository": {
"id": "1",
"name": "Repo",
"description": "",
"dataFormat": "IPv4",
"type": "Local"
},
"acr": {
"score": "4",
"overwritten": "false",
"notes": null,
"overwrittenScore": "-1",
"lastEditedUserID": null,
"lastEditedOrgID": null,
"lastEvaluatedTime": "1655319340",
"internetExposure": "internal",
"capability": "",
"deviceType": "general_purpose",
"reasoning": [],
"keyDrivers": {
"internet exposure": "internal",
"device capability": "",
"device type": "general_purpose"
}
},
"aes": {
"score": "496"
},
"systemType": "general_purpose"
}
]
},
"error_code": 0,
"error_msg": "",
"warnings": [],
"timestamp": 1655385966
}

/hosts/download

Methods
POST

Export the Host Assets data to a CSV file format.

Fields Parameter
Expand

Search the list of Hosts identified from all scan results that are on T.sc.

Fields Parameter
Expand

The fields parameter should be specified along the query string, and it takes the syntax

    ?fields=<field>,...

The sortField parameter should be a string

    ?sortField=<field>

The sortDirection parameter should be either ASC or DESC

	?sortDirection=<string>

The startOffset parameter should be an integer greater than 0

    ?startOffset=<number>,...

The endOffset parameter should be  an integer greater than 0

    ?endOffset=<number>,...

Allowed Fields

*id
**uuid
**ipAddress
**os
**name
**lastSeen
**source
**netBios
**dns
**acr
**aes
**repository
**systemType

Legend

* = always comes back
** = comes back if fields list not specified
green = The uuid field will be renamed to "assetID" in the CSV header

Filter Parameter
Expand

Filter parameters should be posted via the request payload.

Value field for assetCriticalityRating and assetExposureScore should be a range of unsigned integers separated by a "-". Example: "1-10"

Filter Parameter
Expand
{
"filters": {
"and": [
{
"property": <string> "systemType" | "assetCriticalityRating" | "assetExposureScore",
"operator": <string> "eq",
"value": <string> "systemTypeId" | "<uint>-<uint>"
}
]
}
}
Example Response (text/csv)
Expand


"name","ipAddress","os","macAddress","firstSeen","lastSeen","netBios","dns","id","source","repository","acr","aes","systemType","assetID"
"ABCD-EFGH","0.0.0.0","Linux Kernel 123","a:b:c:d:e","1234567890","1234567890","ABCD-EFGH","abdc-efgh.hijk-lmnop.com","1234","Nessus Scan","ipv4","10","300","","abcd-efgh-ijkl-mnop-qrst-uvwx-yz"
"ABCD-EFGH","0.0.0.0","Linux Kernel 123","a:b:c:d:e","1234567890","1234567890","ABCD-EFGH","abdc-efgh.hijk-lmnop.com","1234","Nessus Scan","ipv4","10","300","","abcd-efgh-ijkl-mnop-qrst-uvwx-yz"
"ABCD-EFGH","0.0.0.0","Linux Kernel 123","a:b:c:d:e","1234567890","1234567890","ABCD-EFGH","abdc-efgh.hijk-lmnop.com","1234","Nessus Scan","ipv4","10","300","","abcd-efgh-ijkl-mnop-qrst-uvwx-yz"