Finding Enriched Attributes Payload Files

When the system adds, edits, or deletes findings attributes, Tenable Data Stream sends a payload file to your AWS bucket. In the file, updates appear in the updates array and deletes appear with a timestamp in the deletes array.

The following example shows the format of a FINDING_ENRICHED_ATTRIBUTES payload file. For definitions of the properties in this file, see Tenable Data Stream Finding Enriched Attributes Properties.

Copy


{
    "payload_id": "finding_enriched_attributes-1762508131013-16",
    "version": 1,
    "type": "FINDING_ENRICHED_ATTRIBUTES",
    "count_updated": 2,
    "count_deleted": 0,
    "updates": [
      {
        "recast_properties": {
          "finding_id": "0ef70e1e-7ffc-5352-bd60-36314a198aba",
          "source": "recast-platform",
          "recast_annotation": {
            "rule_id": "83ed48c7-dd06-4881-a577-f3515c7f7873",
            "created_at": "2025-11-04T06:29:00.021Z",
            "updated_at": "2025-11-07T09:35:30.874Z",
            "modification": "RECASTED",
            "rule_comment": "Recasted by user",
            "modification_target": "RISK",
            "recasted_severity": "LOW",
            "changed_result": "PASSED"
         }
       }
      },
      {
         "recast_properties": {
          "finding_id": "0d8d3fad-acf3-5549-9c02-677802a99728",
          "source": "recast-platform",
          "recast_annotation": {
              "rule_id": "83ed48c7-dd06-4881-a577-f3515c7f7873",
              "created_at": "2025-11-04T06:28:59.194Z",
              "updated_at": "2025-11-07T09:35:30.873Z",
              "modification": "RECASTED",
              "rule_comment": "Recasted by user",
              "modification_target": "RISK",
              "recasted_severity": "LOW",
              "changed_result": "PASSED"
         }
       }
     }
   ],
  "deletes": [],
  "first_ts": "1762508130929",
  "last_ts": "1762508130932"
}