Manifest Files

When the Tenable system finishes sending payload files, it sends a manifest file that lists the files in the order they were sent, along with metadata and file paths. The system generates a manifest file as often as every 15 minutes.

Using Manifest Files

You can reference manifest files when building logic to ingest vulnerability data into your application. To do this, apply a handler to the manifest file so the resulting process consumes payload files in order.

For example, let’s say the Tenable system sends 100 findings payload files to your AWS bucket between 12:00 PM and 12:15 PM and they are saved in …/finding/<export-date>/. At 12:15 PM, the system sends a manifest file to …/manifest_finding/<export-date>/ in this format with a list of the files.

This process works the same way for all payload file types: assets, findings, and tags.

Manifest File Properties

The following table defines the properties that appear in Tenable Data Stream manifest files.

Property	Data Type	Description
type	string	The type of manifest file: MANIFEST_ASSET, MANIFEST_FINDING, or MANIFEST_TAGS.
payload_type	string	The type of payload the manifest contains: ASSET, FINDING, or TAGS.
payloads[].path	string	The path to the payload file in your AWS bucket.
payloads[].md5	string	The MD5 hash value of the payload file.
payloads[].version	integer	The version identifier for the manifest file.
payloads[].num_updates	integer	The number of updates in the payload file.
payloads[].num_deletes	integer	The number of deleted items in the payload file.
payloads[].first_record_timestamp	integer	The Unix timestamp of the first entry in the payload file.
payloads[].last_record_timestamp	integer	The Unix timestamp of the last entry in the payload file.
payloads[].scan_id	string	The grouping ID for assets, findings, or tags in the payload file. If there is no grouping ID, this value is empty.

Example Manifest Files

The following examples show the format of the manifest files sent by the Tenable system. In the files, each payload file is one object in an array.

Asset Manifest File

Copy

{
  "type": "MANIFEST_ASSET",
  "payload_type": "ASSET",
  "payloads": [
    {
      "path": "path-prefix/asset/2024-09-23/asset-1727096558876-17-5a0ffa7d-6b2c-4af6-a0f1-f506fe769dba.json.gz",
      "md5": "c515b063ad68680fc90257444f782e94",
      "version": 1,
      "num_updates": 1,
      "num_deletes": 0,
      "first_record_timestamp": 1727096558490,
      "last_record_timestamp": 1727096558490,
      "scan_id": "5a0ffa7d-6b2c-4af6-a0f1-f506fe769dba"
    }
  ]
}

Findings Manifest File

Copy

{
  "type": "MANIFEST_FINDING",
  "payload_type": "FINDING",
  "payloads": [
    {
      "path": "path-prefix/finding/2024-09-23/finding-1727096618967-60-5a0ffa7d-6b2c-4af6-a0f1-f506fe769dba.json.gz",
      "md5": "e6919aaffa6967e0c6de3908c9a04a78",
      "version": 1,
      "num_updates": 2,
      "num_deletes": 0,
      "first_record_timestamp": 1727096618799,
      "last_record_timestamp": 1727096618820,
      "scan_id": "5a0ffa7d-6b2c-4af6-a0f1-f506fe769dba"
    }
  ]
}

Tags Manifest File

Copy

{
  "type": "MANIFEST_TAGS",
  "payload_type": "TAGS",
  "payloads": [
    {
      "path": "path-prefix/tags/2024-09-23/tags-1727096866393-5.json.gz",
      "md5": "d641c41a287911d4779d1215edb2406d",
      "version": 1,
      "num_updates": 1,
      "num_deletes": 0,
      "first_record_timestamp": 1727096866345,
      "last_record_timestamp": 1727096866345,
      "scan_id": ""
    }
  ]
}