feat(rapid7-insightvm): new Rapid7 InsightVM vulnerability integration

InsightVM/Nexpose Console API v3, 9 commands: list/get assets, asset
vulnerabilities, list/get vulnerabilities, list sites, start site scan,
get scan. HTTP Basic auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

integrations/qualys/manifest.yaml

@@ -0,0 +1,88 @@
+id: qualys
+name: Qualys VMDR
+version: 1.0.0
+description: "Qualys Vulnerability Management (API v2) — asset and vulnerability context: list hosts, list host vulnerability detections, look up vulnerability (QID) knowledge-base details, and list/launch VM scans. HTTP Basic authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: host list, host detections, knowledge-base vulnerability details, scan list, launch scan."
+category: vulnerability
+
+# Per-instance configuration. HTTP Basic auth against the Qualys API server
+# (regional, e.g. https://qualysapi.qg2.apps.qualys.com). All requests send the
+# required 'X-Requested-With' header. Responses are XML.
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "Qualys API server URL (e.g. https://qualysapi.qualys.com)"
+    username:
+      type: string
+      description: "Qualys username"
+    password:
+      type: string
+      description: "Qualys password"
+      x-soar-sensitive: true
+  required:
+    - base_url
+    - username
+    - password
+
+commands:
+  - id: host_list
+    name: qualys-host-list
+    description: "List scanned hosts (optionally filtered by IP range)."
+    risk: read
+    inputs_schema:
+      properties:
+        ips: { type: string, description: "Optional IP/range filter (e.g. 10.0.0.1-10.0.0.50)" }
+        truncation_limit: { type: number, description: "Max hosts (default 100)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: host_detections
+    name: qualys-host-detections
+    description: "List vulnerability detections on hosts (optionally filtered by IP and severity)."
+    risk: read
+    inputs_schema:
+      properties:
+        ips: { type: string, description: "Optional IP/range filter" }
+        severities: { type: string, description: "Optional severity filter (e.g. 4,5)" }
+        truncation_limit: { type: number, description: "Max hosts (default 100)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: vuln_details
+    name: qualys-vuln-details
+    description: "Get knowledge-base details for one or more vulnerabilities by QID."
+    risk: read
+    inputs_schema:
+      properties:
+        qids: { type: string, description: "Comma-separated QIDs" }
+      required: [qids]
+    outputs_schema: { properties: {} }
+  - id: list_scans
+    name: qualys-list-scans
+    description: "List VM scans."
+    risk: read
+    inputs_schema:
+      properties:
+        state: { type: string, description: "Optional state filter (Running, Finished, Canceled, ...)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: launch_scan
+    name: qualys-launch-scan
+    description: "Launch a VM scan against a set of IPs."
+    inputs_schema:
+      properties:
+        scan_title: { type: string, description: "Title for the scan" }
+        ip: { type: string, description: "Comma-separated target IPs/ranges" }
+        option_title: { type: string, description: "Option profile title (provide this or option_id)" }
+        option_id: { type: string, description: "Option profile ID (provide this or option_title)" }
+        iscanner_name: { type: string, description: "Scanner appliance name (optional)" }
+      required: [ip]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: qualys-test-connection
+    description: "Verify connectivity and credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/qualys/scripts/host_detections.py

@@ -0,0 +1,89 @@
+import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
+import xml.etree.ElementTree as ET
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _strip_ns(tag):
+    return tag.split("}", 1)[1] if "}" in tag else tag
+
+
+def _xml_to_dict(elem):
+    children = list(elem)
+    if not children:
+        return (elem.text or "").strip()
+    d = {}
+    for c in children:
+        tag = _strip_ns(c.tag)
+        val = _xml_to_dict(c)
+        if tag in d:
+            if not isinstance(d[tag], list):
+                d[tag] = [d[tag]]
+            d[tag].append(val)
+        else:
+            d[tag] = val
+    return d
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def call(method, path, cfg, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/")
+    url = base + path
+    params = {k: v for k, v in (params or {}).items() if v not in (None, "")}
+    data = None
+    if method == "GET":
+        if params:
+            url += "?" + urllib.parse.urlencode(params)
+    else:
+        data = urllib.parse.urlencode(params).encode("utf-8")
+    headers = {
+        "Authorization": _auth(cfg),
+        "X-Requested-With": "Riposte",
+        "Accept": "application/xml",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=120) as r:
+        raw = r.read()
+    root = ET.fromstring(raw)
+    return {_strip_ns(root.tag): _xml_to_dict(root)}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    ips = inputs.get("ips")
+    severities = inputs.get("severities")
+    truncation_limit = inputs.get("truncation_limit")
+    params = {
+        "action": "list",
+        "truncation_limit": int(truncation_limit or 100),
+    }
+    if ips:
+        params["ips"] = ips
+    if severities:
+        params["severities"] = severities
+    return call("GET", "/api/2.0/fo/asset/host/vm/detection/", cfg, params)
+
+
+_run(main)

integrations/qualys/scripts/host_list.py

@@ -0,0 +1,86 @@
+import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
+import xml.etree.ElementTree as ET
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _strip_ns(tag):
+    return tag.split("}", 1)[1] if "}" in tag else tag
+
+
+def _xml_to_dict(elem):
+    children = list(elem)
+    if not children:
+        return (elem.text or "").strip()
+    d = {}
+    for c in children:
+        tag = _strip_ns(c.tag)
+        val = _xml_to_dict(c)
+        if tag in d:
+            if not isinstance(d[tag], list):
+                d[tag] = [d[tag]]
+            d[tag].append(val)
+        else:
+            d[tag] = val
+    return d
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def call(method, path, cfg, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/")
+    url = base + path
+    params = {k: v for k, v in (params or {}).items() if v not in (None, "")}
+    data = None
+    if method == "GET":
+        if params:
+            url += "?" + urllib.parse.urlencode(params)
+    else:
+        data = urllib.parse.urlencode(params).encode("utf-8")
+    headers = {
+        "Authorization": _auth(cfg),
+        "X-Requested-With": "Riposte",
+        "Accept": "application/xml",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=120) as r:
+        raw = r.read()
+    root = ET.fromstring(raw)
+    return {_strip_ns(root.tag): _xml_to_dict(root)}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    ips = inputs.get("ips")
+    truncation_limit = inputs.get("truncation_limit")
+    params = {
+        "action": "list",
+        "truncation_limit": int(truncation_limit or 100),
+    }
+    if ips:
+        params["ips"] = ips
+    return call("GET", "/api/2.0/fo/asset/host/", cfg, params)
+
+
+_run(main)

integrations/qualys/scripts/launch_scan.py

@@ -0,0 +1,102 @@
+import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
+import xml.etree.ElementTree as ET
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _strip_ns(tag):
+    return tag.split("}", 1)[1] if "}" in tag else tag
+
+
+def _xml_to_dict(elem):
+    children = list(elem)
+    if not children:
+        return (elem.text or "").strip()
+    d = {}
+    for c in children:
+        tag = _strip_ns(c.tag)
+        val = _xml_to_dict(c)
+        if tag in d:
+            if not isinstance(d[tag], list):
+                d[tag] = [d[tag]]
+            d[tag].append(val)
+        else:
+            d[tag] = val
+    return d
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def call(method, path, cfg, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/")
+    url = base + path
+    params = {k: v for k, v in (params or {}).items() if v not in (None, "")}
+    data = None
+    if method == "GET":
+        if params:
+            url += "?" + urllib.parse.urlencode(params)
+    else:
+        data = urllib.parse.urlencode(params).encode("utf-8")
+    headers = {
+        "Authorization": _auth(cfg),
+        "X-Requested-With": "Riposte",
+        "Accept": "application/xml",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=120) as r:
+        raw = r.read()
+    root = ET.fromstring(raw)
+    return {_strip_ns(root.tag): _xml_to_dict(root)}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    ip = inputs.get("ip")
+    if not ip:
+        raise Exception("ip is required")
+    scan_title = inputs.get("scan_title")
+    option_title = inputs.get("option_title")
+    option_id = inputs.get("option_id")
+    iscanner_name = inputs.get("iscanner_name")
+
+    if not option_title and not option_id:
+        raise Exception("option_title or option_id is required")
+
+    params = {
+        "action": "launch",
+        "ip": ip,
+    }
+    if scan_title:
+        params["scan_title"] = scan_title
+    if option_id:
+        params["option_id"] = option_id
+    elif option_title:
+        params["option_title"] = option_title
+    if iscanner_name:
+        params["iscanner_name"] = iscanner_name
+
+    return call("POST", "/api/2.0/fo/scan/", cfg, params)
+
+
+_run(main)

integrations/qualys/scripts/list_scans.py

@@ -0,0 +1,82 @@
+import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
+import xml.etree.ElementTree as ET
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _strip_ns(tag):
+    return tag.split("}", 1)[1] if "}" in tag else tag
+
+
+def _xml_to_dict(elem):
+    children = list(elem)
+    if not children:
+        return (elem.text or "").strip()
+    d = {}
+    for c in children:
+        tag = _strip_ns(c.tag)
+        val = _xml_to_dict(c)
+        if tag in d:
+            if not isinstance(d[tag], list):
+                d[tag] = [d[tag]]
+            d[tag].append(val)
+        else:
+            d[tag] = val
+    return d
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def call(method, path, cfg, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/")
+    url = base + path
+    params = {k: v for k, v in (params or {}).items() if v not in (None, "")}
+    data = None
+    if method == "GET":
+        if params:
+            url += "?" + urllib.parse.urlencode(params)
+    else:
+        data = urllib.parse.urlencode(params).encode("utf-8")
+    headers = {
+        "Authorization": _auth(cfg),
+        "X-Requested-With": "Riposte",
+        "Accept": "application/xml",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=120) as r:
+        raw = r.read()
+    root = ET.fromstring(raw)
+    return {_strip_ns(root.tag): _xml_to_dict(root)}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    state = inputs.get("state")
+    params = {"action": "list"}
+    if state:
+        params["state"] = state
+    return call("GET", "/api/2.0/fo/scan/", cfg, params)
+
+
+_run(main)

integrations/qualys/scripts/test_connection.py

@@ -0,0 +1,79 @@
+import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
+import xml.etree.ElementTree as ET
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _strip_ns(tag):
+    return tag.split("}", 1)[1] if "}" in tag else tag
+
+
+def _xml_to_dict(elem):
+    children = list(elem)
+    if not children:
+        return (elem.text or "").strip()
+    d = {}
+    for c in children:
+        tag = _strip_ns(c.tag)
+        val = _xml_to_dict(c)
+        if tag in d:
+            if not isinstance(d[tag], list):
+                d[tag] = [d[tag]]
+            d[tag].append(val)
+        else:
+            d[tag] = val
+    return d
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def call(method, path, cfg, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/")
+    url = base + path
+    params = {k: v for k, v in (params or {}).items() if v not in (None, "")}
+    data = None
+    if method == "GET":
+        if params:
+            url += "?" + urllib.parse.urlencode(params)
+    else:
+        data = urllib.parse.urlencode(params).encode("utf-8")
+    headers = {
+        "Authorization": _auth(cfg),
+        "X-Requested-With": "Riposte",
+        "Accept": "application/xml",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=120) as r:
+        raw = r.read()
+    root = ET.fromstring(raw)
+    return {_strip_ns(root.tag): _xml_to_dict(root)}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    call("GET", "/api/2.0/fo/scan/", cfg, {"action": "list"})
+    return {"ok": True}
+
+
+_run(main)

integrations/qualys/scripts/vuln_details.py

@@ -0,0 +1,85 @@
+import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
+import xml.etree.ElementTree as ET
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _strip_ns(tag):
+    return tag.split("}", 1)[1] if "}" in tag else tag
+
+
+def _xml_to_dict(elem):
+    children = list(elem)
+    if not children:
+        return (elem.text or "").strip()
+    d = {}
+    for c in children:
+        tag = _strip_ns(c.tag)
+        val = _xml_to_dict(c)
+        if tag in d:
+            if not isinstance(d[tag], list):
+                d[tag] = [d[tag]]
+            d[tag].append(val)
+        else:
+            d[tag] = val
+    return d
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def call(method, path, cfg, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/")
+    url = base + path
+    params = {k: v for k, v in (params or {}).items() if v not in (None, "")}
+    data = None
+    if method == "GET":
+        if params:
+            url += "?" + urllib.parse.urlencode(params)
+    else:
+        data = urllib.parse.urlencode(params).encode("utf-8")
+    headers = {
+        "Authorization": _auth(cfg),
+        "X-Requested-With": "Riposte",
+        "Accept": "application/xml",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=120) as r:
+        raw = r.read()
+    root = ET.fromstring(raw)
+    return {_strip_ns(root.tag): _xml_to_dict(root)}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    qids = inputs.get("qids")
+    if not qids:
+        raise Exception("qids is required")
+    params = {
+        "action": "list",
+        "ids": qids,
+    }
+    return call("GET", "/api/2.0/fo/knowledge_base/vuln/", cfg, params)
+
+
+_run(main)

integrations/rapid7-insightvm/manifest.yaml

@@ -0,0 +1,115 @@
+id: rapid7_insightvm
+name: Rapid7 InsightVM
+version: 1.0.0
+description: "Rapid7 InsightVM / Nexpose (Console API v3) — asset and vulnerability context: list and read assets and their vulnerabilities, list and read vulnerability definitions, list sites, start a site scan, and read scan status. HTTP Basic authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list/get assets, asset vulnerabilities, list/get vulnerabilities, list sites, start site scan, get scan."
+category: vulnerability
+
+# Per-instance configuration. HTTP Basic auth against the InsightVM/Nexpose
+# console API v3 (typically port 3780). Set insecure for the console's default
+# self-signed certificate.
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "Console base URL (e.g. https://console.example.com:3780)"
+    username:
+      type: string
+      description: "Console username"
+    password:
+      type: string
+      description: "Console password"
+      x-soar-sensitive: true
+    insecure:
+      type: boolean
+      description: "Trust any TLS certificate (not secure)"
+      default: false
+  required:
+    - base_url
+    - username
+    - password
+
+commands:
+  - id: list_assets
+    name: insightvm-list-assets
+    description: "List assets."
+    risk: read
+    inputs_schema:
+      properties:
+        page: { type: number, description: "Page number (default 0)" }
+        size: { type: number, description: "Page size (default 100)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_asset
+    name: insightvm-get-asset
+    description: "Get a single asset by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        asset_id: { type: string, description: "Asset ID" }
+      required: [asset_id]
+    outputs_schema: { properties: {} }
+  - id: asset_vulnerabilities
+    name: insightvm-asset-vulnerabilities
+    description: "List the vulnerabilities found on an asset."
+    risk: read
+    inputs_schema:
+      properties:
+        asset_id: { type: string, description: "Asset ID" }
+      required: [asset_id]
+    outputs_schema: { properties: {} }
+  - id: list_vulnerabilities
+    name: insightvm-list-vulnerabilities
+    description: "List vulnerability definitions."
+    risk: read
+    inputs_schema:
+      properties:
+        page: { type: number, description: "Page number (default 0)" }
+        size: { type: number, description: "Page size (default 100)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_vulnerability
+    name: insightvm-get-vulnerability
+    description: "Get a vulnerability definition by ID (e.g. a CVE-linked vuln)."
+    risk: read
+    inputs_schema:
+      properties:
+        vulnerability_id: { type: string, description: "Vulnerability ID" }
+      required: [vulnerability_id]
+    outputs_schema: { properties: {} }
+  - id: list_sites
+    name: insightvm-list-sites
+    description: "List sites."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: start_site_scan
+    name: insightvm-start-site-scan
+    description: "Start a scan of a site."
+    inputs_schema:
+      properties:
+        site_id: { type: string, description: "Site ID" }
+        scan_name: { type: string, description: "Optional scan name" }
+        hosts: { type: string, description: "Optional comma-separated hosts to scan (subset of the site)" }
+      required: [site_id]
+    outputs_schema: { properties: {} }
+  - id: get_scan
+    name: insightvm-get-scan
+    description: "Get the status and details of a scan."
+    risk: read
+    inputs_schema:
+      properties:
+        scan_id: { type: string, description: "Scan ID" }
+      required: [scan_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: insightvm-test-connection
+    description: "Verify connectivity and credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/rapid7-insightvm/scripts/asset_vulnerabilities.py

@@ -0,0 +1,62 @@
+import json, os, sys, base64, ssl, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/3"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": _auth(cfg), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90, context=_ctx(cfg)) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    asset_id = inputs.get("asset_id")
+    if not asset_id:
+        raise Exception("asset_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    return request("GET", "/assets/" + q(asset_id) + "/vulnerabilities", cfg)
+
+
+_run(main)

integrations/rapid7-insightvm/scripts/get_asset.py

@@ -0,0 +1,62 @@
+import json, os, sys, base64, ssl, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/3"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": _auth(cfg), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90, context=_ctx(cfg)) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    asset_id = inputs.get("asset_id")
+    if not asset_id:
+        raise Exception("asset_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    return request("GET", "/assets/" + q(asset_id), cfg)
+
+
+_run(main)

integrations/rapid7-insightvm/scripts/get_scan.py

@@ -0,0 +1,62 @@
+import json, os, sys, base64, ssl, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/3"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": _auth(cfg), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90, context=_ctx(cfg)) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    scan_id = inputs.get("scan_id")
+    if not scan_id:
+        raise Exception("scan_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    return request("GET", "/scans/" + q(scan_id), cfg)
+
+
+_run(main)

integrations/rapid7-insightvm/scripts/get_vulnerability.py

@@ -0,0 +1,62 @@
+import json, os, sys, base64, ssl, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/3"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": _auth(cfg), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90, context=_ctx(cfg)) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    vulnerability_id = inputs.get("vulnerability_id")
+    if not vulnerability_id:
+        raise Exception("vulnerability_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    return request("GET", "/vulnerabilities/" + q(vulnerability_id), cfg)
+
+
+_run(main)

integrations/rapid7-insightvm/scripts/list_assets.py

@@ -0,0 +1,61 @@
+import json, os, sys, base64, ssl, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/3"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": _auth(cfg), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90, context=_ctx(cfg)) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    page = inputs.get("page")
+    size = inputs.get("size")
+    params = {"page": int(page or 0), "size": int(size or 100)}
+    return request("GET", "/assets", cfg, params=params)
+
+
+_run(main)

integrations/rapid7-insightvm/scripts/list_sites.py

@@ -0,0 +1,59 @@
+import json, os, sys, base64, ssl, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/3"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": _auth(cfg), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90, context=_ctx(cfg)) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    params = {"size": 100}
+    return request("GET", "/sites", cfg, params=params)
+
+
+_run(main)

integrations/rapid7-insightvm/scripts/list_vulnerabilities.py

@@ -0,0 +1,61 @@
+import json, os, sys, base64, ssl, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/3"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": _auth(cfg), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90, context=_ctx(cfg)) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    page = inputs.get("page")
+    size = inputs.get("size")
+    params = {"page": int(page or 0), "size": int(size or 100)}
+    return request("GET", "/vulnerabilities", cfg, params=params)
+
+
+_run(main)

integrations/rapid7-insightvm/scripts/start_site_scan.py

@@ -0,0 +1,74 @@
+import json, os, sys, base64, ssl, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/3"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": _auth(cfg), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90, context=_ctx(cfg)) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    site_id = inputs.get("site_id")
+    if not site_id:
+        raise Exception("site_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+
+    scan_name = inputs.get("scan_name")
+    hosts = inputs.get("hosts")
+
+    body = {}
+    if scan_name not in (None, ""):
+        body["name"] = scan_name
+    if hosts not in (None, ""):
+        hosts_list = [s.strip() for s in str(hosts).split(",") if s.strip()]
+        if hosts_list:
+            body["hosts"] = hosts_list
+
+    return request("POST", "/sites/" + q(site_id) + "/scans", cfg, body=body)
+
+
+_run(main)

integrations/rapid7-insightvm/scripts/test_connection.py

@@ -0,0 +1,59 @@
+import json, os, sys, base64, ssl, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+def _auth(cfg):
+    raw = str(cfg.get("username", "")) + ":" + str(cfg.get("password", ""))
+    return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("utf-8")
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/3"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": _auth(cfg), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90, context=_ctx(cfg)) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    request("GET", "/administration/info", cfg)
+    return {"ok": True}
+
+
+_run(main)

integrations/tenable-io/manifest.yaml

@@ -0,0 +1,107 @@
+id: tenable_io
+name: Tenable Vulnerability Management
+version: 1.0.0
+description: "Tenable Vulnerability Management (Tenable.io API) — asset and vulnerability context for incidents: list and read assets, list vulnerabilities and per-asset vulnerabilities, read vulnerability (plugin) details, and list/launch/status scans. API-key (access/secret) authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list/get assets, list vulnerabilities, per-asset vulnerabilities, vulnerability details, list scans, scan status, launch scan."
+category: vulnerability
+
+# Per-instance configuration. Keys are sent as
+# 'X-ApiKeys: accessKey=<access_key>; secretKey=<secret_key>'.
+config_schema:
+  properties:
+    url:
+      type: string
+      description: "Tenable.io API base URL"
+      default: "https://cloud.tenable.com"
+    access_key:
+      type: string
+      description: "Tenable API access key"
+      x-soar-sensitive: true
+    secret_key:
+      type: string
+      description: "Tenable API secret key"
+      x-soar-sensitive: true
+  required:
+    - access_key
+    - secret_key
+
+commands:
+  - id: list_assets
+    name: tenable-list-assets
+    description: "List assets."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_asset
+    name: tenable-get-asset
+    description: "Get a single asset's details by UUID."
+    risk: read
+    inputs_schema:
+      properties:
+        asset_uuid: { type: string, description: "Asset UUID" }
+      required: [asset_uuid]
+    outputs_schema: { properties: {} }
+  - id: asset_vulnerabilities
+    name: tenable-asset-vulnerabilities
+    description: "List the vulnerabilities found on a single asset."
+    risk: read
+    inputs_schema:
+      properties:
+        asset_uuid: { type: string, description: "Asset UUID" }
+      required: [asset_uuid]
+    outputs_schema: { properties: {} }
+  - id: list_vulnerabilities
+    name: tenable-list-vulnerabilities
+    description: "List vulnerabilities across the workbench (optionally filtered by severity age)."
+    risk: read
+    inputs_schema:
+      properties:
+        age: { type: number, description: "Only vulnerabilities seen in the last N days (default 30)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_vulnerability
+    name: tenable-get-vulnerability
+    description: "Get details for a vulnerability (Nessus plugin) by plugin ID."
+    risk: read
+    inputs_schema:
+      properties:
+        plugin_id: { type: string, description: "Nessus plugin ID" }
+      required: [plugin_id]
+    outputs_schema: { properties: {} }
+  - id: list_scans
+    name: tenable-list-scans
+    description: "List scans."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_scan_status
+    name: tenable-get-scan-status
+    description: "Get the status of a scan."
+    risk: read
+    inputs_schema:
+      properties:
+        scan_id: { type: string, description: "Scan ID" }
+      required: [scan_id]
+    outputs_schema: { properties: {} }
+  - id: launch_scan
+    name: tenable-launch-scan
+    description: "Launch a scan."
+    inputs_schema:
+      properties:
+        scan_id: { type: string, description: "Scan ID to launch" }
+        targets: { type: string, description: "Optional comma-separated alternate targets" }
+      required: [scan_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: tenable-test-connection
+    description: "Verify connectivity and the API keys (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/tenable-io/scripts/asset_vulnerabilities.py

@@ -0,0 +1,54 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("url") or "https://cloud.tenable.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-ApiKeys": "accessKey=" + str(cfg.get("access_key", "")) + "; secretKey=" + str(cfg.get("secret_key", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    asset_uuid = inputs.get("asset_uuid")
+    if not asset_uuid:
+        raise Exception("asset_uuid is required")
+    return request("GET", "/workbenches/assets/" + q(asset_uuid) + "/vulnerabilities", cfg)
+
+
+_run(main)

integrations/tenable-io/scripts/get_asset.py

@@ -0,0 +1,54 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("url") or "https://cloud.tenable.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-ApiKeys": "accessKey=" + str(cfg.get("access_key", "")) + "; secretKey=" + str(cfg.get("secret_key", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    asset_uuid = inputs.get("asset_uuid")
+    if not asset_uuid:
+        raise Exception("asset_uuid is required")
+    return request("GET", "/assets/" + q(asset_uuid), cfg)
+
+
+_run(main)

integrations/tenable-io/scripts/get_scan_status.py

@@ -0,0 +1,54 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("url") or "https://cloud.tenable.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-ApiKeys": "accessKey=" + str(cfg.get("access_key", "")) + "; secretKey=" + str(cfg.get("secret_key", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    scan_id = inputs.get("scan_id")
+    if not scan_id:
+        raise Exception("scan_id is required")
+    return request("GET", "/scans/" + q(scan_id) + "/latest-status", cfg)
+
+
+_run(main)

integrations/tenable-io/scripts/get_vulnerability.py

@@ -0,0 +1,54 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("url") or "https://cloud.tenable.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-ApiKeys": "accessKey=" + str(cfg.get("access_key", "")) + "; secretKey=" + str(cfg.get("secret_key", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    plugin_id = inputs.get("plugin_id")
+    if not plugin_id:
+        raise Exception("plugin_id is required")
+    return request("GET", "/workbenches/vulnerabilities/" + q(plugin_id) + "/info", cfg)
+
+
+_run(main)

integrations/tenable-io/scripts/launch_scan.py

@@ -0,0 +1,57 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("url") or "https://cloud.tenable.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-ApiKeys": "accessKey=" + str(cfg.get("access_key", "")) + "; secretKey=" + str(cfg.get("secret_key", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    scan_id = inputs.get("scan_id")
+    if not scan_id:
+        raise Exception("scan_id is required")
+    targets_raw = inputs.get("targets")
+    targets = [s.strip() for s in str(targets_raw).split(",") if s.strip()] if targets_raw else []
+    body = {"alt_targets": targets} if targets else {}
+    return request("POST", "/scans/" + q(scan_id) + "/launch", cfg, body=body)
+
+
+_run(main)

integrations/tenable-io/scripts/list_assets.py

@@ -0,0 +1,50 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("url") or "https://cloud.tenable.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-ApiKeys": "accessKey=" + str(cfg.get("access_key", "")) + "; secretKey=" + str(cfg.get("secret_key", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    return request("GET", "/assets", cfg)
+
+
+_run(main)

integrations/tenable-io/scripts/list_scans.py

@@ -0,0 +1,50 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("url") or "https://cloud.tenable.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-ApiKeys": "accessKey=" + str(cfg.get("access_key", "")) + "; secretKey=" + str(cfg.get("secret_key", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    return request("GET", "/scans", cfg)
+
+
+_run(main)

integrations/tenable-io/scripts/list_vulnerabilities.py

@@ -0,0 +1,52 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("url") or "https://cloud.tenable.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-ApiKeys": "accessKey=" + str(cfg.get("access_key", "")) + "; secretKey=" + str(cfg.get("secret_key", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    age = inputs.get("age")
+    age = int(age) if age not in (None, "") else 30
+    return request("GET", "/workbenches/vulnerabilities", cfg, params={"date_range": age})
+
+
+_run(main)

integrations/tenable-io/scripts/test_connection.py

@@ -0,0 +1,51 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("url") or "https://cloud.tenable.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-ApiKeys": "accessKey=" + str(cfg.get("access_key", "")) + "; secretKey=" + str(cfg.get("secret_key", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    request("GET", "/server/properties", cfg)
+    return {"ok": True}
+
+
+_run(main)