id: tenable_io
name: Tenable Vulnerability Management
version: 1.0.0
description: "Tenable Vulnerability Management (Tenable.io API) — asset and vulnerability context for incidents: list and read assets, list vulnerabilities and per-asset vulnerabilities, read vulnerability (plugin) details, and list/launch/status scans. API-key (access/secret) authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get assets, list vulnerabilities, per-asset vulnerabilities, vulnerability details, list scans, scan status, launch scan."
category: vulnerability

# Per-instance configuration. Keys are sent as
# 'X-ApiKeys: accessKey=<access_key>; secretKey=<secret_key>'.
config_schema:
  properties:
    url:
      type: string
      description: "Tenable.io API base URL"
      default: "https://cloud.tenable.com"
    access_key:
      type: string
      description: "Tenable API access key"
      x-soar-sensitive: true
    secret_key:
      type: string
      description: "Tenable API secret key"
      x-soar-sensitive: true
  required:
    - access_key
    - secret_key

commands:
  - id: list_assets
    name: tenable-list-assets
    description: "List assets."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: get_asset
    name: tenable-get-asset
    description: "Get a single asset's details by UUID."
    risk: read
    inputs_schema:
      properties:
        asset_uuid: { type: string, description: "Asset UUID" }
      required: [asset_uuid]
    outputs_schema: { properties: {} }
  - id: asset_vulnerabilities
    name: tenable-asset-vulnerabilities
    description: "List the vulnerabilities found on a single asset."
    risk: read
    inputs_schema:
      properties:
        asset_uuid: { type: string, description: "Asset UUID" }
      required: [asset_uuid]
    outputs_schema: { properties: {} }
  - id: list_vulnerabilities
    name: tenable-list-vulnerabilities
    description: "List vulnerabilities across the workbench (optionally filtered by severity age)."
    risk: read
    inputs_schema:
      properties:
        age: { type: number, description: "Only vulnerabilities seen in the last N days (default 30)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_vulnerability
    name: tenable-get-vulnerability
    description: "Get details for a vulnerability (Nessus plugin) by plugin ID."
    risk: read
    inputs_schema:
      properties:
        plugin_id: { type: string, description: "Nessus plugin ID" }
      required: [plugin_id]
    outputs_schema: { properties: {} }
  - id: list_scans
    name: tenable-list-scans
    description: "List scans."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: get_scan_status
    name: tenable-get-scan-status
    description: "Get the status of a scan."
    risk: read
    inputs_schema:
      properties:
        scan_id: { type: string, description: "Scan ID" }
      required: [scan_id]
    outputs_schema: { properties: {} }
  - id: launch_scan
    name: tenable-launch-scan
    description: "Launch a scan."
    inputs_schema:
      properties:
        scan_id: { type: string, description: "Scan ID to launch" }
        targets: { type: string, description: "Optional comma-separated alternate targets" }
      required: [scan_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: tenable-test-connection
    description: "Verify connectivity and the API keys (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }