Tenable Workbenches API
The Workbenches API from Tenable — 14 operation(s) for workbenches.
OpenAPI Specification
openapi: 3.0.0
info:
version: 1.0.0
title: Downloads About Workbenches API
description: 'The Downloads API enables customers to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.
**Note:** The Tenable Downloads API uses a different server URL than the Tenable Vulnerability Management API:
`https://www.tenable.com/downloads/api/v2/pages`.
### Authentication
Like the Downloads website, certain files require authentication to download. When files have a `"requires_auth": true` attribute on the product list page, the Downloads API uses bearer token authentication and requires a valid token in the Authorization header to download the file:
```
Authorization: Bearer AbCdEf123456
```
To access or reset your authentication token, navigate to the [Authentication Token](https://www.tenable.com/downloads/api-docs) page.
Examples of product downloads that **do not** require authentication include Nessus and Nessus Agents.'
servers:
- url: https://www.tenable.com/downloads/api/v2
security:
- Bearer: []
tags:
- name: Workbenches
x-displayName: Workbenches
paths:
/workbenches/vulnerabilities:
get:
summary: List vulnerabilities
description: "Returns a list of recorded vulnerabilities. The list returned is limited to 5,000. To retrieve more than 5,000 vulnerabilities, use the [export-request API](ref:workbenches-export-request). Additionally, this endpoint only returns data less than 450 days (15 months) old.\n\n **Note:** This endpoint is not intended for large or frequent exports of vulnerability or assets data. If you experience errors, reduce the volume, [rate](doc:rate-limiting), or [concurrency](doc:concurrency-limiting) of your requests or narrow your filters. Contact support if you continue to experience errors. Additionally, Tenable recommends the [POST /vulns/export](ref:exports-vulns-request-export) endpoint for large or frequent exports of vulnerability data, and the [POST /assets/v2/export](ref:export-assets-v2) endpoint for large or frequent exports of assets data.\n\nFor information and best practices for retrieving vulnerability and assets data from Tenable Vulnerability Management, see [Retrieve Vulnerability Data from Vulnerability Management](doc:retrieve-vulnerability-data-from-tenableio) and [Retrieve Asset Data from Vulnerability Management](doc:retrieve-asset-data-from-tenableio).<div class=\"perms-callout\">Requires the Basic [16] user role. See [Roles](doc:roles).</div>"
operationId: workbenches-vulnerabilities
tags:
- Workbenches
parameters:
- description: The number of days of data prior to and including today that should be returned.
name: date_range
in: query
schema:
type: integer
format: int32
- description: 'The name of the filter to apply to the exported scan report. You can find available filters by using the [GET /filters/workbenches/vulnerabilities](ref:io-filters-vulnerabilities-workbench-list) endpoint. For more information about the format of this parameter, see [Workbench Filters](doc:workbench-filters).
**Note:** There is a limit of 10 filters. A `400 Bad Request` error is returned if you exceed this limit.'
required: false
name: filter.0.filter
in: query
schema:
type: string
example: plugin.name
- description: The operator of the filter to apply to the exported scan report. You can find the operators for the filter using the [GET /filters/workbenches/vulnerabilities](ref:io-filters-vulnerabilities-workbench-list) endpoint. For more information about the format of this parameter, see [Workbench Filters](doc:workbench-filters).
required: false
name: filter.0.quality
in: query
schema:
type: string
example: match
- description: 'The value of the filter to apply to the exported scan report. You can find valid values for the filter in the ''control'' attribute of the objects returned by the [GET /filters/workbenches/vulnerabilities](ref:io-filters-vulnerabilities-workbench-list) endpoint. For more information about the format of this parameter, see [Workbench Filters](doc:workbench-filters).
**Note:** There is a limit of 10 filter values per filter. A `400 Bad Request` error is returned if you exceed this limit.'
required: false
name: filter.0.value
in: query
schema:
type: string
example: RHEL
- description: For multiple filters, specifies whether to use the AND or the OR logical operator. The default is AND. For more information about this parameter, see [Workbench Filters](doc:workbench-filters).
required: false
name: filter.search_type
in: query
schema:
type: string
enum:
- ''
- and
- or
responses:
'200':
description: Returned if the list of vulnerabilities was retrieved successfully.
content:
application/json:
schema:
type: object
description: A list of vulnerabilities.
properties:
vulnerabilities:
type: array
description: A list of discovered vulnerabilities.
items:
$ref: '#/components/schemas/workbenches_workbenches-vulnerability'
total_vulnerability_count:
type: integer
description: The total number of discovered vulnerabilities.
total_asset_count:
type: integer
description: The total number of assets.
examples:
response:
value:
vulnerabilities:
- count: 319
plugin_family: General
plugin_id: 51192
plugin_name: SSL Certificate Cannot Be Trusted
vulnerability_state: Active
vpr_score: 2.4
accepted_count: 0
recasted_count: 0
counts_by_severity:
- count: 319
value: 2
severity: 2
- count: 215
plugin_family: Misc.
plugin_id: 70658
plugin_name: SSH Server CBC Mode Ciphers Enabled
vulnerability_state: Active
vpr_score: 7.4
accepted_count: 0
recasted_count: 0
counts_by_severity:
- count: 215
value: 1
severity: 1
- count: 168
plugin_family: Misc.
plugin_id: 71049
plugin_name: SSH Weak MAC Algorithms Enabled
vulnerability_state: Active
vpr_score: 5.5
accepted_count: 0
recasted_count: 0
counts_by_severity:
- count: 168
value: 1
severity: 1
total_vulnerability_count: 3
total_asset_count: 0
'400':
description: Returned if your request contained invalid syntax or if you specified more than 10 filters or 50 filter values per filter.
content:
application/json:
examples:
response:
value:
error: 'Value ''192.0.2.1'' is not valid for filter host.id and operator eq : host.id - 192.0.2.1 does not match [0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}(,[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12})*'
type: invalid_filter_value
filter_name: host.id
filter_operator: eq
filter_value: 192.0.2.1
reason: host.id - 192.0.2.1 does not match [0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}(,[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12})*
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/workbenches_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to list vulnerabilities.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/workbenches_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- workbenches_cloud: []
/workbenches/vulnerabilities/{plugin_id}/info:
get:
summary: Get plugin details
description: "Retrieves the details for a plugin.\n\n **Note:** This endpoint is not intended for large or frequent exports of vulnerability or assets data. If you experience errors, reduce the volume, [rate](doc:rate-limiting), or [concurrency](doc:concurrency-limiting) of your requests or narrow your filters. Contact support if you continue to experience errors. Additionally, Tenable recommends the [POST /vulns/export](ref:exports-vulns-request-export) endpoint for large or frequent exports of vulnerability data, and the [POST /assets/v2/export](ref:export-assets-v2) endpoint for large or frequent exports of assets data.\n\nFor information and best practices for retrieving vulnerability and assets data from Tenable Vulnerability Management, see [Retrieve Vulnerability Data from Vulnerability Management](doc:retrieve-vulnerability-data-from-tenableio) and [Retrieve Asset Data from Vulnerability Management](doc:retrieve-asset-data-from-tenableio).<div class=\"perms-callout\">Requires the Basic [16] user role. See [Roles](doc:roles).</div>"
operationId: workbenches-vulnerability-info
tags:
- Workbenches
parameters:
- description: The ID of the plugin. You can find the plugin ID by examining the output of the [GET /workbenches/vulnerabilities](ref:workbenches-vulnerabilities) endpoint.
required: true
name: plugin_id
in: path
schema:
type: integer
format: int32
- description: The number of days of data prior to and including today that should be returned.
name: date_range
in: query
schema:
type: integer
format: int32
- description: The name of the filter to apply to the exported scan report. You can find available filters by using the [GET /filters/workbenches/vulnerabilities](ref:io-filters-vulnerabilities-workbench-list) endpoint. For more information about the format of this parameter, see [Workbench Filters](doc:workbench-filters).
required: false
name: filter.0.filter
in: query
schema:
type: string
example: plugin.name
- description: The operator of the filter to apply to the exported scan report. You can find the operators for the filter using the [GET /filters/workbenches/vulnerabilities](ref:io-filters-vulnerabilities-workbench-list) endpoint. For more information about the format of this parameter, see [Workbench Filters](doc:workbench-filters).
required: false
name: filter.0.quality
in: query
schema:
type: string
example: match
- description: The value of the filter to apply to the exported scan report. You can find valid values for the filter in the 'control' attribute of the objects returned by the [GET /filters/workbenches/vulnerabilities](ref:io-filters-vulnerabilities-workbench-list) endpoint. For more information about the format of this parameter, see [Workbench Filters](doc:workbench-filters).
required: false
name: filter.0.value
in: query
schema:
type: string
example: RHEL
- description: For multiple filters, specifies whether to use the AND or the OR logical operator. The default is AND. For more information about this parameter, see [Workbench Filters](doc:workbench-filters).
required: false
name: filter.search_type
in: query
schema:
type: string
enum:
- ''
- and
- or
responses:
'200':
description: Returned if the details for the specified plugin were retrieved successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/workbenches_workbenches-vulnerability-info'
examples:
response:
value:
info:
count: 13
vuln_count: 14
description: The remote web server is affected by a command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a remote attacker to execute arbitrary code via environment variable manipulation depending on the configuration of the system.
synopsis: The remote web server is affected by a remote code execution vulnerability.
solution: Apply the referenced patch.
discovery:
seen_first: '2019-12-31T17:15:52.000Z'
seen_last: '2019-12-31T22:53:45.000Z'
severity: 4
plugin_details:
family: CGI abuses
modification_date: '2017-12-31T00:00:00Z'
name: GNU Bash Environment Variable Handling Code Injection (Shellshock)
publication_date: '2014-12-31T00:00:00Z'
type: remote
version: null
severity: 4
reference_information:
- name: bid
url: http://www.securityfocus.com/bid/
values:
- 70103
- name: cert
url: http://www.kb.cert.org/vuls/id/
values:
- '252743'
- name: cve
url: http://web.nvd.nist.gov/view/vuln/detail?vulnId=
values:
- CVE-2014-6271
- name: edb-id
url: http://www.exploit-db.com/exploits/
values:
- '34766'
- '34777'
- '34765'
- name: iava
values:
- 2014-A-0142
- name: osvdb
values:
- '112004'
risk_information:
risk_factor: Critical
cvss_vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
cvss_base_score: '10.0'
cvss_temporal_vector: E:F/RL:OF/RC:ND
cvss_temporal_score: '8.3'
cvss3_vector: null
cvss3_base_score: null
cvss3_temporal_vector: null
cvss3_temporal_score: null
stig_severity: null
see_also:
- http://seclists.org/oss-sec/2014/q3/650
- http://www.nessus.org/u?dacf7829
- https://www.invisiblethreat.ca/post/shellshock/
vulnerability_information:
vulnerability_publication_date: '2014-12-31T00:00:00Z'
exploited_by_malware: true
patch_publication_date: '2014-12-31T00:00:00Z'
exploit_available: true
exploitability_ease: null
asset_inventory: null
default_account: null
exploited_by_nessus: null
in_the_news: true
malware: null
unsupported_by_vendor: null
cpe: null
exploit_frameworks:
- name: Core Impact
- name: Metasploit
exploits:
- name: Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)
url: null
vpr:
score: 9.6
drivers:
age_of_vuln:
lower_bound: 731
upper_bound: 0
exploit_code_maturity: HIGH
cvss3_impact_score: 5.9
cvss_impact_score_predicted: true
threat_intensity_last28: HIGH
threat_recency:
lower_bound: 0
upper_bound: 7
threat_sources_last28:
- Others
- Mainstream Media
- Code Repo and Paste Bins
product_coverage: LOW
updated: '2019-12-31T10:10:57Z'
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/workbenches_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to view plugin details.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/workbenches_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- workbenches_cloud: []
/workbenches/vulnerabilities/{plugin_id}/outputs:
get:
summary: List plugin outputs
description: "Retrieves the vulnerability outputs for a plugin. The list returned is limited to 5,000. To retrieve more than 5,000 vulnerability outputs, use the [export-request API](ref:workbenches-export-request). Additionally, this endpoint only returns data less than 450 days (15 months) old.\n\n **Note:** This endpoint is not intended for large or frequent exports of vulnerability or assets data. If you experience errors, reduce the volume, [rate](doc:rate-limiting), or [concurrency](doc:concurrency-limiting) of your requests or narrow your filters. Contact support if you continue to experience errors. Additionally, Tenable recommends the [POST /vulns/export](ref:exports-vulns-request-export) endpoint for large or frequent exports of vulnerability data, and the [POST /assets/v2/export](ref:export-assets-v2) endpoint for large or frequent exports of assets data.\n\nFor information and best practices for retrieving vulnerability and assets data from Tenable Vulnerability Management, see [Retrieve Vulnerability Data from Vulnerability Management](doc:retrieve-vulnerability-data-from-tenableio) and [Retrieve Asset Data from Vulnerability Management](doc:retrieve-asset-data-from-tenableio).<div class=\"perms-callout\">Requires the Basic [16] user role. See [Roles](doc:roles).</div>"
operationId: workbenches-vulnerability-output
tags:
- Workbenches
parameters:
- description: The ID of the plugin. You can find the plugin ID by examining the output of the [GET /workbenches/vulnerabilities](ref:workbenches-vulnerabilities) endpoint.
required: true
name: plugin_id
in: path
schema:
type: integer
format: int32
- description: The number of days of data prior to and including today that should be returned.
name: date_range
in: query
schema:
type: integer
format: int32
- description: The name of the filter to apply to the exported scan report. You can find available filters by using the [GET /filters/workbenches/vulnerabilities](ref:io-filters-vulnerabilities-workbench-list) endpoint. For more information about the format of this parameter, see [Workbench Filters](doc:workbench-filters).
required: false
name: filter.0.filter
in: query
schema:
type: string
example: plugin.name
- description: The operator of the filter to apply to the exported scan report. You can find the operators for the filter using the [GET /filters/workbenches/vulnerabilities](ref:io-filters-vulnerabilities-workbench-list) endpoint. For more information about the format of this parameter, see [Workbench Filters](doc:workbench-filters).
required: false
name: filter.0.quality
in: query
schema:
type: string
example: match
- description: The value of the filter to apply to the exported scan report. You can find valid values for the filter in the 'control' attribute of the objects returned by the [GET /filters/workbenches/vulnerabilities](ref:io-filters-vulnerabilities-workbench-list) endpoint. For more information about the format of this parameter, see [Workbench Filters](doc:workbench-filters).
required: false
name: filter.0.value
in: query
schema:
type: string
example: RHEL
- description: For multiple filters, specifies whether to use the AND or the OR logical operator. The default is AND. For more information about this parameter, see [Workbench Filters](doc:workbench-filters).
required: false
name: filter.search_type
in: query
schema:
type: string
enum:
- ''
- and
- or
responses:
'200':
description: Returned if the list of plugin outputs for the specified plugin was retrieved successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/workbenches_workbenches-plugin-outputs'
examples:
response:
value:
outputs:
- plugin_output: '
The following certificate was at the top of the certificate
chain sent by the remote host, but it is signed by an unknown
certificate authority :
|-Subject : O=LCE Users/OU=LCE Certification Authority/L=New York/C=US/ST=NY/CN=LCE Certification Authority
|-Issuer : O=LCE Users/OU=LCE Certification Authority/L=New York/C=US/ST=NY/CN=LCE Certification Authority
'
states:
- name: Active
results:
- application_protocol: unknown
port: 1243
transport_protocol: tcp
assets:
- hostname: 192.0.2.57
id: e0f36b9c-4b25-477f-b892-adaf9c95ed07
uuid: e0f36b9c-4b25-477f-b892-adaf9c95ed07
netbios_name: null
fqdn: null
ipv4: 192.0.2.57
first_seen: '2018-12-31T15:00:25Z'
last_seen: '2018-12-31T15:00:25Z'
- hostname: 192.0.2.57
id: 7e62a7a7-943b-4154-a5cf-7abc0fdb6c0b
uuid: 7e62a7a7-943b-4154-a5cf-7abc0fdb6c0b
netbios_name: null
fqdn: null
ipv4: 192.0.2.57
first_seen: '2018-12-31T15:00:25Z'
last_seen: '2018-12-31T15:00:25Z'
- hostname: 192.0.2.57
id: 665a9705-cbd8-4822-91e1-40da3b902254
uuid: 665a9705-cbd8-4822-91e1-40da3b902254
netbios_name: null
fqdn: example.com
ipv4: 192.0.2.57
first_seen: '2018-12-31T15:00:25Z'
last_seen: '2018-12-31T15:00:25Z'
- hostname: 192.0.2.57
id: 9ad262f1-f99d-4f9f-ae4d-d49bb79737d0
uuid: 9ad262f1-f99d-4f9f-ae4d-d49bb79737d0
netbios_name: null
fqdn: null
ipv4: 192.0.2.57
first_seen: '2018-12-31T15:00:25Z'
last_seen: '2018-12-31T15:00:25Z'
- hostname: 192.0.2.57
id: 5bb5bbea-9325-4a3c-9c1a-b9710a1bce58
uuid: 5bb5bbea-9325-4a3c-9c1a-b9710a1bce58
netbios_name: null
fqdn: example.com
ipv4: 192.0.2.57
first_seen: '2018-12-31T15:00:25Z'
last_seen: '2018-12-31T15:00:25Z'
- hostname: 192.0.2.57
id: a6bd0750-f9c1-46b0-b1db-6de779a67442
uuid: a6bd0750-f9c1-46b0-b1db-6de779a67442
netbios_name: null
fqdn: null
ipv4: 192.0.2.57
first_seen: '2018-12-31T15:00:25Z'
last_seen: '2018-12-31T15:00:25Z'
severity: 2
- plugin_output: '
The following certificate was at the top of the certificate
chain sent by the remote host, but it is signed by an unknown
certificate authority :
|-Subject : O=VMware, Inc./OU=vCenterServer_2014.07.30_111246/CN=VMware default certificate/E=support@vmware.com
|-Issuer : O=VMware, Inc./OU=vCenterServer_2014.07.30_111246/CN=192.0.2.57/E=support@vmware.com
'
states:
- name: Active
results:
- application_protocol: unknown
port: 443
transport_protocol: tcp
assets:
- hostname: 192.0.2.57
id: aae31e9f-1f6f-4b59-b36b-12e51035584d
uuid: aae31e9f-1f6f-4b59-b36b-12e51035584d
netbios_name: VCENTER
fqdn: example.com
ipv4: 192.0.2.57
first_seen: '2018-12-31T15:00:25Z'
last_seen: '2018-12-31T15:00:25Z'
severity: 2
- application_protocol: unknown
port: 8191
transport_protocol: tcp
assets:
- hostname: 192.0.2.57
id: aae31e9f-1f6f-4b59-b36b-12e51035584d
uuid: aae31e9f-1f6f-4b59-b36b-12e51035584d
netbios_name: VCENTER
fqdn: example.com
ipv4: 192.0.2.57
first_seen: '2018-12-31T15:00:25Z'
last_seen: '2018-12-31T15:00:25Z'
severity: 2
- application_protocol: unknown
port: 8443
transport_protocol: tcp
assets:
- hostname: 192.0.2.57
id: aae31e9f-1f6f-4b59-b36b-12e51035584d
uuid: aae31e9f-1f6f-4b59-b36b-12e51035584d
netbios_name: VCENTER
fqdn: example.com
ipv4: 192.0.2.57
first_seen: '2018-12-31T15:00:25Z'
last_seen: '2018-12-31T15:00:25Z'
severity: 2
- application_protocol: unknown
port: 31100
transport_protocol: tcp
assets:
- hostname: 192.0.2.57
id: aae31e9f-1f6f-4b59-b36b-12e51035584d
uuid: aae31e9f-1f6f-4b59-b36b-12e51035584d
netbios_name: VCENTER
fqdn: example.com
ipv4: 192.0.2.57
first_seen: '2018-12-31T15:00:25Z'
last_seen: '2018-12-31T15:00:25Z'
severity: 2
- application_protocol: unknown
port: 32100
transport_protocol: tcp
assets:
- hostname: 192.0.2.57
id: aae31e9f-1f6f-4b59-b36b-12e51035584d
uuid: aae31e9f-1f6f-4b59-b36b-12e51035584d
netbios_name: VCENTER
fqdn: example.com
ipv4: 192.0.2.57
first_seen: '2018-12-31T15:00:25Z'
last_seen: '2018-12-31T15:00:25Z'
severity: 2
- plugin_output: '
The following certificate was at the top of the certificate
chain sent by the remote host, but it is signed by an unknown
certificate authority
# --- truncated at 32 KB (164 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tenable/refs/heads/main/openapi/tenable-workbenches-api-openapi.yml