search

tenable / pyTenable

Python Library for interfacing into Tenable's platform APIs
https://pytenable.readthedocs.io
MIT License
354 stars 173 forks source link

Query on Tenable.sc API - Analysis #680

Closed stiong-p closed 1 year ago

stiong-p commented 1 year ago

Hi, I would like to understand the definitions of the API analysis output data below, or there other documentation that I may refer to?:

  1. The difference between "ips" and "ip".

  2. The last_seen_after and last_seen_before are null, why would it be null? last_seen : (epoch-timestamp) last_seen_after: null last_seen_before: null

Thank you in advance!

aseemsavio commented 1 year ago

Hi, is this the API you're referring to?

aseemsavio commented 1 year ago

Could you also mention the version of Tenable.sc you're using?

stiong-p commented 1 year ago

It is with reference to https://pytenable.readthedocs.io/en/stable/api/sc/analysis.html, using T.sc 5.23.1. If I were to just query using this method - https://docs.tenable.com/tenablesc/api/Analysis.htm#AnalysisRESTReference-/analysis I do not find "ip", "last_seen_after" and "last_seen_before".

aseemsavio commented 1 year ago

Here's the response to the question from T.sc team.

The ip field is the IP address of the host (in IP repos it’s the IP address stored in the .hdb file). The ips field is all the IP addresses stored in the namedb for that host. May be “last_seen_after” and “last_seen_before” fields were from old implementation. I don’t see any reference to these fields in SC current code base.