tenable / pyTenable

Python Library for interfacing into Tenable's platform APIs
https://pytenable.readthedocs.io
MIT License
354 stars 173 forks source link

Can't export all vulns (only for tha last 30 days) #697

Closed peter-fakory closed 7 months ago

peter-fakory commented 1 year ago

Is your feature request related to a problem? Please describe. When I use the indicated code it seems that it exports only vulns were last found in the last 30 days so how I can export all vulns ever?

Describe the solution you'd like is there away to filter with the same code to tell PyTenable export all vulns datra and not just those who were last found in the last 'e.g. 30/60/90 days'?

Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered.

Additional context Here is the code I'm using:

from tenable.io import TenableIO import pprint

access_key='ACCESS_KEY_GOES_HERE' secret_key='SECRET_KEY_GOES_HERE'

tio = TenableIO(access_key, secret_key, product='Export Vuln Data', build='0.0.1')

for vuln in tio.exports.vulns(): pprint.pprint(vuln)

SteveMcGrath commented 1 year ago

The default filters on the API itself are 30 days && only for licensed assets. For older data you would need to specify inclusion of unlicensed assets as well as a since parameter of much older. Note the include_unlicensed blag and the since filters here:

https://pytenable.readthedocs.io/en/stable/api/io/exports.html#tenable.io.exports.api.ExportsAPI.vulns

Also worth noting, that a given IO instance only allows for so many exports running at a time, and larger exports take much long and have significantly more data. It's why we generally recommend pulling the data statefully and tracking the data using deltas.

https://developer.tenable.com/docs/tenableio-integrations#data-exports

https://developer.tenable.com/docs/tenableio-integrations#vulnerability-exports

sanchirico commented 1 year ago

Hi @SteveMcGrath is there any other filters that could be limiting results.? I'm using include_unlicensed=True and since=331189387 (June, 1980) and still receiving less than 1/2 of the vulns shown in cloud.tenable.

SteveMcGrath commented 8 months ago

@sanchirico just doubling back on this to see if this is still an issue? if not let me know and I can close the issue out. If we dont hear back within a week or so we'll close it out as well.