search

tenable / pyTenable

Python Library for interfacing into Tenable's platform APIs
https://pytenable.readthedocs.io
MIT License
354 stars 174 forks source link

add a method for /rest/deviceInfo call #827

Closed MAngel666 closed 2 months ago

MAngel666 commented 3 months ago

is there a plan to implepment this api call:

https://docs.tenable.com/security-center/api/Device-Information.htm

as a method in pyTenable for SC?

SteveMcGrath commented 3 months ago

A couple of things:

  1. That API isn't the most reliable, If you NEED that API, then I would recommend using the repository-specific implementation of it instead: https://pytenable.readthedocs.io/en/stable/api/sc/repositories.html#tenable.sc.repositories.RepositoryAPI.device_info
  2. Why are you querying deviceInfo instead of pulling the data from the analysis API?
MAngel666 commented 3 months ago
  1. Because with this call I can get the information repository independently
  2. I think this call is faster and not as resource "hungry" as the one over analysis API
SteveMcGrath commented 3 months ago
  1. the results it returns arent always "accurate" if the same ip exists in multiple repos.
  2. it may be faster for single host, but would actually be much much slower at scale.
MAngel666 commented 3 months ago

I want to use it for an nagios/icinga check. I want to check the availability of the host in tenable.sc.

  1. thats ok for me
  2. I want to use the check a host
SteveMcGrath commented 2 months ago

So I'm going to mark this as a won't do. That API isn't really designed to be used in this way. SC really doesn't like N-scale problems like this as it may actually create a lot of issues with SC if you have more than a few dozen hosts that get pinged in this manner.

While it's counter-intuitive, its actually a lot faster for SC if you make a single bulk call with the analysis API for all the hosts that your trying to get instead of pulling device info. Both analysis and deviceinfo pull from the same sources, and therefore would have the same resource implications to pull from. The deviceinfo API is specifically meant to drive that single UI element within the UI, and is not something we generally ever recommend folks to use.