Returns a list of all of your applications.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | ∞ |
| Maximum Page Size | 100 |
| Default Page Size | 100 |
Total Count Present in meta object | No |
Update a parent asset group or risk meter attributes by ID.
This API converts all filters into a querystring that can't exceed 8,000 characters.
- [Show Asset Group](https://apidocs.kennasecurity.com/reference/show-asset-group.md): Returns a single asset group by ID. - [Delete Asset Group](https://apidocs.kennasecurity.com/reference/delete-asset-group.md):Delete an asset group or risk meter using its ID.
Note: A child or descendant asset group cannot be deleted via the API. Use the UI to delete the child or descendant asset group.
- [Calculate Asset Group Metric](https://apidocs.kennasecurity.com/reference/calculate-asset-group-metric.md): Returns a newly calculated metric value for an asset group based on its ID and the specified metric name. - [Show All Fixes](https://apidocs.kennasecurity.com/reference/show-all-fixes.md):Returns a paginated list of fixes that are related to all of your open vulnerabilities within an asset group.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | ∞ |
| Maximum Page Size | 100 |
| Default Page Size | 100 |
Total Count Present in meta object | Yes |
This request may take longer to complete depending on the number of assets and vulnerabilities associated with your asset group.
- [Show Top Fix Groups](https://apidocs.kennasecurity.com/reference/show-top-fix-groups.md): Returns top fixes for an asset group ID. You can optionally hide assets and only return fix data by passing the hide_asset parameter and setting it equal to true. - [Create Child Asset Group or Risk Meter](https://apidocs.kennasecurity.com/reference/create-child-asset-group-and-risk-meter.md):Creates a new child Asset Group or Risk Meter. The "Hierarchical Risk Meters" feature flag must be enabled to use this endpoint.
When the "Skip Calculations During Risk Meter Creation" feature flag is enabled, "asset_count", "risk_meter_score", and "true_risk_meter_score" calculations are skipped on the response payload and the value is returned as null.
- [List Asset Groups](https://apidocs.kennasecurity.com/reference/list-asset-groups.md):Returns a list of all of your asset groups.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | ∞ |
| Maximum Page Size | 100 |
| Default Page Size | 30 |
Total Count Present in meta object | Yes |
Creates a new Asset Group or Risk Meter.
This API converts all filters into a querystring that can't exceed 8,000 characters.
When the "Skip Calculations During Risk Meter Creation" feature flag is enabled, "asset_count", "risk_meter_score", and "true_risk_meter_score" calculations are skipped on the response payload and the value is returned as null.
- [Historical Mean Time To Remediate Findings by Risk Level](https://apidocs.kennasecurity.com/reference/asset-groups-findings-historical-mean-time-to-remediate-by-risk-level.md): Returns a list of Mean Time To Remediate (MTTR) findings in days based on the Risk Level for the provided Asset Group ID. - [Average Days Open by Risk Level Over Time](https://apidocs.kennasecurity.com/reference/average-days-open-by-risk-level-over-time.md): Returns the average days open of vulnerabilities by risk status in each level (low, medium, and high) for a given Asset Group over time. - [False Positives by Risk Level Over Time](https://apidocs.kennasecurity.com/reference/false-positive-by-risk-level-over-time.md): Returns the count of vulnerabilities manually marked as false positive for a given date range, grouped by risk level. - [Historical Mean Time To Remediate Vulnerabilities by Risk Level](https://apidocs.kennasecurity.com/reference/historical-mean-time-to-remediate-by-risk-level.md): Returns a list of Mean Time To Remediate (MTTR) vulnerabilities in days by Risk Level specified by the Asset Group ID. - [Historical Vulnerability Risk Category Counts](https://apidocs.kennasecurity.com/reference/historical-vulnerability-risk-category-counts.md): Returns a list of the historical Vulnerability Risk Category ("High", "Medium", "Low") counts for the Asset Group ID provided. If a start or end date is not provided, this endpoint defaults to returning data for all time for the specified Asset Group. - [Past Due Vulnerabilities by Risk Level Over Time](https://apidocs.kennasecurity.com/reference/past-due-vulnerabilities-by-risk-level-over-time.md): Returns the count of vulnerabilities that are past their due date for a given date range, grouped by risk level. - [Historical Risk Meter Scores](https://apidocs.kennasecurity.com/reference/historical-risk-meter-scores.md): Returns a list of the historical Risk Meter scores for the Asset Group ID provided. If a start or end date is not provided, this endpoint defaults to returning risk meter scores for all time for the specified Asset Group. - [Risk Accepted by Risk Level Over Time](https://apidocs.kennasecurity.com/reference/risk-accepted-by-risk-level-over-time.md): Returns the count of vulnerabilities with risk-accepted status in each level (low, medium, and high) for a given Asset Group over time. - [Total Past Due Vulnerabilities by Risk Level](https://apidocs.kennasecurity.com/reference/total-past-due-vulnerabilities-by-risk-level.md): Returns the count of vulnerabilities for an asset group that are past their assigned due dates, sorted by high, medium and low risk vulnerabilities. - [Vulnerabilities by Due Date](https://apidocs.kennasecurity.com/reference/vulnerabilities-by-due-date.md): Returns the count of vulnerabilities for a given Asset Group categorized by when they are due. - [Get Refresh Reporting Status](https://apidocs.kennasecurity.com/reference/get-refresh-reporting-status.md): Get the status of the reporting data refresh. Only one client report refresh can be run at a time. If the scheduled client report refresh or a manual refresh is already running, you will not be able to manually start a new one until the one that is currently running is finished. - [Refresh Reporting Data](https://apidocs.kennasecurity.com/reference/refresh-reporting-data.md): Refresh all reporting data. Only one client report refresh can be run at a time. If the scheduled client report refresh or a manual refresh is already running, you will not be able to manually start a new one until the one that is currently running is finished. - [Update Asset](https://apidocs.kennasecurity.com/reference/update-asset.md): Update a single asset's attributes by ID. - [Show Asset](https://apidocs.kennasecurity.com/reference/show-asset.md): Returns information about a single asset by ID. This endpoint does not return tag source information. Tag source information is available in the List Tags endpoint. - [Show Asset Vulnerabilities](https://apidocs.kennasecurity.com/reference/show-asset-vulnerabilities.md): Returns all vulnerabilities for a single asset. - [List Assets](https://apidocs.kennasecurity.com/reference/list-assets.md):Returns a list of all active assets with open vulnerabilities.
To retrieve inactive assets, use the `filter` query parameter with the value "inactive".
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | 20 |
| Maximum Page Size | 500 |
| Default Page Size | 500 |
Total Count Present in meta object | No |
This endpoint does not return tag source information. Tag source information is available in the List Tags endpoint.
- [Create Asset](https://apidocs.kennasecurity.com/reference/create-asset.md): Creates a single asset and returns the record. - [Bulk Update Assets](https://apidocs.kennasecurity.com/reference/bulk-update-assets.md):
Update multiple assets at one time using the bulk update endpoint. Update limit is 30,000 assets at a time.
By default, we will index the assets in the background. To index your assets synchronously, pass in the realtime parameter and set it to true.
In addition to the standard attributes on the "asset" parameter, you can also provide a "remove_tags" param: an array of strings that represent tags you would like removed, and a "reset_tags" param: a boolean value set to true if you would like to completely clear tags for each asset. If "reset_tags" is true, all tags will be removed from the assets regardless of source.
- [Download Zipped Asset Data](https://apidocs.kennasecurity.com/reference/download-zipped-asset-data.md):Returns a gzipped file with the most recent data export of all of your assets. To arrange for a daily full data export, contact support. The format of the uncompressed data, is JSONL, JSON, or XML. This is determined when when you contact support.
For more details, refer to Downloading Export Files.
- [Search Assets](https://apidocs.kennasecurity.com/reference/search-assets.md):Filters assets by a given set of input parameters and returns the filtered assets and the total number of assets in the filtered set. By default, only active assets with open vulnerabilities are returned.
Each unique parameter is combined using AND while each value passed in a single array will be combined using OR. For example, if you search for all assets with status[]=["active"] and tags[]=["foo", "bar"] you will receive all active assets that have either a "foo" tag or a "bar" tag.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | 20 |
| Maximum Page Size | 50,000 |
| Default Page Size | 500 |
Total Count Present in meta object | Yes |
This endpoint does not return tag source information. Tag source information is available in the List Tags endpoint.
- [Validate Asset Search Query](https://apidocs.kennasecurity.com/reference/validate-asset-search-query.md): Validate the query string portion of an asset search. If the query is invalid and if the system can determine a suggested replacement, that suggestion will be returned in the response. - [Untag an Asset](https://apidocs.kennasecurity.com/reference/untag-an-asset.md):
Update a single asset based on ID by removing a tag or tags. Supports either an array of tags, each tag wrapped in single or double quotes, or a single string with a comma separator
Requests to this endpoint will only remove taggings created through the UI or API.
- [Tag an Asset](https://apidocs.kennasecurity.com/reference/tag-an-asset.md): Update a single asset based on ID by using a tag or tags. Supports either an array of tags, each tag wrapped in single or double quotes, or a single string with a comma separator. - [List Tags](https://apidocs.kennasecurity.com/reference/list-tags.md): Returns a list of tags for a given asset. - [Audit Log Search](https://apidocs.kennasecurity.com/reference/audit-log-search.md):Returns a compressed (gzip) JSON lines file with all entries for the specified date range. If there are no audit logs for the specified period, the returned file will have no content. The date is in an ISO 8601 format. Only the day portion (YYYY-MM-DD) is used for both start_date and end_date.
For more details, refer to Downloading Export Files.
- [Show Connector Run](https://apidocs.kennasecurity.com/reference/show-connector-run.md): Return information about a single connector run by ID. - [List Connector Runs](https://apidocs.kennasecurity.com/reference/list-connector-runs.md): Returns a list of connector runs for a connector. - [Upload Data File](https://apidocs.kennasecurity.com/reference/upload-data-file.md):Uploads a data file to a file based connector specified by the id.
The id can be found from the List Connectors API.
The file format is dependent on the connector specified by the id. In most cases, the file format is the Data Importer (KDI) format. This is a JSON format that specifies assets and vulnerabilities.
Get all results from a previously created export using the search_id returned in the Request Data Export API response.
The response is gzipped and the content of the response data is determined by the model field in export_settings in the Request Data Export API body parameters. Usually, the response is stored in a file and gzipped.
If your search has not been completed you will receive an Export Incomplete Response to indicate that we are still processing your search results.
The response example shows an uncompressed response for asset exports; whereas, the response schema shows the options of returning asset, fix, or vulnerability information in its uncompressed format.
For more details, refer to Downloading Export Files guide, "Acquiring the Download File" section.
- [Request Data Export](https://apidocs.kennasecurity.com/reference/request-data-export.md):Filters client data by a given set of search parameters below and ones in the respective search API endpoints.The request is processed in the background.
User must specify the format of the data, including the model type (asset, fix, vulnerability or finding), and data format (json, jsonl, xml). For asset and vulnerability exports, the defaults are open vulnerabilities with active assets. For finding exports, the default is open findings with active assets.
User can also specify fields in export_settings to return only the fields that the user is interested in.For more details, please refer to the Downloading Export Files guide, "Selecting Your Fields" section.
Due to the async nature of the request, a search_id is returned which can be used to get the results of the search once the processing of the request is complete. Search IDs are valid for 30 days after the initial request is made.
The model field in export_settings is referred to as "model" in the filter body parameters below. Each filter body parameter contains information on which model or models the filter body parameter is valid.
Get the status message from a previously created asynchronous search using the search_id.
The following messages are currently returned with the appropriate HTTP response status code:
| HTTP Status Code | Message |
|---|---|
| 200 | Export ready for download |
| 206 | The export is currently enqueued. Try again later. |
| 206 | The export is currently processing. Try again later. |
| 404 | No search found. |
| 410 | The search has expired and is no longer available. |
| 500 | There was an error getting your search data. Please contact tech support for more details. |
Kill a running export by specifying the export ID.
The following messages are currently returned with the appropriate HTTP response status code:
| HTTP Status Code | Message |
|---|---|
| 200 | Terminating client data export. |
| 400 | Export not found. |
| 400 | Cannot kill an already cancelled, failed, or completed export. |
| 500 | There was an error while killing the export. Please contact tech support for more details. |
Returns the client entitlements overage status.
- [Show Finding](https://apidocs.kennasecurity.com/reference/show-finding.md): Returns a single finding by ID. - [Update Finding](https://apidocs.kennasecurity.com/reference/update-findings.md):
Update a single finding's attributes by ID.
To avoid ambiguity with regards to dates, this endpoint accepts strings formatted according to a stricter version of ISO 8601: "YYYY-MM-DDThh:mm:ss.sssZ". All fields besides nanoseconds and timezone are required. If timezone is omitted, UTC is used.
- [Bulk Delete Findings](https://apidocs.kennasecurity.com/reference/bulk-delete-findings.md): Delete multiple findings at a time using the bulk delete endpoint. Delete limit is 2,000 findings at a time. - [Search Findings](https://apidocs.kennasecurity.com/reference/search-findings.md):Filters findings by a given set of parameters and returns those filtered findings as well as the total number of findings in the filtered set.
If no filters are specified, then "Search Findings" is "List Findings".
Each unique parameter is combined using AND while each of values passed in a single array will be combined using OR. For example, if you search for all findings with status=["new", "resolved"] and sort_by="score", you will receive all findings with either status "new" or "resolved," sorted by score in the response.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | 2,000 |
| Maximum Page Size | 100 |
| Default Page Size | 100 |
Total Count Present in meta object | Yes |
To avoid ambiguity with regards to dates, this endpoint accepts strings formatted according to a stricter version of ISO 8601: "YYYY-MM-DDThh:mm:ss.sssTZD". All fields besides nanoseconds and timezone are required. If time is omitted, UTC is used. See ISO 8601 formats for more details.
- [Create Finding](https://apidocs.kennasecurity.com/reference/create-finding.md):Creates a single finding and returns the record.
To associate this Finding with a vulnerability definition, either identifier or definition is required. The identifier should be used when the Finding is associated with a known vulnerability: CVE, CWE, or WASC ID (e.g. "CWE-242"). However, certain scanners will not report a known vulnerability, in which case the definition can be used. The keys of definition are documented below, with scanner_identifier being minimally required.
To avoid ambiguity with regards to dates, this endpoint accepts strings formatted according to a stricter version of ISO 8601: "YYYY-MM-DDThh:mm:ss.sssTZD". All fields besides nanoseconds and timezone are required. If timezone is omitted, UTC is used.
- [Show Fix](https://apidocs.kennasecurity.com/reference/show-fix.md): Returns information about a single fix by ID. - [List Fix Alternatives](https://apidocs.kennasecurity.com/reference/list-fix-alternatives.md):Returns a paginated list of a single fix's alternative fixes by a fix's ID.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | ∞ |
| Maximum Page Size | 100 |
| Default Page Size | 25 |
Total Count Present in meta object | Yes |
Note: this request may take longer to complete depending on the number of assets and vulnerabilities associated with your fixes.
- [List Fixes](https://apidocs.kennasecurity.com/reference/list-fixes.md):Returns a paginated list of fixes that are related to all of your open vulnerabilities that have active assets.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | ∞ |
| Maximum Page Size | 100 |
| Default Page Size | 25 |
Total Count Present in meta object | Yes |
Note: this request may take longer to complete depending on the number of assets and vulnerabilities associated with your fixes.
- [Search Fixes](https://apidocs.kennasecurity.com/reference/search-fixes.md):Filters fixes by a given set of vulnerability and asset parameters and returns the filtered fixes as well as the total number of fixes. By default, only fixes for open vulnerabilities with active assets are returned. Requests with search parameters relevant to over 30,000,000 vulnerabilities will be rejected.
Each unique parameter is combined using AND while each of values passed in a single array will be combined using OR. For example, if you search for all fixes belonging to vulnerabilities with status=["open"] and port=["443", "80"] you will receive all fixes for open vulnerabilities that have either port 443 or port 80.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | ∞ |
| Maximum Page Size | 5,000 |
| Default Page Size | 25 |
Total Count Present in meta object | Yes |
List fixes in a ServiceNow format.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | ∞ |
| Maximum Page Size | 1,000 |
| Default Page Size | 1,000 |
Total Count Present in meta object | Yes |
Note: The functionality of this ServiceNow fix endpoint is intended to be migrated in the future. Updates and instructions on new endpoint will be provided in advance of any migration.
- [ServiceNow Search Vulnerabilities](https://apidocs.kennasecurity.com/reference/service-now-search-vulnerabilities.md):Filters vulnerabilities by a given set of parameters and returns the filtered vulnerabilities as well as the total number of vulnerabilities in the filtered set.
By default, only open vulnerabilities with active assets are returned. Each unique parameter is combined using AND while each of values passed in a single array will be combined using OR. For example, if you search for all vulnerabilities with status=["open"] and classification[]=CVE you will receive all open vulnerabilities that have CVEs.
| Attribute | Value |
|---|---|
| Maximum Result Allowed When search_id is not provided | ∞ |
| Maximum Result Allowed When search_id is provided | 200,000 |
| Maximum Page Size | 10,000 |
| Default Page Size | 10,000 |
Total Count Present in meta object | Yes |
Note: The functionality of this ServiceNow vulnerability endpoint is intended to be migrated in the future. Updates and instructions on new endpoint will be provided in advance of any migration.
- [Show Remediation Score](https://apidocs.kennasecurity.com/reference/check-remediation-score.md):Returns Remediation Score, which is a measurement of how well an organization is addressing the risk on a group of assets. This is different than the Risk Score, which is not performance based, but the point-in-time level of risk on a group of assets. Remediation Score is calculated through four metrics on an organization's vulnerabilities (both open and closed) related to the organization's assets.
The four metrics of a Remediation Score are: Coverage, Efficiency, Velocity, and Capacity.
Restricted Access
This API endpoint is a premium feature, depending on your subscription you may not have access.
Returns Service Level Agreement (SLA) adherence metrics from up to the last 60 days.
Note: If vulnerability metric (low, medium, high) does not have data, it will not be shown. - [Show High Risk Vulnerability Densities](https://apidocs.kennasecurity.com/reference/check-vulnerability-densities-metrics.md):
Returns high risk vulnerability densities metrics, which are open high priority vulnerabilities by Cisco Vulnerability Management Risk score, grouped by asset priority buckets, from up to the last 180 days. The response will contain your metrics as well as your industry metrics.
Note: If vulnerability densities metric (low, medium, critical) does not have data, it will not be shown. - [Show Role](https://apidocs.kennasecurity.com/reference/show-role.md): Returns information about a single role by ID. - [Update Role](https://apidocs.kennasecurity.com/reference/update-role.md): Update a single role's attributes by ID. When updating asset groups for a role, all current asset groups for a role will be over written by the array passed in the update params. To add asset groups to a role without overwriting a role's current asset groups use the add_asset_groups endpoint. If you would like to update custom role permissions, please use the custom_permissions endpoint. - [Delete Role](https://apidocs.kennasecurity.com/reference/delete-role.md): Delete a role using its ID. A role cannot be deleted if it is connected to a user. - [Add Application(s) to Role](https://apidocs.kennasecurity.com/reference/add-applications-to-role.md): Add applications to a role by ID. - [Add Asset Group(s) to Role](https://apidocs.kennasecurity.com/reference/add-asset-groups-to-role.md): Add asset groups to a role by ID. - [Update Role Custom Permissions](https://apidocs.kennasecurity.com/reference/update-role-custom-permissions.md): Update the custom permissions by role ID. - [List Roles](https://apidocs.kennasecurity.com/reference/list-roles.md): Returns a list of all of your roles. - [Create Role](https://apidocs.kennasecurity.com/reference/create-role.md): Creates a single role and returns the record. - [Bulk Update Permissions](https://apidocs.kennasecurity.com/reference/update-permissions-in-bulk.md): Allow admins to bulk update permissions of custom roles. Currently the end point supports enabling/disabling home page and AppSec reporting page access for custom roles. Update limit is 10,000 permissions at a time. By default we will index the permissions in the background and it responds with {"result":"Your request to update permissions in bulk is being processed in the background."} after receiving the request, updated changes can be seen in the UI under "Roles" or by invoking the "List Roles" API. In order to index your permissions synchronously, pass in the "realtime" parameter and set it to true. - [Show Stack](https://apidocs.kennasecurity.com/reference/show-stack.md): Return information about a stack by ID. - [Delete Stack](https://apidocs.kennasecurity.com/reference/delete-stack.md): Delete an Stack using its ID. - [Update Stack](https://apidocs.kennasecurity.com/reference/update-stack.md): Update a stack by its ID. - [Stack's Application statistics](https://apidocs.kennasecurity.com/reference/stack-applications-statistics.md): Return the application statistics about a stack by ID. - [Stack's Asset Groups statistics](https://apidocs.kennasecurity.com/reference/stack-asset-groups-statistics.md): Return the asset groups statistics about a stack by ID. - [List Stacks](https://apidocs.kennasecurity.com/reference/list-stacks.md):
Returns a list of all of your stacks.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | ∞ |
| Maximum Page Size | 100 |
| Default Page Size | 100 |
Total Count Present in meta object | Yes |
Update a single user's attributes by ID. You can assign up to ten roles per user with the new "Multiple Roles Per User" feature.
Please use roles or role_ids in the request, role is no longer supported after Sep 08, 2021.
Important: all of the user's roles or role_ids should be provided in the arrays including the existing ones and the new ones, any existing roles or role_ids that are not included in the arrays will be unassigned from the user. For more details, please see the blog Updating Users with Multiple Roles, section "Update user".
Filters users by a given set of input parameters and returns the filtered users and the total number of users in the filtered set.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | ∞ |
| Maximum Page Size | 5000 |
| Default Page Size | 50 |
Total Count Present in meta object | Yes |
Returns a paginated list of all of your users.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | ∞ |
| Maximum Page Size | 5000 |
| Default Page Size | 500 |
Total Count Present in meta object | Yes |
Delete multiple vulnerabilities at a time. Delete limit is 2,000 vulnerabilities at a time.
- [Bulk Update Vulnerabilities](https://apidocs.kennasecurity.com/reference/bulk-update-vulnerability.md): Update multiple vulnerabilities at a time using the bulk update endpoint. Update limit is 30,000 vulnerabilities at a time. By default we will index the vulnerabilities in the background. - [Download Zipped Vulnerability Data](https://apidocs.kennasecurity.com/reference/download-zipped-vuln-data.md):Will return a gzipped file with the most recent data export of all of your vulnerabilities. In order to arrange for a daily full data export please contact our tech support staff. The format of the uncompressed data, is JSONL, JSON, or XML. This is determined when the technical support staff is contacted.
For more details, refer to Downloading Export Files.
- [Search Vulnerabilities](https://apidocs.kennasecurity.com/reference/search-vulnerabilities.md):Filters vulnerabilities by a given set of parameters and returns the filtered vulnerabilities as well as the total number of vulnerabilities in the filtered set.
By default, only open vulnerabilities with active assets are returned. Each unique parameter is combined using AND while each of values passed in a single array will be combined using OR. For example, if you search for all vulnerabilities with status=["open"] and port=["443", "80"] you will receive all open vulnerabilities that have either port 443 or port 80.
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | 20 |
| Maximum Page Size | 5,000 |
| Default Page Size | 500 |
Total Count Present in meta object | Yes |
Returns a list of all of the open vulnerabilities that are associated with active assets.
To retrieve closed vulnerabilities, use the `filter` query parameter with the value "closed".
| Attribute | Value |
|---|---|
| Maximum Pages Allowed | 20 |
| Maximum Page Size | 500 |
| Default Page Size | 500 |
Total Count Present in meta object | No |
Returns a single vulnerability definition by CVE ID.
Restricted Access
This API endpoint is a premium feature and requires access to the Vulnerability Intelligence+ API.
Cisco Vulnerability Management defines chatter as anytime a given vulnerability is mentioned anywhere on the Internet including the dark web. Returns chatter information for a single vulnerability definition specified by CVE ID.
Restricted Access
This API endpoint is a premium feature and requires access to the Vulnerability Intelligence+ API.
Returns a list of known malware hashes (MD5, SHA1 and SHA256) for a single vulnerability definition by CVE ID.
Restricted Access
This API endpoint is a premium feature and requires access to the Vulnerability Intelligence+ API.
Returns all known CVE IDs.
Restricted Access
This API endpoint is a premium feature and requires access to the Vulnerability Intelligence+ API.
Returns vulnerability definitions that match given search criteria for only Qualys customers.
Restricted Access
This API endpoint is a premium feature and requires access to the Vulnerability Intelligence+ API.
Returns top 20 Vulnerability Trends defined by the `trend` and `sort_by` parameters.For example:
Restricted Access
This API endpoint is a premium feature and requires access to the Vulnerability Intelligence+ API.
Provides the location to obtain the download of the Vulnerability Intelligence+ data snapshot.
A HTTP 302 status code indicates redirection and to use the URL value of the Locaton key in the HTTP response header in a HTTP GET. The response of the HTTP GET will return gzip data.
However some libraries and applications due to options or default behavior, perform the redirect and return a HTTP 200 status code along with gzipped response data.
No matter which way the gzipped data is obtained, it is the responsibility of the client to ungzip the response data. The unzipped data is in the JSONL format.
The response schema and example shows one line of ungzipped data in JSONL format.
Restricted Access
This API endpoint is a premium feature and requires access to the Vulnerability Intelligence+ API.
This API endpoint's data is now accessible as part of the Cisco Cloud Security Add-on for Splunk.
Return one or more vulnerability definitions by CVE ID.
Restricted Access
This API endpoint is a premium feature and requires access to the Vulnerability Intelligence+ API.
Returns vulnerability definitions with significant score changes (more than 1 point of change up or down) by CVE ID. An empty array is returned if there are no vulnerability defintions with significant score changes.The `realtime_score` field is included and reflects the current score change, which can be compared to the less frequently more stable `risk_meter_score` field.
Restricted Access
This API endpoint is a premium feature and requires access to the Vulnerability Intelligence+ API.
Returns Cisco Vulnerability Management's CVE score history for one or more CVE identifiers. Customers who have purchased the Vulnerability Intelligence+ API may access any CVE. Customers who have not purchased Vulnerability Intelligence+ API may only access CVEs that correspond to vulnerabilities within their instance.
Restricted Access
This API endpoint is a premium feature and requires access to the Vulnerability Intelligence+ API to access any CVE.
Returns a list of known vulnerabilities for a given operating system such as Windows, Mac OS and Linux Systems.
Restricted Access
This API endpoint is a premium feature for select partners.
To generate a payload on the client machine, please review the Getting Started with Vulnerability Inference V2 guides, and select your client operating system. For example, for Darwin Systems (macOS), run this osquery command from your command line shell:
osqueryi --json "SELECT * FROM os_version;"The command should produce JSON output that looks like this:
[ { "major": "10", "name": "Mac OS X", "platform_like": "darwin", "patch": "3", "platform": "darwin", "version": "10.15.1", "build": "19D76", "codename": "", "arch": "x86_64", "minor": "15" } ]The above output can be used in the POST request.
- [Vulnerability Inference for Windows, Darwin (macOS) and Linux Systems](https://apidocs.kennasecurity.com/reference/v3-os-inference.md):Returns a list of known vulnerabilities for a given operating system such as Windows, Mac OS and Linux Systems.
Restricted Access
This API endpoint is a premium feature for select partners.
To generate a payload on the client machine, please review the Getting Started with Vulnerability Inference V3 guides, and select your client operating system. For example, for Darwin Systems (macOS), run this osquery command from your command line shell:
osqueryi --json "SELECT * FROM os_version;"The command should produce JSON output that looks like this:
[ { "major": "10", "name": "Mac OS X", "platform_like": "darwin", "patch": "3", "platform": "darwin", "version": "10.15.1", "build": "19D76", "codename": "", "arch": "x86_64", "minor": "15" } ]The above output can be used in the POST request.
- [Cve entities details](https://apidocs.kennasecurity.com/reference/get-odata-cves.md):Returns a entity or collection of entities of type CVEs.
Restricted Access
This API endpoint is a premium feature for selected partners.
Returns a list of known vulnerabilities for a given list of applications. Supported operating systems include CentOS, SUSE Linux Enterprise Server, Redhat Enterprise Linux, Ubuntu and Windows.
Restricted Access
This API endpoint is a premium feature for select partners.
Returns a list of known vulnerabilities for a given Windows operating system version.
Restricted Access
This API endpoint is a premium feature for select partners.