diff --git a/registry/pyproject.toml b/registry/pyproject.toml index 998ff55a4..9900bc66c 100644 --- a/registry/pyproject.toml +++ b/registry/pyproject.toml @@ -34,6 +34,7 @@ dependencies = [ "ldap3==2.9.1", "nh3==0.2.18", "pymongo==4.8.0", + "pytenable==1.6.0", "slack-sdk==3.28.0", "tenacity==8.3.0", "types-aioboto3[guardduty,s3]==13.0.1", diff --git a/registry/tracecat_registry/integrations/tenable_nessus.py b/registry/tracecat_registry/integrations/tenable_nessus.py new file mode 100644 index 000000000..926fb3540 --- /dev/null +++ b/registry/tracecat_registry/integrations/tenable_nessus.py @@ -0,0 +1,36 @@ +"""Generic interface for Tenable Nessus via pyTenable. + +https://github.com/tenable/pyTenable/blob/main/tests/nessus/conftest.py +""" + +from tenable.nessus import Nessus + +from tracecat_registry import RegistrySecret, registry, secrets + +tenable_secret = RegistrySecret( + name="tenable_nessus", + keys=["TENNABLE_ACCESS_KEY", "TENNABLE_SECRET_KEY"], +) +"""Tenable Nessus secret. + +- name: `tenable_nessus` +- keys: + - `TENNABLE_ACCESS_KEY` + - `TENNABLE_SECRET_KEY` +""" + + +@registry.register( + default_title="Call Nessus API", + description="Call any Nessus API using the pyTenable library", + display_group="Tenabl Nessus", + doc_url="https://pytenable.readthedocs.io/en/stable/api/nessus/index.html", + namespace="integrations.tenable_nessus", + secrets=[tenable_secret], +) +async def call_api(object_name: str, method_name: str, params: dict) -> dict: + nessus = Nessus( + access_key=secrets.get("TENNABLE_ACCESS_KEY"), + secret_key=secrets.get("TENNABLE_SECRET_KEY"), + ) + return await getattr(getattr(nessus, object_name), method_name)(**params) diff --git a/registry/tracecat_registry/templates/tenable_nessus/list_vulnerabilities.yml b/registry/tracecat_registry/templates/tenable_nessus/list_vulnerabilities.yml new file mode 100644 index 000000000..fc364f066 --- /dev/null +++ b/registry/tracecat_registry/templates/tenable_nessus/list_vulnerabilities.yml @@ -0,0 +1,25 @@ +type: action +definition: + title: List Tenable Nessus scans + description: List vulnerability scans from a Tenable Nessus instance + display_group: Tenable Nessus + doc_url: https://pytenable.readthedocs.io/en/stable/api/nessus/scans.html#tenable.nessus.scans.ScansAPI.details + namespace: integrations.tenable_nessus + name: list_vulnerabilities + expects: + scan_id: + type: int + description: Maximum number of scans to return + default: 100 + api_domain: + type: str + description: API domain to call + steps: + - ref: list_vulnerabilities + action: integrations.tenable_nessus.call_api + args: + object_name: scans + method_name: list + params: + scan_id: ${{ inputs.scan_id }} + returns: ${{ steps.list_vulnerabilities.result }}