List Vulnerabilities

curl --request GET \
  --url https://api.leen.dev/v1/vms/vulnerabilities \
  --header 'X-API-KEY: <api-key>' \
  --header 'X-CONNECTION-ID: <api-key>'

{
  "count": 123,
  "items": [
    {
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "name": "<string>",
      "description": "<string>",
      "scan_output": "<string>",
      "cve": [
        "<string>"
      ],
      "cvss_version": "<string>",
      "cvss_vector": "<string>",
      "cvss_temporal_score": 123,
      "cvss_temporal_vector": "<string>",
      "cert_id": "<string>",
      "port": 123,
      "protocol": "<string>",
      "service": "<string>",
      "first_seen": "2023-11-07T05:31:56Z",
      "last_seen": "2023-11-07T05:31:56Z",
      "updated_at": "2023-11-07T05:31:56Z",
      "state_updated_at": "2023-11-07T05:31:56Z",
      "patchable": true,
      "solution": "<string>",
      "category": "web",
      "vendor": "tenable",
      "vendor_id": "<string>",
      "vendor_severity": "<string>",
      "vendor_scan_id": "<string>",
      "device": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "status": "active",
        "last_seen": "2023-11-07T05:31:56Z",
        "first_seen": "2023-11-07T05:31:56Z",
        "source_vendors": [
          {
            "vendor": "<string>",
            "vendor_id": "<string>",
            "agent_info": {
              "agent_version": "<string>",
              "signature_version": "<string>",
              "policies": [
                {}
              ]
            }
          }
        ],
        "installed_software": [
          "<string>"
        ],
        "ad_info": {
          "org_unit": "<string>",
          "site_name": "<string>",
          "domain": "<string>",
          "device_id": "<string>"
        },
        "platform": "mac",
        "hostnames": [
          "<string>"
        ],
        "os_version": "<string>",
        "os_major_version": "<string>",
        "os_minor_version": "<string>",
        "fqdns": [
          "<string>"
        ],
        "ipv4s": [
          "<string>"
        ],
        "ipv6s": [
          "<string>"
        ],
        "mac_addresses": [
          "<string>"
        ],
        "cloud_metadata": {
          "cloud_provider": "aws",
          "account_id": "<string>",
          "region": "<string>",
          "availability_zone": "<string>",
          "instance_id": "<string>",
          "instance_type": "<string>",
          "image_id": "<string>",
          "kernel_id": "<string>",
          "vpc_id": "<string>",
          "subnet_id": "<string>"
        },
        "tags": [
          {
            "key": "<string>",
            "value": "<string>",
            "source": "aws"
          }
        ],
        "identities": [
          {
            "username": "<string>",
            "user_sid": "<string>"
          }
        ],
        "vendor_data": {}
      },
      "resource": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "name": "<string>",
        "type": "BRANCH",
        "state": "ACTIVE",
        "vendor": "<string>",
        "vendor_attributes": {
          "id": "<string>",
          "data": {
            "vendor": "qualys",
            "host_id": "<string>",
            "asset_id": "<string>",
            "tracking_method": "<string>"
          }
        },
        "tags": [
          {
            "key": "<string>",
            "value": "<string>",
            "source": "wiz_vms"
          }
        ],
        "groups": [
          {
            "name": "<string>",
            "uid": "<string>"
          }
        ],
        "data": {
          "hostnames": [
            "<string>"
          ],
          "image": "<string>"
        },
        "cloud_metadata": {
          "account_id": "<string>",
          "account_name": "<string>",
          "cloud_provider": "<string>",
          "image_id": "<string>",
          "instance_id": "<string>",
          "instance_type": "<string>",
          "region": "<string>",
          "subnet_id": "<string>",
          "vpc_id": "<string>"
        },
        "url": "<string>",
        "first_seen": "2023-11-07T05:31:56Z",
        "last_seen": "2023-11-07T05:31:56Z"
      },
      "cvss_base_score": "CVSS base score",
      "severity": "none",
      "state": "open",
      "vulnerability_url": "<string>",
      "vendor_data": {}
    }
  ],
  "total": 123
}

GET

vms

vulnerabilities

List Vulnerabilities

curl --request GET \
  --url https://api.leen.dev/v1/vms/vulnerabilities \
  --header 'X-API-KEY: <api-key>' \
  --header 'X-CONNECTION-ID: <api-key>'

{
  "count": 123,
  "items": [
    {
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "name": "<string>",
      "description": "<string>",
      "scan_output": "<string>",
      "cve": [
        "<string>"
      ],
      "cvss_version": "<string>",
      "cvss_vector": "<string>",
      "cvss_temporal_score": 123,
      "cvss_temporal_vector": "<string>",
      "cert_id": "<string>",
      "port": 123,
      "protocol": "<string>",
      "service": "<string>",
      "first_seen": "2023-11-07T05:31:56Z",
      "last_seen": "2023-11-07T05:31:56Z",
      "updated_at": "2023-11-07T05:31:56Z",
      "state_updated_at": "2023-11-07T05:31:56Z",
      "patchable": true,
      "solution": "<string>",
      "category": "web",
      "vendor": "tenable",
      "vendor_id": "<string>",
      "vendor_severity": "<string>",
      "vendor_scan_id": "<string>",
      "device": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "status": "active",
        "last_seen": "2023-11-07T05:31:56Z",
        "first_seen": "2023-11-07T05:31:56Z",
        "source_vendors": [
          {
            "vendor": "<string>",
            "vendor_id": "<string>",
            "agent_info": {
              "agent_version": "<string>",
              "signature_version": "<string>",
              "policies": [
                {}
              ]
            }
          }
        ],
        "installed_software": [
          "<string>"
        ],
        "ad_info": {
          "org_unit": "<string>",
          "site_name": "<string>",
          "domain": "<string>",
          "device_id": "<string>"
        },
        "platform": "mac",
        "hostnames": [
          "<string>"
        ],
        "os_version": "<string>",
        "os_major_version": "<string>",
        "os_minor_version": "<string>",
        "fqdns": [
          "<string>"
        ],
        "ipv4s": [
          "<string>"
        ],
        "ipv6s": [
          "<string>"
        ],
        "mac_addresses": [
          "<string>"
        ],
        "cloud_metadata": {
          "cloud_provider": "aws",
          "account_id": "<string>",
          "region": "<string>",
          "availability_zone": "<string>",
          "instance_id": "<string>",
          "instance_type": "<string>",
          "image_id": "<string>",
          "kernel_id": "<string>",
          "vpc_id": "<string>",
          "subnet_id": "<string>"
        },
        "tags": [
          {
            "key": "<string>",
            "value": "<string>",
            "source": "aws"
          }
        ],
        "identities": [
          {
            "username": "<string>",
            "user_sid": "<string>"
          }
        ],
        "vendor_data": {}
      },
      "resource": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "name": "<string>",
        "type": "BRANCH",
        "state": "ACTIVE",
        "vendor": "<string>",
        "vendor_attributes": {
          "id": "<string>",
          "data": {
            "vendor": "qualys",
            "host_id": "<string>",
            "asset_id": "<string>",
            "tracking_method": "<string>"
          }
        },
        "tags": [
          {
            "key": "<string>",
            "value": "<string>",
            "source": "wiz_vms"
          }
        ],
        "groups": [
          {
            "name": "<string>",
            "uid": "<string>"
          }
        ],
        "data": {
          "hostnames": [
            "<string>"
          ],
          "image": "<string>"
        },
        "cloud_metadata": {
          "account_id": "<string>",
          "account_name": "<string>",
          "cloud_provider": "<string>",
          "image_id": "<string>",
          "instance_id": "<string>",
          "instance_type": "<string>",
          "region": "<string>",
          "subnet_id": "<string>",
          "vpc_id": "<string>"
        },
        "url": "<string>",
        "first_seen": "2023-11-07T05:31:56Z",
        "last_seen": "2023-11-07T05:31:56Z"
      },
      "cvss_base_score": "CVSS base score",
      "severity": "none",
      "state": "open",
      "vulnerability_url": "<string>",
      "vendor_data": {}
    }
  ],
  "total": 123
}

Authorizations

X-CONNECTION-ID

string

header

required

X-API-KEY

string

header

required

Query Parameters

sort

string | null

Sort by field

stateUpdatedSince

string<date-time> | null

Datetime filter, only return vulnerabilities where the state was updated since this datetime. Example format: 2021-01-01T00:00:00+00:00

firstSeenSince

string<date-time> | null

Datetime filter, only return vulnerabilities where the first seen since this datetime. Example format: 2021-01-01T00:00:00+00:00

lastSeenSince

string<date-time> | null

Datetime filter, only return vulnerabilities where the last seen since this datetime. Example format: 2021-01-01T00:00:00+00:00

deviceId

string | null

Device ID Filter, comma separated

resourceId

string | null

Resource ID Filter, comma separated

severity

string | null

Vulnerability severity filter, comma separated

state

string | null

Vulnerability state filter, comma separated

port

string | null

Port number filter, comma separated

protocol

string | null

Protocol filter, comma separated

Response

Successful Response

OffsetPaginatedResponse[VulnerabilityRespModel]
KeySetPaginatedResponse[VulnerabilityRespModel]

count

integer

required

Number of items return in the response

items

Vulnerability · object[]

required

List of items returned in the response

Show child attributes

items.id

string<uuid>

required

Leen's UUID for the vulnerability

items.name

string

required

Name of vulnerability, provided by the upstream vendor

items.description

string

required

Description of vulnerability, provided by the upstream vendor

items.scan_output

string | null

required

Scan output that was provided when detected on the device

items.cve

string[] | null

required

List of CVEs associated with the vulnerability

items.cvss_version

string | null

required

CVSS version

items.cvss_vector

string | null

required

CVSS vector uses cvss3 when available, provided by the upstream vendor

items.cvss_temporal_score

number | null

required

CVSS temporal score

items.cvss_temporal_vector

string | null

required

CVSS temporal vector

items.cert_id

string | null

required

Corresponds to an identifier in the vulnerability database provided by the US Computer Emergency Readiness Team (US-CERT)

items.port

integer | null

required

Port number of the vulnerability that was detected

items.protocol

string | null

required

Protocol of the vulnerability that was detected, example: tcp

items.service

string | null

required

Service of the vulnerability that was detected, example: http

items.first_seen

string<date-time> | null

required

First detection date

items.last_seen

string<date-time> | null

required

Last detection date

items.updated_at

string<date-time> | null

required

The last time the vulnerability was updated

items.state_updated_at

string<date-time> | null

required

The last time the state was updated

items.patchable

boolean | null

required

A patch is available

items.solution

string | null

required

Solution for the vulnerability, provided by upstream vendor

items.category

enum<string> | null

required

Vulnerability category

Available options:

web,

network,

database,

application,

os,

other,

general,

attack_vector

items.vendor

enum<string>

required

Source vendor

Available options:

tenable,

qualys,

snyk,

insightvm,

crowdstrike_spotlight,

sentinelone_vms,

MS_DEFENDER_VMS,

WIZ_VMS,

AWS_INSPECTOR2

items.vendor_id

string | null

required

Vendor's ID of the vulnerability

items.vendor_severity

string | null

required

Passthrough value of severity

items.vendor_scan_id

string | null

required

Vendor's ID of the scan that detected the

items.device

Device · object

Device attached to the vulnerability, include device groups with includeDeviceGroups query parameter

Device
DeviceWithGroups

Show child attributes

items.device.id

string<uuid>

required

items.device.status

enum<string>

required

Available options:

active,

offline,

quarantined,

unknown,

deleted

items.device.last_seen

string<date-time> | null

required

items.device.first_seen

string<date-time> | null

required

items.device.source_vendors

DeviceVendor · object[]

required

Show child attributes

items.device.source_vendors.vendor

string

required

items.device.source_vendors.vendor_id

string

required

items.device.source_vendors.agent_info

DeviceAgentInfo · object

Show child attributes

items.device.source_vendors.agent_info.agent_version

string | null

items.device.source_vendors.agent_info.signature_version

string | null

items.device.source_vendors.agent_info.policies

Policies · object[] | null

items.device.installed_software

string[] | null

required

items.device.ad_info

DeviceADInfo · object

required

Show child attributes

items.device.ad_info.org_unit

string | null

items.device.ad_info.site_name

string | null

items.device.ad_info.domain

string | null

items.device.ad_info.device_id

string | null

items.device.platform

enum<string> | null

Available options:

mac,

windows,

linux,

unknown

items.device.hostnames

string[] | null

items.device.os_version

string | null

items.device.os_major_version

string | null

items.device.os_minor_version

string | null

items.device.fqdns

string[] | null

items.device.ipv4s

string[] | null

items.device.ipv6s

string[] | null

items.device.mac_addresses

string[] | null

items.device.cloud_metadata

AWSMetadata · object

CloudMetadata, currently only AWS is supported

Show child attributes

items.device.cloud_metadata.cloud_provider

enum<string>

default:aws

Available options:

aws

Allowed value: "aws"

items.device.cloud_metadata.account_id

string | null

items.device.cloud_metadata.region

string | null

items.device.cloud_metadata.availability_zone

string | null

items.device.cloud_metadata.instance_id

string | null

items.device.cloud_metadata.instance_type

string | null

items.device.cloud_metadata.image_id

string | null

items.device.cloud_metadata.kernel_id

string | null

items.device.cloud_metadata.vpc_id

string | null

items.device.cloud_metadata.subnet_id

string | null

items.device.tags

DeviceTags · object[] | null

Show child attributes

items.device.tags.key

string

required

items.device.tags.value

string

required

items.device.tags.source

enum<string>

required

Available options:

aws,

qualys,

wiz_vms

items.device.identities

DeviceIdentity · object[] | null

Show child attributes

items.device.identities.username

string

required

items.device.identities.user_sid

string | null

items.device.vendor_data

Vendor Data · object

Vendor specific pass through data, values can vary based on vendor

items.resource

Resource · object

Resource attached to the vulnerability

Show child attributes

items.resource.id

string<uuid>

required

Leen's UUID for the resource

items.resource.name

string

required

Resource name

items.resource.type

enum<string>

required

Type of the resource

Available options:

BRANCH,

HOST,

CONTAINER,

DEPENDENCY,

IMAGE,

REPOSITORY,

VENDOR,

UNKNOWN

items.resource.state

enum<string>

required

State of the resource

Available options:

ACTIVE,

IGNORED,

DELETED,

INACTIVE,

QUARANTINED,

UNKNOWN

items.resource.vendor

string

required

The source vendor of the resource

items.resource.vendor_attributes

ResourceVendorAttributes · object

required

Vendor-specific attributes like IDs

Show child attributes

items.resource.vendor_attributes.id

string

required

Vendor specific ID

items.resource.vendor_attributes.data

QualysDeviceVendorData · object

Vendor specific data

QualysDeviceVendorData
TenableDeviceVendorData
OrcaResourceVendorAttributesData

Show child attributes

items.resource.vendor_attributes.data.vendor

enum<string>

required

Available options:

qualys

Allowed value: "qualys"

items.resource.vendor_attributes.data.host_id

string

required

items.resource.vendor_attributes.data.asset_id

string | null

items.resource.vendor_attributes.data.tracking_method

string | null

items.resource.tags

ResourceTag · object[] | null

List of arbitrary tags/metadata for the resource

Show child attributes

items.resource.tags.key

string

required

items.resource.tags.value

string

required

items.resource.tags.source

enum<string>

required

Available options:

wiz_vms,

gitlab,

checkmarx,

mend,

qualys,

aws,

insight_vm,

orca,

blackkite

items.resource.groups

ResourceGroup · object[] | null

Groups associated with the resource

Show child attributes

items.resource.groups.name

string

required

The name of the group.

items.resource.groups.uid

string

required

The unique identifier of the group.

items.resource.data

ResourceContainer · object

Additional data or properties about the resource

ResourceContainer
ResourceHost
ResourceImage
ResourceBranch

Show child attributes

items.resource.data.hostnames

string[] | null

List of hostnames for the container

items.resource.data.image

string | null

Container image identifier

items.resource.cloud_metadata

ResourceCloudMetadata · object

Cloud metadata for the resource

Show child attributes

items.resource.cloud_metadata.account_id

string | null

Cloud account identifier

items.resource.cloud_metadata.account_name

string | null

Cloud account name

items.resource.cloud_metadata.cloud_provider

string | null

Cloud service provider

items.resource.cloud_metadata.image_id

string | null

Cloud image identifier

items.resource.cloud_metadata.instance_id

string | null

Cloud instance identifier

items.resource.cloud_metadata.instance_type

string | null

Type of cloud instance

items.resource.cloud_metadata.region

string | null

Cloud region

items.resource.cloud_metadata.subnet_id

string | null

Cloud subnet identifier

items.resource.cloud_metadata.vpc_id

string | null

Cloud VPC identifier

items.resource.url

string | null

URL associated with the resource

items.resource.first_seen

string<date-time> | null

Timestamp when the resource was first seen

items.resource.last_seen

string<date-time> | null

Timestamp when the resource was last seen

items.cvss_base_score

number | null

default:CVSS base score

items.severity

enum<string>

default:none

Available options:

critical,

high,

medium,

low,

info,

none

items.state

enum<string>

default:open

Available options:

open,

closed,

reopened,

ignored,

deleted

items.vulnerability_url

string | null

URL to the vulnerability details, provided by the upstream vendor

items.vendor_data

Vendor Data · object

Vendor specific pass through data, values can vary based on vendor

total

integer | null

Total number of items that can be returned

VMS Connectors Get Vulnerability by ID

⌘I

API Documentation

AppSec

EDR

VMS

CSPM

Identity Provider (IDP)

TPRM

GRC

ITSM

Entities

Configuration

Provisioning

Connectors

OnRamp

Enrichments

Outbound Jobs

Authorizations

Query Parameters

Response