List Vulnerabilities

GET

vms

vulnerabilities

curl --request GET \
  --url https://api.leen.dev/v1/vms/vulnerabilities \
  --header 'X-API-KEY: <api-key>' \
  --header 'X-CONNECTION-ID: <api-key>'

{
  "count": 123,
  "total": 123,
  "items": [
    {
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "device": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "status": "active",
        "platform": "mac",
        "hostnames": [
          "<string>"
        ],
        "os_version": "<string>",
        "os_major_version": "<string>",
        "os_minor_version": "<string>",
        "fqdns": [
          "<string>"
        ],
        "ipv4s": [
          "<string>"
        ],
        "ipv6s": [
          "<string>"
        ],
        "mac_addresses": [
          "<string>"
        ],
        "last_seen": "2023-11-07T05:31:56Z",
        "first_seen": "2023-11-07T05:31:56Z",
        "source_vendors": [
          {
            "vendor": "<string>",
            "vendor_id": "<string>",
            "agent_info": {
              "agent_version": "<string>",
              "signature_version": "<string>",
              "policies": [
                {}
              ]
            }
          }
        ],
        "installed_software": [
          "<string>"
        ],
        "ad_info": {
          "org_unit": "<string>",
          "site_name": "<string>",
          "domain": "<string>",
          "device_id": "<string>"
        },
        "cloud_metadata": {
          "cloud_provider": "aws",
          "account_id": "<string>",
          "region": "<string>",
          "availability_zone": "<string>",
          "instance_id": "<string>",
          "instance_type": "<string>",
          "image_id": "<string>",
          "kernel_id": "<string>",
          "vpc_id": "<string>",
          "subnet_id": "<string>"
        },
        "tags": [
          {
            "key": "<string>",
            "value": "<string>",
            "source": "aws"
          }
        ],
        "identities": [
          {
            "username": "<string>",
            "user_sid": "<string>"
          }
        ],
        "vendor_data": {}
      },
      "resource": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "name": "<string>",
        "uid": "<string>",
        "tags": [
          {
            "key": "<string>",
            "value": "<string>",
            "source": "wiz_vms"
          }
        ],
        "type": "branch",
        "groups": [
          {
            "name": "<string>",
            "uid": "<string>"
          }
        ],
        "data": {
          "hostnames": [
            "<string>"
          ],
          "image": "<string>",
          "url": "<string>",
          "type": "container"
        },
        "cloud_metadata": {
          "account_id": "<string>",
          "account_name": "<string>",
          "cloud_provider": "<string>",
          "image_id": "<string>",
          "instance_id": "<string>",
          "instance_type": "<string>",
          "region": "<string>",
          "subnet_id": "<string>",
          "vpc_id": "<string>"
        },
        "url": "<string>",
        "vendor": "<string>",
        "vendor_id": "<string>"
      },
      "name": "<string>",
      "description": "<string>",
      "scan_output": "<string>",
      "cve": [
        "<string>"
      ],
      "cvss_version": "<string>",
      "cvss_base_score": 123,
      "cvss_vector": "<string>",
      "cvss_temporal_score": 123,
      "cvss_temporal_vector": "<string>",
      "cert_id": "<string>",
      "port": 123,
      "protocol": "<string>",
      "service": "<string>",
      "severity": "critical",
      "first_seen": "2023-11-07T05:31:56Z",
      "last_seen": "2023-11-07T05:31:56Z",
      "state": "open",
      "state_updated_at": "2023-11-07T05:31:56Z",
      "patchable": true,
      "solution": "<string>",
      "category": "web",
      "vulnerability_url": "<string>",
      "vendor": "tenable",
      "vendor_id": "<string>",
      "vendor_severity": "<string>",
      "vendor_scan_id": "<string>",
      "vendor_data": {}
    }
  ]
}

Authorizations

X-CONNECTION-ID

string

header

required

X-API-KEY

string

header

required

Query Parameters

sort

string | null

Sort by field

stateUpdatedSince

string | null

Datetime filter, only return vulnerabilites where the state was updated since this datetime. Example format: 2021-01-01T00:00:00+00:00

firstSeenSince

string | null

Datetime filter, only return vulnerabilites where the first seen since this datetime. Example format: 2021-01-01T00:00:00+00:00

lastSeenSince

string | null

Datetime filter, only return vulnerabilites where the last seen since this datetime. Example format: 2021-01-01T00:00:00+00:00

deviceId

string | null

Device ID Filter, comma separated

resourceId

string | null

Resource ID Filter, comma separated

severity

string | null

Vulnerability severity filter, comma separated

state

string | null

Vulnerability state filter, comma separated

port

string | null

Port number filter, comma separated

protocol

string | null

Protocol filter, comma separated

Response

200

application/json

Successful Response

count

integer

required

Number of items return in the response

items

object[]

required

List of items returned in the response

items.id

string

required

Leen's UUID for the vulnerability

items.name

string

required

Name of vulnerability, provided by the upstream vendor

items.description

string

required

Description of vulnerability, provided by the upstream vendor

items.scan_output

string | null

required

Scan output that was provided when detected on the device

items.cve

string[] | null

required

List of CVEs associated with the vulnerability

items.cvss_version

string | null

required

CVSS version

items.cvss_vector

string | null

required

CVSS vector uses cvss3 when available, provided by the upstream vendor

items.cvss_temporal_score

number | null

required

CVSS temporal score

items.cvss_temporal_vector

string | null

required

CVSS temporal vector

items.cert_id

string | null

required

Corresponds to an identifier in the vulnerability database provided by the US Computer Emergency Readiness Team (US-CERT)

items.port

integer | null

required

Port number of the vulnerability that was detected

items.protocol

string | null

required

Protocol of the vulnerability that was detected, example: tcp

items.service

string | null

required

Service of the vulnerability that was detected, example: http

items.first_seen

string | null

required

First detection date

items.last_seen

string | null

required

Last detection date

items.state_updated_at

string | null

required

The last time the state was updated

items.patchable

boolean | null

required

A patch is available

items.solution

string | null

required

Solution for the vulnerability, provided by upstream vendor

items.category

enum<string> | null

required

Vulnerability category

Available options:

web,

network,

database,

application,

os,

other,

general,

attack_vector

items.vendor

enum<string>

required

Source vendor

Available options:

tenable,

qualys,

snyk,

insightvm,

crowdstrike_spotlight,

sentinelone_vms,

MS_DEFENDER_VMS,

WIZ_VMS,

AWS_INSPECTOR2

items.vendor_id

string | null

required

Vendor's ID of the vulnerability

items.vendor_severity

string | null

required

Passthrough value of severity

items.vendor_scan_id

string | null

required

Vendor's ID of the scan that detected the

items.device

object | null

Device attached to the vulnerability, include device groups with includeDeviceGroups query parameter

items.device.id

string

required

items.device.status

enum<string>

required

Available options:

active,

offline,

quarantined,

unknown,

deleted

items.device.last_seen

string | null

required

items.device.first_seen

string | null

required

items.device.source_vendors

object[]

required

items.device.installed_software

string[] | null

required

items.device.ad_info

object | null

required

items.device.platform

enum<string> | null

Available options:

mac,

windows,

linux,

unknown

items.device.hostnames

string[] | null

items.device.os_version

string | null

items.device.os_major_version

string | null

items.device.os_minor_version

string | null

items.device.fqdns

string[] | null

items.device.ipv4s

string[] | null

items.device.ipv6s

string[] | null

items.device.mac_addresses

string[] | null

items.device.cloud_metadata

object | null

CloudMetadata, currently only AWS is supported

items.device.tags

object[] | null

items.device.identities

object[] | null

items.device.vendor_data

object | null

Vendor specific pass through data, values can vary based on vendor

items.resource

object | null

Resource attached to the vulnerability

items.resource.id

string

required

Leen's UUID for the resource

items.resource.name

string

required

Resource name

items.resource.uid

string

required

Unique identifier (vendor/system ID) for the resource

items.resource.type

enum<string>

required

Type of the resource

Available options:

branch,

host,

container,

dependency,

repo,

image,

unknown

items.resource.vendor

string

required

The source vendor of the resource

items.resource.vendor_id

string

required

The vendor-specific or external ID associated with this resource

items.resource.tags

object[] | null

List of arbitrary tags/metadata for the resource

items.resource.groups

object[] | null

Groups associated with the resource

ORM model representing a groups in a resource.

items.resource.data

object | null

Additional data or properties about the resource

items.resource.cloud_metadata

object | null

Cloud metadata for the resource

items.resource.url

string | null

URL associated with the resource

items.cvss_base_score

number | null

default:CVSS base score

items.severity

enum<string>

default:none

Available options:

critical,

high,

medium,

low,

info,

none

items.state

enum<string>

default:open

Available options:

open,

closed,

reopened,

ignored,

deleted

items.vulnerability_url

string | null

URL to the vulnerability details, provided by the upstream vendor

items.vendor_data

object | null

Vendor specific pass through data, values can vary based on vendor

total

integer | null

Total number of items that can be returned

VMS Connectors Get Vulnerability by ID

curl --request GET \
  --url https://api.leen.dev/v1/vms/vulnerabilities \
  --header 'X-API-KEY: <api-key>' \
  --header 'X-CONNECTION-ID: <api-key>'

{
  "count": 123,
  "total": 123,
  "items": [
    {
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "device": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "status": "active",
        "platform": "mac",
        "hostnames": [
          "<string>"
        ],
        "os_version": "<string>",
        "os_major_version": "<string>",
        "os_minor_version": "<string>",
        "fqdns": [
          "<string>"
        ],
        "ipv4s": [
          "<string>"
        ],
        "ipv6s": [
          "<string>"
        ],
        "mac_addresses": [
          "<string>"
        ],
        "last_seen": "2023-11-07T05:31:56Z",
        "first_seen": "2023-11-07T05:31:56Z",
        "source_vendors": [
          {
            "vendor": "<string>",
            "vendor_id": "<string>",
            "agent_info": {
              "agent_version": "<string>",
              "signature_version": "<string>",
              "policies": [
                {}
              ]
            }
          }
        ],
        "installed_software": [
          "<string>"
        ],
        "ad_info": {
          "org_unit": "<string>",
          "site_name": "<string>",
          "domain": "<string>",
          "device_id": "<string>"
        },
        "cloud_metadata": {
          "cloud_provider": "aws",
          "account_id": "<string>",
          "region": "<string>",
          "availability_zone": "<string>",
          "instance_id": "<string>",
          "instance_type": "<string>",
          "image_id": "<string>",
          "kernel_id": "<string>",
          "vpc_id": "<string>",
          "subnet_id": "<string>"
        },
        "tags": [
          {
            "key": "<string>",
            "value": "<string>",
            "source": "aws"
          }
        ],
        "identities": [
          {
            "username": "<string>",
            "user_sid": "<string>"
          }
        ],
        "vendor_data": {}
      },
      "resource": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "name": "<string>",
        "uid": "<string>",
        "tags": [
          {
            "key": "<string>",
            "value": "<string>",
            "source": "wiz_vms"
          }
        ],
        "type": "branch",
        "groups": [
          {
            "name": "<string>",
            "uid": "<string>"
          }
        ],
        "data": {
          "hostnames": [
            "<string>"
          ],
          "image": "<string>",
          "url": "<string>",
          "type": "container"
        },
        "cloud_metadata": {
          "account_id": "<string>",
          "account_name": "<string>",
          "cloud_provider": "<string>",
          "image_id": "<string>",
          "instance_id": "<string>",
          "instance_type": "<string>",
          "region": "<string>",
          "subnet_id": "<string>",
          "vpc_id": "<string>"
        },
        "url": "<string>",
        "vendor": "<string>",
        "vendor_id": "<string>"
      },
      "name": "<string>",
      "description": "<string>",
      "scan_output": "<string>",
      "cve": [
        "<string>"
      ],
      "cvss_version": "<string>",
      "cvss_base_score": 123,
      "cvss_vector": "<string>",
      "cvss_temporal_score": 123,
      "cvss_temporal_vector": "<string>",
      "cert_id": "<string>",
      "port": 123,
      "protocol": "<string>",
      "service": "<string>",
      "severity": "critical",
      "first_seen": "2023-11-07T05:31:56Z",
      "last_seen": "2023-11-07T05:31:56Z",
      "state": "open",
      "state_updated_at": "2023-11-07T05:31:56Z",
      "patchable": true,
      "solution": "<string>",
      "category": "web",
      "vulnerability_url": "<string>",
      "vendor": "tenable",
      "vendor_id": "<string>",
      "vendor_severity": "<string>",
      "vendor_scan_id": "<string>",
      "vendor_data": {}
    }
  ]
}

API Documentation

AppSec

EDR

VMS

CSPM

Identity Provider (IDP)

Entities

Configuration

Provisioning

Connectors

OnRamp

Enrichments

Authorizations

Query Parameters

Response