> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leen.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# VMS Integrations

> Information about the VMS integrations available in Leen. Find out which fields are supported by each integration and how to configure them.

## Supported Fields

| Leen Model | Tenable | Qualys | Rapid7 | CrowdStrike Spotlight | SentinelOne VMS | Microsoft Defender VM | AWS Inspector2 | Wiz | Available through enrichment |
| - | - | - | - | - | - | - | - | - | - |
| `category` | ✅ | ✅ | ✅ | ✅ | | ✅ | ✅ | | |
| `cert_id` | | | | | | | | | ✅ |
| `cve` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| `cvss_base_score` | ✅ | ✅ | ✅ | ✅ | | ✅ | ✅ | | |
| `cvss_temporal_score` | ✅ | | | | | | | | ✅ |
| `cvss_temporal_vector` | ✅ | | | | | | | | ✅ |
| `cvss_vector` | ✅ | ✅ | ✅ | ✅ | | ✅ | ✅ | | |
| `description` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| `device` (see [Entities](/api-reference/entities)) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| `exploitable` | ✅ | ✅ | ✅ | ✅ | | ✅ | ✅ | ✅ | |
| `first_seen` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| `id` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| `last_seen` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| `name` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| `patchable` | ✅ | ✅ | ✅ | ✅ | | | ✅ | | |
| `port` | ✅ | ✅ | ✅ | | | | | | |
| `protocol` | ✅ | ✅ | ✅ | | | | | | |
| `reachability` | | | | | | | | | |
| `scan_output` | ✅ | ✅ | ✅ | | ✅ | | | | |
| `service` | ✅ | | | | ✅ | | | | |
| `severity` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| `solution` | ✅ | | ✅ | ✅ | | ✅ | ✅ | ✅ | |
| `state` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| `state_updated_at` | ✅ | ✅ | ✅ | ✅ | | ✅ | ✅ | ✅ | |
| `vulnerability_url` | ✅ | ✅ | | | ✅ | ✅ | ✅ | ✅ | |
| `vendor` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| `vendor_id` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| `vendor_scan_id` | ✅ | | | | | | | | |
| `vendor_severity` | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |
| `vendor_data` (Additional vendor specific data) | | ✅ | | | | ✅ | ✅ | | |

`exploitable` and `reachability` are on the vulnerability model and accepted as filters on [List Vulnerabilities](/api-reference/vms/get-vulnerabilities). Every connector above except SentinelOne VMS now reports `exploitable`, each from its own vendor's exploit signal — the `notes` in the `capabilities` block say which, and they differ: Tenable's `exploit_available`, Wiz's known-exploit and CISA KEV flags, AWS Inspector's exploit-available assertion. `reachability` is a different question — whether the vulnerable code is called — which no VMS vendor answers, so it stays `null` on every record and matches no filter value.

Both are tri-state: a record the vendor did not assess carries `null` and matches neither filter value. The `capabilities` block on [List Integration Details](/api-reference/integration-details/list-integration-details#filter-capabilities) declares support per integration and carries those notes, along with the values each vendor emits for `severity`, `state` and `category`, and whether it populates `port`, `protocol` and `cve`.

For any additional information about our field mappings or integrations please contact us.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.