# Tenable IE Change Attribution

> Names the actor behind Tenable IE's Active Directory findings by correlating them with DC Security logs, via MCP.

- Type: MCP server
- Author: hatumus
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-09-03
- Source repository: https://github.com/hatumus/tenable-ie-change-attribution
- Repo state: not archived
- Last push: 2026-08-28T11:16:50Z
- Stars: 3 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable
- Domains: identity-access, security-operations
- Tags: active-directory, identity-exposure, incident-response, threat-hunting, attribution, windows-event-log, mcp
- Date added: 2026-09-02
- Transport: stdio
- Runtime: python
- Auth method: api-key
- Compatible clients: Claude Code, Claude Desktop
- Tools:
  - `who_caused_deviances`: Pull Tenable IE deviances (IoE security findings) and attribute each to the actor in the DC Security log.
  - `attribute_ie_window`: Pull IE Trail Flow changes in a time range and attribute each to the DC actor who made them, paginating past the API's 500-event page cap.
  - `attribute_change`: Attribute a single AD change (by DN / objectSid / objectGUID / sAMAccountName + timestamp) to its actor.
  - `attribute_trailflow_event`: Attribute a single Trail Flow event by its numeric event id to the DC-log actor who made it.
  - `query_dc_log`: Query the DC Security event log directly over WinRM, bypassing Tenable IE, for ad-hoc investigation.
- Listing page: https://exchange.tenable.com/mcp-servers/ie-change-attribution
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/ie-change-attribution.md

Tenable Identity Exposure detects Active Directory changes but doesn't know who made them — deviances derive from AD replication metadata, which carries no actor identity. This MCP server closes that gap by correlating IE deviances and Trail Flow events with the Domain Controller's Security event log, matching on object identity (objectSid/objectGUID > DN > sAMAccountName) within a time window, and returning the actor with a confidence score.

## What it does

- Attributes IE deviances (IoE findings) and Trail Flow events to the DC-log actor who caused them
- Scores confidence as high / medium / low / ambiguous / none — a `none` rate surfaces DC audit-coverage gaps rather than claiming "no actor"
- Queries the DC Security log directly, bypassing IE, for ad-hoc investigation
- Runs agentless: reads the DC remotely over WinRM or SSH, nothing installed on the DC
- Ships as a dependency-free MCP server that implements the JSON-RPC handshake directly, with no FastMCP or pydantic dependency required

## How it works

It pulls changes from Tenable IE's REST v3 API (deviances endpoint and `/api/events/search` for Trail Flow), then joins each one against the Windows Security event log entries that carry `SubjectUserName`/`SubjectUserSid` (event IDs such as 4720/4728/4732/5136), reporting the best-matching actor and supporting evidence. A CLI mode also supports offline verification against exported IE data, with no live DC or IE connection required.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/mcp-servers/ie-change-attribution.json. The full index and how to read it: https://exchange.tenable.com/llms.txt