Tenable One Choke-Point Action Dashboard

A Claude Code skill that converts Tenable One (Exposure Management) Attack Path Analysis data into an actionable HTML dashboard centered on choke points — the assets, identities, groups, and OT devices that the most attack paths pass through — and flags actively-exploited weaknesses on those choke points using the CISA Known Exploited Vulnerabilities catalog.

What it does

• Detects the Tenable One instance with computed APA data and pulls choke-point assets via the connected Tenable MCP server.
• Ranks choke points using native Tenable scoring — AES (Asset Exposure Score), ACR (Asset Criticality Rating), and APA path tier — no invented composite score.
• Computes shared-weakness blast radius and resolves every affected asset/account name so each remediation row shows exactly who to fix.
• Cross-references findings against the CISA KEV catalog, flagging actively-exploited and ransomware-linked weaknesses; surfaces those that hit choke points as urgent priority.
• Surfaces identity and OT choke points with class-aware remediation (the choke-point table is filterable by type — Device, Identity, OT, Application), intersects them with crown-jewel assets, renders an interactive attack-path map of the real APA topology, and writes everything into a single offline HTML file with an executive summary, a 🔴 Actively Exploited section (with CVEs, CISA-KEV dates, and VPR backfilled from plugin data), choke-point landscape, practitioner remediation queue, and CSV export.

How it works

Invoke it from within Claude Code with a Tenable MCP server connected. It runs read-only inventory queries (MCP or REST), pulls the KEV feed once at generation time, scores choke points per the documented methodology, and writes a self-contained dashboard to ./chokepoint-output/. The dashboard itself is fully offline — no CDNs, no network calls. The skill is explicit about provenance: native Tenable scores are exact, blast radius and choke-point intersections are computed from the asset↔finding map, and KEV flags come from a verified finding_cves filter match. If the KEV feed is unreachable (TLS-intercepting proxy, offline), the urgent section is gracefully omitted while the rest of the dashboard generates.