# Tenable One Choke-Point Action Dashboard

> Turns Tenable One Attack Path Analysis data into a prioritized, self-contained HTML remediation dashboard with native Tenable scoring and a CISA KEV cross-reference for actively-exploited findings on choke points

- Type: Skill
- Author: arnzg
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-07-17
- Source repository: https://github.com/arnzg/apa-chokepoint-analysis
- Repo state: not archived
- Last push: 2026-07-10T16:28:43Z
- Stars: 2 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: HTML
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, Tenable Hexa AI MCP
- Domains: vulnerability-management, threat-intelligence
- Tags: tenable-one, exposure-management, attack-path-analysis, choke-points, vuln-management, threat-intelligence, cisa-kev, ransomware, dashboard, claude-code
- Date added: 2026-07-10
- Works with the Tenable Hexa AI MCP server: yes
- Compatible platforms: Claude Code
- Invocation: `/tenable-chokepoint-actions`
- Listing page: https://exchange.tenable.com/skills/tenable-chokepoint-actions
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/tenable-chokepoint-actions.md

A Claude Code skill that converts Tenable One (Exposure Management) Attack Path Analysis data into an actionable HTML dashboard centered on **choke points** — the assets, identities, groups, and OT devices that the most attack paths pass through — and flags **actively-exploited weaknesses** on those choke points using the CISA Known Exploited Vulnerabilities catalog.

## What it does

- Detects the Tenable One instance with computed APA data and pulls choke-point assets via the connected Tenable MCP server.
- Ranks choke points using **native Tenable scoring** — AES (Asset Exposure Score), ACR (Asset Criticality Rating), and APA path tier — no invented composite score.
- Computes shared-weakness blast radius and resolves every affected asset/account name so each remediation row shows exactly who to fix.
- Cross-references findings against the **CISA KEV** catalog, flagging actively-exploited and ransomware-linked weaknesses; surfaces those that hit choke points as urgent priority.
- Surfaces identity and OT choke points with class-aware remediation (the choke-point table is filterable by type — Device, Identity, OT, Application), intersects them with crown-jewel assets, renders an interactive attack-path map of the real APA topology, and writes everything into a single offline HTML file with an executive summary, a 🔴 Actively Exploited section (with CVEs, CISA-KEV dates, and VPR backfilled from plugin data), choke-point landscape, practitioner remediation queue, and CSV export.

## How it works

Invoke it from within Claude Code with a Tenable MCP server connected. It runs read-only inventory queries (MCP or REST), pulls the KEV feed once at generation time, scores choke points per the documented methodology, and writes a self-contained dashboard to `./chokepoint-output/`. The dashboard itself is fully offline — no CDNs, no network calls. The skill is explicit about provenance: native Tenable scores are exact, blast radius and choke-point intersections are computed from the asset↔finding map, and KEV flags come from a verified `finding_cves` filter match. If the KEV feed is unreachable (TLS-intercepting proxy, offline), the urgent section is gracefully omitted while the rest of the dashboard generates.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/tenable-chokepoint-actions.json. The full index and how to read it: https://exchange.tenable.com/llms.txt