# Tenable Info Plugins

> Discover, extract, and analyze Tenable INFO-severity plugin data — processes, software, accounts, hardware, and forensic artifacts — from Tenable VM for inventory, forensics, and threat hunting.

- Type: Skill
- Author: jdavies-pub-git
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-07-16
- Source repository: https://github.com/jdavies-pub-git/tenable-info-skill
- Repo state: not archived
- Last push: 2026-07-16T20:44:30Z
- Stars: 2 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable
- Domains: security-operations, platform-operations
- Tags: tenable, vulnerability-management, info-plugins, asset-inventory, forensics, threat-hunting
- Date added: 2026-07-16
- Compatible platforms: Claude Code, Claude Desktop, Claude Cowork
- Invocation: `tenable-info-plugins`
- Listing page: https://exchange.tenable.com/skills/tenable-info-plugins
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/tenable-info-plugins.md

## What it does

Tenable scans emit findings at five severities, and the INFO-severity ones aren't
vulnerabilities — they're the detailed host telemetry a credentialed scan already
collected but that mostly goes unused: running processes, installed software and
patches, local and cached domain accounts, the last logged-on user, services and
startup items, network shares, physical hardware (CPU, memory, BIOS/model/serial via
DMI), AV/firewall status, and forensic artifacts like recycle-bin contents.

This skill teaches Claude to turn that data into answers. It handles asset inventory
(single-host profiles and fleet-wide hardware/software inventories), forensic and
threat-hunting snapshots (e.g. processes running from suspicious paths, unexpected
admin accounts, deleted-file artifacts), and a plugin-reference lookup — all from
data that already exists in the customer's Tenable Vulnerability Management deployment,
with no new scan required.

## How it works

Rather than hard-coding plugin IDs, the skill discovers the right INFO plugin at query
time via plugin search and confirms its severity before use. It reads plugin output
with the Tenable VM MCP tools for quick looks and environment-wide mining, and documents
where those tools cap out (the outputs endpoint returns only a limited, truncated set
with no host filter). For complete, untruncated results it ships a bundled Python script
that calls the Tenable.io API directly — trying pyTenable first and falling back to a
dependency-free stdlib REST call so it runs even in locked-down environments. Output is
parsed defensively into readable structures and delivered as tables, host profiles,
hunting snapshots, or CSV/HTML reports. API keys are read only from environment
variables, and CSV output is sanitized against spreadsheet formula injection since the
underlying data originates on scanned (possibly compromised) hosts.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/tenable-info-plugins.json. The full index and how to read it: https://exchange.tenable.com/llms.txt