# Tenable Plugin Lookup

> Query Tenable Security Center by plugin ID — deep per-host lookup for one plugin, or bulk present/not-found check across many plugins. Read-only.

- Type: Skill
- Author: conard0-git
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Source repository: https://github.com/conard0-git/tenable-plugin-lookup
- Repo state: not archived
- Last push: 2026-08-13T16:32:05Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: AWS, Tenable
- Domains: platform-operations, vulnerability-management
- Tags: tenable, security-center, plugin-lookup, vulnerability-lookup, poam, audit-qc, aws, ec2
- Date added: 2026-08-07
- Compatible platforms: Claude Code
- Invocation: `/tenable-plugin-lookup`
- Listing page: https://exchange.tenable.com/skills/tenable-plugin-lookup
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/tenable-plugin-lookup.md

Two modes over one primitive — querying **Tenable Security Center** by
plugin ID via the `analysis.vulns` API, filtered by repository. Pick the
mode by intent: **host lookup** answers "who is affected by this
plugin/CVE?" and **presence check** answers "are these plugins detected at
all?" — the everyday POA&M / audit QC question. Both modes are read-only
against Tenable and only optionally read AWS for enrichment; nothing is
ever modified.

## What it does

- **Host lookup — one plugin, deep.** Run an `analysis.vulns` query with
  `tool = "vulndetails"` filtered by `repositoryIDs` and `pluginID`,
  sorted by last-seen descending. Collect per-host detail (IP, plugin
  name, severity, DNS/NetBIOS, last seen, cleaned plugin output) and
  de-duplicate by (Tenable instance, IP) keeping the most recent record —
  a host in multiple repos on one console merges to a single row.
- **Optional AWS enrichment (host lookup).** For each host IP, resolve
  the matching EC2 instance and attach owning-team tag, instance Name,
  profile, region, VPC, and instance ID. Flag anomalies: instance not
  running, not found in AWS (likely decommissioned), or **possible IP
  reuse** when the instance's launch time is *after* the plugin's last-
  seen date. Rows without a cloud match are tagged Tenable-only.
- **Presence check — many plugins, shallow.** For each plugin ID × each
  repository, run `analysis.vulns` with `tool = "sumip"` — a lightweight
  summary-by-IP query that returns a host count without pulling every
  finding. Aggregate present-yes-if-found-anywhere, total host count, and
  repositories-found for each plugin.
- **CSV + console output.** Host-lookup produces a triage-ordered CSV
  (alerts and anomalous hosts first, then by team, name, IP) plus a
  console table. Presence check produces a CSV matrix
  (`plugin_id, present, host_count, repos_found, plugin_name`) plus a
  console summary.

## How it works

The skill's guarantee is that both modes are **read-only** — no writes to
Tenable, no changes to hosts or agents, ever. Mode choice is driven by
the right query tool: `vulndetails` when you need per-host detail,
`sumip` when you only need presence and counts (much lighter on the API).
Per-repository failures are non-fatal — one unreachable source logs a
warning and the run continues so a partial answer is still returned.
Configuration is entirely environment-variable driven — Security Center
URL + keys, repository IDs, optional AWS credentials/region — with no
config files, hardcoded secrets, hostnames, or repository IDs. See
`SKILL.md` for the full workflow, `references/host-lookup.md` for the
Mode 1 query mechanics + enrichment logic, and
`references/presence-check.md` for the Mode 2 aggregation logic.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/tenable-plugin-lookup.json. The full index and how to read it: https://exchange.tenable.com/llms.txt