# Tenable Scan to CSV

> Download latest completed Tenable Security Center scans and emit filtered-column CSVs.

- Type: Skill
- Author: conard0-git
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-08-19
- Source repository: https://github.com/conard0-git/tenable-scan-to-csv
- Repo state: not archived
- Last push: 2026-08-14T18:18:19Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable
- Domains: platform-operations
- Tags: tenable, security-center, nessus, csv, scan-export
- Date added: 2026-08-14
- Compatible platforms: Claude Code
- Invocation: `/tenable-scan-to-csv`
- Listing page: https://exchange.tenable.com/skills/tenable-scan-to-csv
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/tenable-scan-to-csv.md

Download the latest completed instance of each caller-supplied Tenable Security Center scan, extract the `.nessus` XML, and emit filtered-column CSVs to a dated monthly directory. Idempotent by design: skips scans whose latest-dated CSV already exists and prunes older versions on rewrite.

## What it does

- Connects to a Tenable Security Center console using env-var-supplied API keys (read-only: list and download only).
- Reads a caller-supplied scan-name list and a caller-supplied column mapping. There is no baked-in column set; any Nessus field the lookup can resolve is valid.
- For each scan, finds the latest **completed** instance, skips the download if that CSV already exists, otherwise downloads the ZIP, stream-parses the `.nessus` XML, and writes `{scan}_{YYYY-MM-DD}.csv`.
- Falls back to `HOST_END` tags when the API `finishTime` is missing, so filenames always carry a real completion date.

Security Center-specific. Tenable Vulnerability Management (Tenable.io) is not targeted.

## How it works

Uses `pytenable`'s `TenableSC` client to list scan instances and `POST /rest/scanResult/{id}/download` for the ZIP. The `.nessus` XML is parsed with `iterparse` so multi-hundred-megabyte scans stay in flat memory. Each CSV column is resolved in order: ReportItem attribute → child element → host property → namespace-qualified compliance-check field.

Install by cloning into `~/.claude/skills/tenable-scan-to-csv` (or `.claude/skills/` in a project) and invoke with `/tenable-scan-to-csv`.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/tenable-scan-to-csv.json. The full index and how to read it: https://exchange.tenable.com/llms.txt