Recast Rules

The following methods allow for interaction with the Tenable Vulnerability Management Recast Rules API endpoints.

Methods available on tio.recast_rules:

class RecastRulesAPI(api: APISession)

Manage Tenable Vulnerability Management recast rules.

Access this API through tio.recast_rules. Rule values and search filters are passed to the API as dictionaries.

create(resource_type: str, rule_value: dict[str, Any], rule_name: str | None = None, description: str | None = None, expires_at: str | None = None, disabled_details: dict[str, Any] | None = None) → dict[str, Any]

Create a recast rule.

Parameters:

• resource_type (str) – One of HOST, HOST_AUDIT, or WEBAPP.

• rule_value (dict) – Rule criteria accepted by the Recast Rules API.

• rule_name (str, optional) – Name for the rule.

• description (str, optional) – Description of the rule.

• expires_at (str, optional) – Expiration timestamp accepted by the API.

• disabled_details (dict, optional) – API-defined disabled-rule details.

Returns:

The created rule response from the API.

Return type:

dict

Examples

Create a host rule with API-defined criteria:

>>> tio.recast_rules.create('HOST', rule_value)

delete(rule_id: str) → dict[str, Any]

Delete a recast rule by UUID.

Parameters:

rule_id (str) – UUID of the rule to delete.

Returns:

The deletion response from the API.

Return type:

dict

Examples

>>> tio.recast_rules.delete('4c931fce-699c-4052-a43c-c953e71dd37b')

details(rule_id: str) → dict[str, Any]

Retrieve a recast rule by UUID.

Parameters:

rule_id (str) – UUID of the rule to retrieve.

Returns:

The rule response from the API.

Return type:

dict

Examples

>>> tio.recast_rules.details('4c931fce-699c-4052-a43c-c953e71dd37b')

edit(rule_id: str, resource_type: str, rule_value: dict[str, Any], rule_name: str | None = None, description: str | None = None, expires_at: str | None = None, disabled_details: dict[str, Any] | None = None) → dict[str, Any]

Update a recast rule by UUID.

Parameters:

• rule_id (str) – UUID of the rule to update.

• resource_type (str) – One of HOST, HOST_AUDIT, or WEBAPP.

• rule_value (dict) – Rule criteria accepted by the Recast Rules API.

• rule_name (str, optional) – Name for the rule.

• description (str, optional) – Description of the rule.

• expires_at (str, optional) – Expiration timestamp accepted by the API.

• disabled_details (dict, optional) – API-defined disabled-rule details.

Returns:

The updated rule response from the API.

Return type:

dict

Examples

>>> tio.recast_rules.edit(
...     '4c931fce-699c-4052-a43c-c953e71dd37b', 'HOST', rule_value
... )

filters() → dict[str, Any]

Retrieve the filters available for recast rule searches.

Returns:

The filter definitions returned by the API.

Return type:

dict

Examples

>>> tio.recast_rules.filters()

search(resource_type: list[str] | None = None, filter: dict[str, Any] | None = None, limit: int = 100, sort: list[str] | None = None, next: str | None = None) → dict[str, Any]

Search recast rules using the API’s search endpoint.

Parameters:

• resource_type (list, optional) – Resource types to search. Each must be HOST, HOST_AUDIT, or WEBAPP.

• filter (dict, optional) – API-defined search filter.

• limit (int, optional) – Maximum rules to request, from 1 to 500. Defaults to 100.

• sort (list, optional) – API-defined sort expressions.

• next (str, optional) – Pagination cursor from an earlier response.

Returns:

The search response, including any pagination data supplied by the API.

Return type:

dict

Examples

Request up to 25 host rules:

>>> tio.recast_rules.search(resource_type=['HOST'], limit=25)