Check what references an object before changing it
list_policy_relationshipsIdentify live detection policies affected by changing a shared object like an asset group or baseline. Run this before edits to avoid silent coverage changes.
Instructions
Answers 'what breaks if I change this?' — the impact check to run BEFORE any write that touches a shared object (asset group, schedule group, port/protocol group, baseline).
Tenable OT's policy mutations are FULL REPLACES, so an edit lands completely and silently. If a live detection policy scopes to the group you're about to archive or re-scope, that policy's coverage changes with no warning. This tool surfaces those dependants first.
kind selects the relationship:
• policies_containing — policies that CONTAIN the given object id (needs target_id)
• used_in_policies — policies that USE the given object id (needs target_id). Tenable exposes both directions; check both when the answer matters.
• baseline_policies — policies bound to the network baseline (no id needed)
• ids_rules — the IDS rule catalogue with SIDs, classifications and enabled state (no id needed)
The impact block gives the verdict: how many referencing policies are actually LIVE (not disabled/archived/paused), and their titles. An archived policy referencing the object is not a reason to hold back; a live one is.
READ-ONLY.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | Yes | ||
| after | No | ||
| limit | No | ||
| target_id | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||