List Tenable audit-log events for a date range, with optional filters.

Pagination is handled internally (the next cursor is followed automatically) up to a safety cap of 20 pages / 100k events per call; if the cap is hit, pagination.next_token is returned so the next call resumes exactly where this one stopped. Every event is normalised, tagged with an access type (API key vs UI session), and has credential-looking field values redacted to their last 4 characters.

Args: date_from: Start of the window, ISO-8601 (e.g. "2024-01-01" or "2024-01-01T00:00:00Z"). Inclusive. date_to: End of the window, ISO-8601. Inclusive. actor_id: Optional actor UUID to filter on (actor_id.eq). action: Optional exact action name, e.g. "user.create" (action.eq). limit: Page size sent to the API (1-5000). next_token: Opaque cursor from a previous call, to resume pagination.

Returns: A dict with events (classified, redacted), a summary rollup of those events, and a pagination block.

Summarise all audit-log activity in a window (counts computed in Python).

Returns event counts by actor, by action, by CRUD type and by access type, plus failure and anonymous rates - all pre-computed. Use these numbers directly; do not re-derive them from raw events.

Args: date_from: Start of the window, ISO-8601. Inclusive. date_to: End of the window, ISO-8601. Inclusive.

Returns: A dict with a summary block (total_events, by_actor, by_action, by_crud, by_access_type, failure_rate_pct, top_failed_actions) and a pagination block describing coverage.

Report API-key-driven activity per actor (UI/session activity excluded).

Events are classified as API-key driven using the audit event's access/auth-method field, falling back to user-agent shape (scripted client vs browser). Each actor gets an action breakdown, distinct source IPs, and first/last seen timestamps - all pre-aggregated.

Args: actor_id: Optional actor UUID. Omit to cover every actor with API-key activity in the window. date_from: Start of the window, ISO-8601. Defaults to 30 days ago. date_to: End of the window, ISO-8601. Defaults to now.

Returns: A dict with actors (per-actor API-key usage profiles), an access_type_totals breakdown for context, and coverage metadata.

Compare a window against each actor's stored baseline and flag outliers.

Checks run: previously unseen actor, event volume above SPIKE_MULTIPLIER x the actor's historical daily average, source IPs absent from the baseline lookback, failed-event bursts, sustained high failure rate, off-hours activity spikes, and never-before-seen action types. Every finding includes the observed value, the threshold crossed, and a reasoning sentence.

Baselines live in the local SQLite state file and are refreshed from the period immediately preceding the window when they are stale. Events in the analysed window itself are not folded into the baseline, so re-running the same window yields the same findings.

Args: date_from: Start of the window under investigation, ISO-8601. date_to: End of the window under investigation, ISO-8601. baseline_days: Days of history preceding the window to baseline against.

Returns: A dict with findings (severity-ordered, each with evidence and reasoning), findings_by_type/findings_by_severity counts, and the active thresholds.

Full historical view of one actor: roles, actions, access types, IPs.

Combines a fresh audit-log fetch for the actor with everything previously persisted in the local state database, so IPs and actions seen in earlier sessions still show up. The Tenable role is resolved on a best-effort basis from the user directory and is omitted when the API keys cannot list users.

Args: actor_id: The actor UUID (as it appears in actor.id on events). lookback_days: How far back to fetch fresh events for this actor.

Returns: A dict with identity, recent_activity (rollup over the lookback window), lifetime (accumulated state: all IPs, all actions, all access types, first/last seen) and pagination.

Verify the configured API keys can actually read the audit log.

Makes one minimal audit-log request and reports pass/fail with a plain explanation and remediation steps. Run this first when another tool returns an authentication or permission error. No secret material is echoed - the access key is shown with only its last 4 characters.

Returns: A dict with ok, a human-readable message, remediation when failing, plus configuration and local-state diagnostics.