get_actor_profile
Retrieve a full historical profile for any actor, combining fresh audit-log events with previously stored data to show all roles, actions, access types, and IPs across sessions.
Instructions
Full historical view of one actor: roles, actions, access types, IPs.
Combines a fresh audit-log fetch for the actor with everything previously persisted in the local state database, so IPs and actions seen in earlier sessions still show up. The Tenable role is resolved on a best-effort basis from the user directory and is omitted when the API keys cannot list users.
Args:
actor_id: The actor UUID (as it appears in actor.id on events).
lookback_days: How far back to fetch fresh events for this actor.
Returns:
A dict with identity, recent_activity (rollup over the lookback
window), lifetime (accumulated state: all IPs, all actions, all
access types, first/last seen) and pagination.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| actor_id | Yes | ||
| lookback_days | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||