List all available Tenable Identity Exposure API resources and their paths.

Call this first to discover what resources exist before using other tools.

Make a direct HTTP call to any Tenable Identity Exposure API endpoint.

Only server-relative paths are accepted; absolute URLs are refused so the API key cannot be sent to another host. Non-GET methods require the server to have been started with --allow-writes. Credential endpoints are refused for every method, including GET.

Args: method: HTTP method (GET, POST, PUT, PATCH, DELETE). path: API path, e.g. "/api/directories" or "/api/attacks/123". params: Optional query string parameters as a dict. body: Optional request body as a dict (used with POST/PUT/PATCH).

Returns: Parsed JSON response from the TIE API.

Perform CRUD operations on a TIE resource.

Args: resource: Resource name from tie_catalog (e.g. "directories", "attacks", "users"). action: Operation — list, get, create, update, or delete. id: Resource ID for get/update/delete operations. body: Request body for create/update operations. params: Optional query parameters (e.g. pagination, filters).

Writes (create/update/delete) require the server to have been started with --allow-writes, and are refused outright for protected resources such as users, roles, the authentication settings, and the monitored AD topology. Credential resources are refused for every action, including list/get.

Examples: List all directories: resource="directories", action="list" Get directory #5: resource="directories", action="get", id=5 List recent attacks: resource="attacks", action="list", params={"page": 1} Create a dashboard: resource="dashboards", action="create", body={...}

List IoE deviances for a given checker within a profile (full detail, no date filter).

For a time-bounded view use tie_deviances(hours=...) or tie_recent_activity instead. The TIE API models this as a POST with a filter expression body; an empty expression returns all deviances for the checker.

Args: checker_id: IoE checker id (see tie_resource_action resource="checkers"). profile_id: Security profile id (default 1). page: Page number (1-based). per_page: Results per page. expression: Optional filter expression object. Defaults to {} (no filter). verbose: If False (default), render descriptions and drop giant attribute values to save tokens. Set True for the full raw payload.

List IoE deviances for a specific directory (full detail, no date filter).

Args: infrastructure_id: Infrastructure (forest) id — see resource="infrastructures". directory_id: Directory id — see resource="directories". page: Page number (1-based). per_page: Results per page. verbose: If False (default), render descriptions and drop giant attribute values.

Find AD objects with IoE deviances for a checker within a time window.

This is the time-filterable deviance query (server-side dateStart/dateEnd via the checker's ad-objects/search endpoint). Provide hours for a relative window (e.g. hours=12) or explicit date_start/date_end. With neither, defaults to the last 24h.

Args: checker_id: IoE checker id (see resource="checkers"). profile_id: Security profile id (default 1). Note: your console may use a non-default profile — call tie_profiles to list them. directory_ids: Restrict to these directory ids (default: all directories in scope). hours: Relative look-back window in hours (e.g. 12). Ignored if date_start given. date_start: Explicit ISO 8601 UTC start (e.g. "2026-07-07T16:00:00.000Z"). date_end: Explicit ISO 8601 UTC end (default: now). reasons: Optional reason ids to filter (see /api/profiles/{id}/checkers/{id}/reasons). show_ignored: Include deviances that are currently ignored (default False). page: Page number (1-based). per_page: Results per page. verbose: If False (default), truncate giant attribute values.

List IoA attack instances for a resource within a profile.

The TIE API requires scoping attacks to a resource. For example, to see attacks against directory id 8: resource_type="directory", resource_value="8".

Args: resource_type: What resource_value refers to — infrastructure, directory, hostname, or ip. resource_value: The id (for infrastructure/directory) or name/ip value to scope to. profile_id: Security profile id (default 1). attack_type_ids: Optional list of attack type ids to filter (e.g. DCSync, Kerberoasting). date_start: Optional ISO 8601 start of date range. date_end: Optional ISO 8601 end of date range. include_closed: Include closed attacks (default False). limit: Max results (default 50). order: Sort order by date, "desc" (newest first) or "asc". search: Optional free-text search filter.

List alerts for a security profile.

Args: profile_id: Security profile id (default 1). page: Page number (1-based). per_page: Results per page. archived: Optionally filter by archived status (True/False).

Get per-directory security scores for a profile.

Returns a list of {directoryId, score} reflecting the AD security posture (higher is better; scores reflect outstanding IoE deviances).

Args: profile_id: Security profile id (default 1).

Get the Active Directory topology (domains, forests, and trust relationships).

Args: profile_id: Security profile id (default 1).

Search AD security events within a date range.

Args: directory_ids: One or more directory ids to search (see resource="directories"). date_start: ISO 8601 start of range, e.g. "2026-07-01T00:00:00.000Z". date_end: ISO 8601 end of range. profile_id: Security profile id (default 1). expression: Optional filter expression object. Defaults to {} (no filter). order: Optional ordering object, e.g. {"column": "date", "direction": "desc"}.

Get the current user's identity, roles, and permissions (from the API key).

Find Active Directory objects whose name or DN contains query.

IMPORTANT: /api/ad-objects has no server-side search. It returns the last known state of every object, cursor-paginated (~1000 per page, roughly 2 MB each on a small forest). Filtering here is therefore CLIENT-SIDE, and only objects within the scanned prefix can match — raise max_scanned to widen the sweep, and read scanned/truncated in the result before concluding that something does not exist.

For deviance investigation prefer tie_deviances / tie_deviances_by_checker, which are filtered server-side.

Args: query: Substring to look for, case-insensitive. Matched against objectId and the naming attributes (cn, name, displayName, sAMAccountName, distinguishedName, userPrincipalName) — not against bulk blobs like ntSecurityDescriptor, which would produce meaningless hits. directory_id: Restrict to one directory (see resource="directories"). object_class: Substring of the objectClass attribute, e.g. "user", "computer", "group", "organizationalUnit". Note this is the LDAP objectClass; the object's own type field is the data source (LDAP or SYSVOL), not the object category. max_results: Stop after this many matches (default 50). max_scanned: Cap on objects fetched while searching (default 5000). timestamp: Optional ISO 8601 UTC point in time; defaults to now. verbose: If False (default), oversized attribute values are dropped.

Get all IoE checker definitions — essential fields only, no description blobs.

Returns id, codename, name, categoryId, and remediationCost for every checker. This is ~100x smaller than tie_resource_action resource="checkers", which embeds multi-KB description/recommendation/vulnerabilityDetail blobs per checker (~500 KB total for ~64 checkers). Use this to enumerate checkers, build a remediation plan, or map deviance checkerId values to human-readable names.

Note: TIE checkers carry remediationCost (easy/medium/hard) but no native severity/ criticality score. For AES (Asset Exposure Score) or ACR (Asset Criticality Rating) scoring, connect to Tenable One — see the README for details.

Fetch all IoE deviances in a few paginated calls (bulk alternative to per-checker fan-out).

Uses GET /api/deviances/changed with cursor pagination to pull deviances across all checkers at once — typically 1–5 API calls instead of one call per checker (~64). This is the recommended starting point for remediation-plan workflows.

Deviances include checkerId and adObjectId (numeric ID, not display name). Use tie_checkers_summary to map checkerId → checker name, and tie_search_ad_objects to resolve adObjectId → object name if needed.

Args: profile_id: Filter to a specific profile id (client-side). None = include all profiles. resolved: Include resolved/closed deviances (default False = active only). batch_size: Records per API page (default 200). max_batches: Safety cap on pagination loops (default 20 = up to 4000 records).

List security profiles (id + name).

IoE/IoA data is scoped to a profile. The console has a selected profile that the API does not expose, so pass the right profile_id explicitly to other tools.

Unified recent-activity timeline of IoE alerts and IoA attacks in one call.

Answers questions like "show me IoE/IoA in the last 12 hours". IoE is sourced from the profile's alert feed (time-ordered) and each in-window alert is enriched with its deviance detail (checker + rendered description). IoA is sourced from the attacks endpoint per directory. Results are merged and sorted newest-first. All timestamps are UTC.

Args: hours: Look-back window in hours (default 12). profile_id: Security profile id (default 1). See tie_profiles. include_ioe: Include IoE deviance alerts (default True). include_ioa: Include IoA attacks (default True). directory_ids: Restrict to these directory ids (default: all in scope). max_items: Cap on items per category — IoE and IoA are budgeted separately (default 50). The IoA cap applies across all directories, not per directory; any truncation is reported in notes. verbose: If False (default), attribute values are slimmed.