Vulnerability Management: Offline Agent Health Event Status

Tenable has added an OFFLINE health status to the Tenable Vulnerability Management agents API, so that you can identify agents that have stopped communicating with Tenable without inferring it from a missing or unknown health value. An agent reports the OFFLINE status, numeric value 40, when it has not communicated with Tenable Vulnerability Management for more than 72 hours.

Affected Response Properties

The new status appears in the properties that report an agent's health state and its health event history. The numeric properties report 40 and the name properties report OFFLINE:

Response Property	Data Type	Description
`health`	Integer	The numeric representation of the agent's health status. Now includes `40` for `OFFLINE`.
`health_state_name`	String	The agent's current health status. Now includes `OFFLINE`.
`state`	Integer	The numeric representation of the agent health event's status. Now includes `40` for `OFFLINE`.
`state_name`	String	The agent health event's status. Now includes `OFFLINE`.
`previous_state`	Integer	The health state code the agent was in before the event. Now includes `40` for `OFFLINE`.
`previous_state_name`	String	The agent's previous health event status. Now includes `OFFLINE`.

The state, state_name, previous_state, and previous_state_name properties belong to the objects in the health_events array of an agent.

Affected Endpoints

This update affects the following endpoints:

Endpoint	Name	Update
GET /scanners/null/agents	List agents	The `health` and `health_state_name` response properties report the new `OFFLINE` status.
GET /scanners/null/agent-groups/{agent_group_id}/agents	List agents by group	The `health` and `health_state_name` response properties report the new `OFFLINE` status.
GET /scanners/null/agents/{agent_id}	Get agent details	The agent health properties and every object in the `health_events` array report the new `OFFLINE` status.

The same properties appear in the response of the Rename agent endpoint.

Example

For example, an agent that has not communicated with Tenable for more than 72 hours returns the following in the Get agent details response:

{
  "id": 1000,
  "name": "EXAMPLE-AGENT-01",
  "status": "off",
  "health": 40,
  "health_state_name": "OFFLINE"
}

The state, state_name, previous_state, and previous_state_name properties of a health event report the same status and numeric value.

📘
Note
The runtime_scanning_health and nessus_scanning_health response properties report continuous assessment and vulnerability scanning health separately, and they do not use the OFFLINE status.

For more information about agent health events, see View Linked Agent Health Events in the Tenable Vulnerability Management User Guide.