Select Vulnerability Export Properties

The properties request body parameter lets you select specific properties to include in a vulnerability export, reducing export size and processing time for large datasets. This parameter is supported by the following endpoints:

Tenable Vulnerability Management — Export vulnerabilities
Tenable Web App Scanning — Export findings

When you specify this parameter, the export only includes the properties you select.

If you omit the properties parameter, the export returns all available properties (the full payload), which is the default behavior.

How It Works

Pass an array of property names in the properties parameter to select only the columns you need.
The system always includes a small set of core identifying properties regardless of your selection (see Always-Included Properties below).
The Get vulnerability export status and Get findings export status endpoints both echo back the properties array you specified. If you did not use the parameter, the properties field is omitted from the status response.

Vulnerability Management Export Properties

The following tables list all valid values for the properties parameter when using the Export vulnerabilities endpoint.

Finding Properties

Core finding attributes — where and when the vulnerability was detected on the asset and its current state.

Property	Description
`source`	The source that identified the vulnerability (for example, NESSUS, AGENT).
`indexed_at`	The timestamp when the finding was last updated internally.
`recast_reason`	The reason for recasting the vulnerability severity.
`recast_rule_uuid`	The UUID of the recast rule applied to the finding.
`port`	The port where the vulnerability was detected.
`protocol`	The protocol used during detection.
`service`	The service running on the detected port.
`severity`	The severity of the vulnerability.
`risk_modified`	Indicates whether the risk has been modified.
`first_observed`	The timestamp when the vulnerability was first observed.
`last_fixed`	The timestamp when the vulnerability was last fixed.
`last_seen`	The timestamp when the vulnerability was last seen.
`state`	The current state of the finding (OPEN, REOPENED, FIXED).
`scan_start_time`	The timestamp when the scan started.
`id`	The unique identifier of the finding.
`time_in_last_state`	The duration the finding has been in its current state.
`resurfaced_date`	The timestamp when the vulnerability resurfaced.
`output`	The plugin output text for the finding.
`software_vulns`	Software package attribution data for the vulnerability.

Asset Properties

Attributes of the asset (host) the finding belongs to.

Property	Description
`asset.agent_name`	The name of the Nessus Agent installed on the asset.
`asset.tenable_id`	The Tenable asset identifier.
`asset.fqdns`	The fully qualified domain names of the asset.
`asset.name`	The display name of the asset.
`asset.id`	The UUID of the asset.
`asset.ipv4_addresses`	The IPv4 addresses associated with the asset.
`asset.ipv6_addresses`	The IPv6 addresses associated with the asset.
`asset.last_authenticated_scan_time`	The timestamp of the last authenticated scan on the asset.
`asset.mac_addresses`	The MAC addresses associated with the asset.
`asset.netbios_name`	The NetBIOS name of the asset.
`asset.operating_systems`	The operating systems detected on the asset.
`asset.network_id`	The UUID of the network the asset belongs to.
`asset.bios_uuid`	The BIOS UUID of the asset.
`asset.system_type`	The system type of the asset.
`asset.network_device_serial_identifier`	The serial identifier of the network device.
`asset.last_scan_target`	The last scan target used for the asset.

Definition Properties

Vulnerability and plugin definition attributes.

Property	Description
`definition.id`	The plugin ID that identified the vulnerability.
`definition.bugtraq`	Bugtraq IDs associated with the vulnerability.
`definition.canvas`	Indicates whether an exploit exists in the CANVAS framework.
`definition.default_account`	Indicates whether the vulnerability involves default accounts.
`definition.malware`	Indicates whether the vulnerability is associated with malware.
`definition.cpe`	Common Platform Enumeration identifiers.
`definition.cve`	Common Vulnerabilities and Exposures identifiers.
`definition.type`	The type of plugin (local, remote, combined).
`definition.elliot`	Indicates whether an exploit exists in the Elliot framework.
`definition.description`	The description of the vulnerability.
`definition.core`	Indicates whether an exploit exists in the Core Impact framework.
`definition.exploithub`	Indicates whether an exploit exists in ExploitHub.
`definition.metasploit`	Indicates whether an exploit exists in Metasploit.
`definition.exploitability_ease`	How easy the vulnerability is to exploit.
`definition.exploited_by_malware`	Indicates whether the vulnerability is exploited by malware.
`definition.exploited_by_nessus`	Indicates whether the vulnerability is exploited by Nessus.
`definition.family`	The plugin family.
`definition.patch_published`	The date the patch was published.
`definition.in_the_news`	Indicates whether the vulnerability is in the news.
`definition.name`	The name of the plugin.
`definition.plugin_updated`	The date the plugin was last updated.
`definition.plugin_published`	The date the plugin was published.
`definition.severity`	The severity assigned by the plugin.
`definition.see_also`	References to additional information.
`definition.solution`	The recommended solution.
`definition.stig_severity`	The DISA STIG severity.
`definition.synopsis`	A brief synopsis of the vulnerability.
`definition.unsupported_by_vendor`	Indicates whether the software is unsupported by the vendor.
`definition.plugin_version`	The version of the plugin.
`definition.vulnerability_published`	The date the vulnerability was published.
`definition.references`	External references for the vulnerability.
`definition.vendor_severity`	The severity assigned by the vendor.
`definition.workaround`	The workaround for the vulnerability.
`definition.workaround_type`	The type of workaround.
`definition.workaround_published`	The date the workaround was published.
`definition.vendor_unpatched`	Indicates whether the vendor has no intention to patch.
`definition.has_workaround`	Indicates whether a workaround exists.

CVSS Properties

Common Vulnerability Scoring System scores and vector components.

Property	Description
`definition.cvss3.base_score`	The CVSS v3 base score.
`definition.cvss3.temporal_score`	The CVSS v3 temporal score.
`definition.cvss2.base_score`	The CVSS v2 base score.
`definition.cvss2.temporal_score`	The CVSS v2 temporal score.
`definition.cvss3.base_vector`	The full CVSS v3 base vector string.
`definition.cvss3.base_vector_ac`	CVSS v3 Attack Complexity.
`definition.cvss3.base_vector_av`	CVSS v3 Attack Vector.
`definition.cvss3.base_vector_a`	CVSS v3 Availability Impact.
`definition.cvss3.base_vector_c`	CVSS v3 Confidentiality Impact.
`definition.cvss3.base_vector_i`	CVSS v3 Integrity Impact.
`definition.cvss3.temporal_vector`	The full CVSS v3 temporal vector string.
`definition.cvss3.temporal_vector_e`	CVSS v3 Exploit Code Maturity.
`definition.cvss3.temporal_vector_rl`	CVSS v3 Remediation Level.
`definition.cvss3.temporal_vector_rc`	CVSS v3 Report Confidence.
`definition.cvss2.base_vector`	The full CVSS v2 base vector string.
`definition.cvss2.base_vector_ac`	CVSS v2 Access Complexity.
`definition.cvss2.base_vector_av`	CVSS v2 Access Vector.
`definition.cvss2.base_vector_a`	CVSS v2 Availability Impact.
`definition.cvss2.base_vector_au`	CVSS v2 Authentication.
`definition.cvss2.base_vector_c`	CVSS v2 Confidentiality Impact.
`definition.cvss2.base_vector_i`	CVSS v2 Integrity Impact.
`definition.cvss2.temporal_vector`	The full CVSS v2 temporal vector string.
`definition.cvss2.temporal_vector_e`	CVSS v2 Exploitability.
`definition.cvss2.temporal_vector_rl`	CVSS v2 Remediation Level.
`definition.cvss2.temporal_vector_rc`	CVSS v2 Report Confidence.
`definition.cvss4.base_score`	The CVSS v4 base score.
`definition.cvss4.base_vector`	The full CVSS v4 base vector string.
`definition.cvss4.base_vector_av`	CVSS v4 Attack Vector.
`definition.cvss4.base_vector_at`	CVSS v4 Attack Requirements.
`definition.cvss4.base_vector_ac`	CVSS v4 Attack Complexity.
`definition.cvss4.base_vector_pr`	CVSS v4 Privileges Required.
`definition.cvss4.base_vector_ui`	CVSS v4 User Interaction.
`definition.cvss4.base_vector_vc`	CVSS v4 Vulnerable System Confidentiality.
`definition.cvss4.base_vector_vi`	CVSS v4 Vulnerable System Integrity.
`definition.cvss4.base_vector_va`	CVSS v4 Vulnerable System Availability.
`definition.cvss4.base_vector_sc`	CVSS v4 Subsequent System Confidentiality.
`definition.cvss4.base_vector_si`	CVSS v4 Subsequent System Integrity.
`definition.cvss4.base_vector_sa`	CVSS v4 Subsequent System Availability.
`definition.cvss4.threat_score`	The CVSS v4 threat score.
`definition.cvss4.threat_vector`	The full CVSS v4 threat vector string.
`definition.cvss4.threat_vector_e`	CVSS v4 Exploit Maturity.

VPR Properties

Tenable Vulnerability Priority Rating scores and drivers.

Property	Description
`definition.vpr.score`	The VPR score.
`definition.vpr.drivers_updated`	The date VPR drivers were last updated.
`definition.vpr.drivers_update_reason`	The reason for the most recent VPR driver update.
`definition.vpr.drivers_age_of_vulns_low`	The lower bound of the vulnerability age range.
`definition.vpr.drivers_age_of_vulns_high`	The upper bound of the vulnerability age range.
`definition.vpr.drivers_exploit_code_maturity`	The exploit code maturity level.
`definition.vpr.drivers_cvss_impact_score_predicted`	Indicates whether the CVSS impact score is predicted.
`definition.vpr.drivers_cvss3_impact_score`	The CVSS v3 impact score used in VPR calculation.
`definition.vpr.drivers_threat_intensity`	The threat intensity level.
`definition.vpr.drivers_threat_recency_low`	The lower bound of threat recency.
`definition.vpr.drivers_threat_recency_high`	The upper bound of threat recency.
`definition.vpr.drivers_threat_sources`	The threat sources contributing to VPR.
`definition.vpr.drivers_product_coverage`	The product coverage metric.
`vpr_v2`	The VPR v2 score.
`vpr_v2_drivers_cve_id`	The CVE ID used in VPR v2 calculation.
`vpr_v2_drivers_vpr_percentile`	The VPR v2 percentile ranking.
`vpr_v2_drivers_vpr_severity`	The VPR v2 severity level.
`vpr_v2_drivers_exploit_probability`	The probability of exploitation.
`vpr_v2_drivers_exploit_code_maturity`	The exploit code maturity (VPR v2).
`vpr_v2_drivers_on_cisa_kev`	Indicates whether the CVE appears on the CISA KEV list.
`vpr_v2_drivers_in_the_news_intensity_last_30`	The news intensity over the last 30 days.
`vpr_v2_drivers_in_the_news_recency`	The recency of news coverage.
`vpr_v2_drivers_malware_observations_intensity_last_30`	The malware observation intensity over the last 30 days.
`vpr_v2_drivers_malware_observations_recency`	The recency of malware observations.
`vpr_v2_drivers_exploit_chain`	Indicates whether the vulnerability is part of an exploit chain.
`vpr_v2_drivers_in_the_news_sources_last_30`	The news sources over the last 30 days.
`vpr_v2_drivers_threat_summary`	A summary of threat intelligence.
`vpr_v2_drivers_remediation`	Remediation guidance from VPR v2.
`vpr_v2_drivers_targeted_industries`	Industries targeted by exploits for this vulnerability.
`vpr_v2_drivers_targeted_regions`	Regions targeted by exploits for this vulnerability.

EPSS Properties

Exploit Prediction Scoring System data.

Property	Description
`definition.epss.score`	The EPSS score (probability of exploitation in the wild).

Scan Properties

Metadata about the scan that produced the finding.

Property	Description
`scan.schedule_id`	The schedule UUID of the scan.
`scan.id`	The unique identifier of the scan run.
`scan.target`	The scan target.

Always-Included Properties

The following properties are always included in the export when you use the properties parameter, even if you do not explicitly request them:

Property	Description
`id`	The unique identifier of the finding.
`asset.id`	The UUID of the asset.
`definition.id`	The plugin ID.
`definition.canvas`	CANVAS exploit availability.
`definition.core`	Core Impact exploit availability.
`definition.elliot`	Elliot exploit availability.
`definition.exploithub`	ExploitHub exploit availability.
`definition.metasploit`	Metasploit exploit availability.
`definition.exploitability_ease`	Exploitability ease.
`definition.patch_published`	Patch publication date.

Request Example (VM)

{
  "filters": {
    "since": 1340331545
  },
  "num_assets": 500,
  "properties": [
    "source",
    "severity",
    "state",
    "first_observed",
    "last_seen",
    "asset.id",
    "asset.name",
    "asset.ipv4_addresses",
    "definition.id",
    "definition.name",
    "definition.cve",
    "definition.vpr.score"
  ]
}

Web App Scanning Export Properties

The following tables list all valid values for the properties parameter when using the Export findings endpoint.

Finding Properties

Core WAS finding attributes.

Property	Description
`indexed_at`	The timestamp when the finding was last updated internally.
`url`	The URL where the vulnerability was found.
`severity`	The severity of the finding.
`input_type`	The type of HTML input associated with the finding.
`input_name`	The name of the input element.
`proof`	The proof of vulnerability.
`payload`	The payload used to detect the vulnerability.
`risk_modified`	Indicates whether the risk has been modified.
`first_observed`	The timestamp when the finding was first observed.
`last_observed`	The timestamp when the finding was last observed.
`last_fixed`	The timestamp when the finding was last fixed.
`last_seen`	The timestamp when the finding was last seen.
`state`	The current state of the finding (OPEN, REOPENED, FIXED).
`scan_id`	The unique identifier of the scan.
`scan_schedule_id`	The schedule UUID of the scan.
`http_method`	The HTTP method used when the finding was detected.
`recast_reason`	The reason for recasting the finding severity.
`recast_rule_uuid`	The UUID of the recast rule.
`original_risk_factor_num`	The original risk factor number before recasting.
`age_in_days`	The age of the finding in days.
`id`	The unique identifier of the finding.
`finding_id`	The finding UUID.
`output`	The plugin output text for the finding.

Asset Properties

Property	Description
`asset.name`	The display name of the web application.
`asset.id`	The UUID of the asset.
`asset.ipv4_addresses`	The IPv4 addresses associated with the asset.
`asset.last_authenticated_scan_time`	The timestamp of the last authenticated scan.

Definition Properties

Property	Description
`definition.id`	The plugin ID.
`definition.cpe`	Common Platform Enumeration identifiers.
`definition.cve`	Common Vulnerabilities and Exposures identifiers.
`definition.locale`	The locale of the plugin.
`definition.intel_type`	The intelligence type.
`definition.synopsis`	A brief synopsis of the vulnerability.
`definition.stig_severity`	The DISA STIG severity.
`definition.public_display`	Indicates whether the vulnerability is publicly displayed.
`definition.policy`	The associated policy.
`definition.in_the_news`	Indicates whether the vulnerability is in the news.
`definition.exploited_by_malware`	Indicates whether exploited by malware.
`definition.type`	The type of plugin.
`definition.description`	The description of the vulnerability.
`definition.exploitability_ease`	How easy the vulnerability is to exploit.
`definition.family`	The plugin family.
`definition.patch_published`	The date the patch was published.
`definition.name`	The name of the plugin.
`definition.plugin_updated`	The date the plugin was last updated.
`definition.plugin_published`	The date the plugin was published.
`definition.severity`	The severity assigned by the plugin.
`definition.see_also`	References to additional information.
`definition.solution`	The recommended solution.
`definition.plugin_version`	The version of the plugin.
`definition.vulnerability_published`	The date the vulnerability was published.
`definition.references`	External references.

CVSS Properties (WAS)

Property	Description
`definition.cvss2.temporal_score`	The CVSS v2 temporal score.
`definition.cvss3.temporal_score`	The CVSS v3 temporal score.
`definition.cvss2.temporal_vector`	The CVSS v2 temporal vector string.
`definition.cvss3.temporal_vector`	The CVSS v3 temporal vector string.
`definition.cvss3.base_score`	The CVSS v3 base score.
`definition.cvss2.base_score`	The CVSS v2 base score.
`definition.cvss3.base_vector`	The full CVSS v3 base vector string.
`definition.cvss3.base_vector_ac`	CVSS v3 Attack Complexity.
`definition.cvss3.base_vector_av`	CVSS v3 Attack Vector.
`definition.cvss3.base_vector_a`	CVSS v3 Availability Impact.
`definition.cvss3.base_vector_c`	CVSS v3 Confidentiality Impact.
`definition.cvss3.base_vector_i`	CVSS v3 Integrity Impact.
`definition.cvss2.base_vector`	The full CVSS v2 base vector string.
`definition.cvss2.base_vector_ac`	CVSS v2 Access Complexity.
`definition.cvss2.base_vector_av`	CVSS v2 Access Vector.
`definition.cvss2.base_vector_a`	CVSS v2 Availability Impact.
`definition.cvss2.base_vector_au`	CVSS v2 Authentication.
`definition.cvss2.base_vector_c`	CVSS v2 Confidentiality Impact.
`definition.cvss2.base_vector_i`	CVSS v2 Integrity Impact.
`definition.cvss4.base_score`	The CVSS v4 base score.
`definition.cvss4.base_vector`	The full CVSS v4 base vector string.
`definition.cvss4.base_vector_av`	CVSS v4 Attack Vector.
`definition.cvss4.base_vector_at`	CVSS v4 Attack Requirements.
`definition.cvss4.base_vector_ac`	CVSS v4 Attack Complexity.
`definition.cvss4.base_vector_pr`	CVSS v4 Privileges Required.
`definition.cvss4.base_vector_ui`	CVSS v4 User Interaction.
`definition.cvss4.base_vector_vc`	CVSS v4 Vulnerable System Confidentiality.
`definition.cvss4.base_vector_vi`	CVSS v4 Vulnerable System Integrity.
`definition.cvss4.base_vector_va`	CVSS v4 Vulnerable System Availability.
`definition.cvss4.base_vector_sc`	CVSS v4 Subsequent System Confidentiality.
`definition.cvss4.base_vector_si`	CVSS v4 Subsequent System Integrity.
`definition.cvss4.base_vector_sa`	CVSS v4 Subsequent System Availability.
`definition.cvss4.threat_score`	The CVSS v4 threat score.
`definition.cvss4.threat_vector`	The full CVSS v4 threat vector string.
`definition.cvss4.threat_vector_e`	CVSS v4 Exploit Maturity.

VPR Properties (WAS)

Property	Description
`definition.vpr.score`	The VPR score.
`definition.vpr.drivers_updated`	The date VPR drivers were last updated.
`definition.vpr.drivers_update_reason`	The reason for the most recent VPR driver update.
`definition.vpr.drivers_age_of_vulns_low`	The lower bound of the vulnerability age range.
`definition.vpr.drivers_age_of_vulns_high`	The upper bound of the vulnerability age range.
`definition.vpr.drivers_exploit_code_maturity`	The exploit code maturity level.
`definition.vpr.drivers_cvss_impact_score_predicted`	Indicates whether the CVSS impact score is predicted.
`definition.vpr.drivers_cvss3_impact_score`	The CVSS v3 impact score used in VPR calculation.
`definition.vpr.drivers_threat_intensity`	The threat intensity level.
`definition.vpr.drivers_threat_recency_low`	The lower bound of threat recency.
`definition.vpr.drivers_threat_recency_high`	The upper bound of threat recency.
`definition.vpr.drivers_threat_sources`	The threat sources contributing to VPR.
`definition.vpr.drivers_product_coverage`	The product coverage metric.
`vpr_v2`	The VPR v2 score.
`vpr_v2_drivers_cve_id`	The CVE ID used in VPR v2 calculation.
`vpr_v2_drivers_vpr_percentile`	The VPR v2 percentile ranking.
`vpr_v2_drivers_vpr_severity`	The VPR v2 severity level.
`vpr_v2_drivers_exploit_probability`	The probability of exploitation.
`vpr_v2_drivers_exploit_code_maturity`	The exploit code maturity (VPR v2).
`vpr_v2_drivers_on_cisa_kev`	Indicates whether the CVE appears on the CISA KEV list.
`vpr_v2_drivers_in_the_news_intensity_last_30`	The news intensity over the last 30 days.
`vpr_v2_drivers_in_the_news_recency`	The recency of news coverage.
`vpr_v2_drivers_malware_observations_intensity_last_30`	The malware observation intensity over the last 30 days.
`vpr_v2_drivers_malware_observations_recency`	The recency of malware observations.
`vpr_v2_drivers_exploit_chain`	Indicates whether the vulnerability is part of an exploit chain.
`vpr_v2_drivers_in_the_news_sources_last_30`	The news sources over the last 30 days.
`vpr_v2_drivers_threat_summary`	A summary of threat intelligence.
`vpr_v2_drivers_remediation`	Remediation guidance from VPR v2.
`vpr_v2_drivers_targeted_industries`	Industries targeted by exploits for this vulnerability.
`vpr_v2_drivers_targeted_regions`	Regions targeted by exploits for this vulnerability.

EPSS Properties (WAS)

Property	Description
`definition.epss.score`	The EPSS score (probability of exploitation in the wild).

Always-Included Properties (WAS)

The following properties are always included in WAS exports when you use the properties parameter:

Property	Description
`id`	The unique identifier of the finding.
`finding_id`	The finding UUID.
`asset.id`	The UUID of the asset.
`definition.id`	The plugin ID.

Request Example (WAS)

{
  "num_assets": 50,
  "filters": {
    "severity": ["HIGH", "CRITICAL"],
    "state": ["OPEN", "REOPENED"]
  },
  "properties": [
    "url",
    "severity",
    "state",
    "first_observed",
    "last_seen",
    "asset.name",
    "asset.id",
    "definition.id",
    "definition.name",
    "definition.cve"
  ]
}