lanz

Tenable Scan Sweep — Security skill for Claude Code

Security community

Find which Tenable Vulnerability Management or Security Center scans target an IP, range, hostname, tag or asset list.

How to install Tenable Scan Sweep

This entry records only its repository, not the path inside it, so there is no exact command to give. Open lanz/tenable-scan-sweep and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Tenable Scan Sweep does

Find which Tenable Vulnerability Management or Security Center scans target an IP, range, hostname, tag or asset list. Audit scan configurations for overlaps, duplicates and missing credentials, from a read-only local snapshot. Claude Code skill and standalone Python script.

Alternatives in Security

Google Workspace Alert Center — Manage security alerts 21.6k ★
Pocketpaw — Your AI agent in 30 seconds 775 ★
Design Compliance — Audit or generate regulation-specific UI patterns for HIPAA, PCI DSS, or ADA compliance 309 ★

README

Tenable Scan Sweep

A Claude Code skill and command-line tool. It answers "which scans target X?" and other scan-configuration questions across every scan in Tenable Vulnerability Management (VM) or Tenable Security Center (SC).

The VM UI can't search scans by target. The API needs one call per scan to read a target list. An assistant or MCP server making those calls spends tokens and tool calls on every scan, and runs out of either long before a container with hundreds of scans is done. This tool makes the calls itself once, read-only, into a local snapshot, and then answers questions from the snapshot instantly:

Which scans target an IP, CIDR, range, hostname, tag, agent group, target group or SC asset list, scanner or scan zone, repository, credential type, policy, template or owner? Is the address under a VM exclusion or an SC freeze window?
Which scans overlap or scan exactly the same addresses?
Scan hygiene: scans with no targets, credentialed templates without credentials, unparsable targets, on-demand-only scans, deprecated target groups, and unused agent groups, target groups and scanners.
Credential usage: which scans use which credential types and managed credentials.

Prerequisites

Python 3.11 or later, and uv (recommended) or pip.
A Tenable VM API key pair. Reading scan configurations requires the Standard role (or the VM.VM_SCAN.VM_SCAN.EDIT privilege), and reading exclusions requires Scan Manager (or VM.VM_SCAN.VM_SCAN_EXCLUSION.READ). Results only cover scans the user can see, so use an administrator's keys for a complete sweep. Generate keys under Settings > My Account > API Keys.
For collect --assets on VM: the asset export needs the Basic role (or VM.VM_EXPLORE.VM_EXPLORE.EXPORT) and Can View on the assets, and the agent list needs Scan Manager (or VM.VM_SENSOR.VM_AGENT.READ). Without the agent list, agent scans stay unresolved.
Or, for Securi