<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Vulnerability Remediation SLAs — API Reference

## Tenable.io Vulnerability API

```bash
# List vulnerabilities with age data
curl -s "https://cloud.tenable.com/workbenches/vulnerabilities" \
  -H "X-ApiKeys: accessKey=$AK; secretKey=$SK" | \
  jq '.vulnerabilities[] | {plugin_name, severity, count}'

# Get asset vulnerability details (includes first_found)
curl -s "https://cloud.tenable.com/workbenches/assets/ASSET_UUID/vulnerabilities" \
  -H "X-ApiKeys: accessKey=$AK; secretKey=$SK"
```

## Qualys VMDR API

```bash
# List vulnerabilities with detection dates
curl -s "https://qualysapi.qualys.com/api/2.0/fo/asset/host/vm/detection/" \
  -u "$QUALYS_USER:$QUALYS_PASS" \
  -d "action=list&show_results=1&severities=4,5"

# Knowledge base lookup
curl -s "https://qualysapi.qualys.com/api/2.0/fo/knowledge_base/vuln/" \
  -u "$QUALYS_USER:$QUALYS_PASS" \
  -d "action=list&ids=QID"
```

## Jira Integration

```bash
# Create remediation ticket
curl -s -X POST "https://jira.internal/rest/api/2/issue" \
  -H "Authorization: Bearer $JIRA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "fields": {
      "project": {"key": "VULN"},
      "summary": "Remediate CVE-2024-6387 on web-prod-01",
      "issuetype": {"name": "Bug"},
      "priority": {"name": "Critical"},
      "customfield_10001": "48h",
      "labels": ["vulnerability", "sla-critical"]
    }
  }'

# Search for overdue tickets
curl -s "https://jira.internal/rest/api/2/search" \
  -H "Authorization: Bearer $JIRA_TOKEN" \
  -G --data-urlencode 'jql=project=VULN AND labels=sla-breach AND status!=Done'
```

## ServiceNow Vulnerability Response

```bash
# Query vulnerable items
curl -s "https://INSTANCE.service-now.com/api/now/table/sn_vul_vulnerable_item" \
  -H "Authorization: Bearer $SN_TOKEN" \
  -H "Accept: application/json" \
  --data-urlencode "sysparm_query=state!=closed^severity<=2"
```

## SLA Calculation Reference

| Field | Source | Description |
|-------|--------|-------------|
| `first_found` | Scanner | SLA clock start |
| `last_fixed` | Rescan | SLA clock stop |
| `severity` | Scanner/CVSS | Determines SLA tier |
| `exception_date` | Manual | Pauses SLA clock |
| `compensating_control` | Manual | Required for exception |
