Intruder
API integration

list_all_intruder_health

Check that the Intruder API is running normally. Returns: status, authenticated_as, openapi, info, paths, components, servers.

list_all_intruder_issue_occurrences

List occurrences for an issue in Intruder. Returns: id, occurrence_id, target, display_address, port, protocol, extra_info, age, snoozed, snooze_reason, snooze_until, exploit_likelihood, cvss_score, first_seen_at, target_last_scanned_at, cves. Required: issue_id. occurrence_id is the stable ID that persists across scans; id may change between scans.

list_all_intruder_issues

List current issues in Intruder, with filters for severity, snoozing, tags, target addresses, and new occurrences since a timestamp. Returns: id, severity, title, description, remediation, snoozed, snooze_reason, snooze_until, occurrences, exploit_likelihood, cvss_score.

create_a_intruder_scan

Start a scan in Intruder. Returns the created scan including its id, status, scan_type, created_at, target_addresses, and start_time. Optionally pass target_addresses and/or tag_names in the body — with no body it scans all targets. Max 500 active and scheduled scans.

list_all_intruder_scans

List current scans in Intruder. Returns scan records including id, status, scan_type, schedule_period, and created_at; filter by scan_type, status, schedule_period, or tag_names.

intruder_scans_cancel

Cancel a running scan in Intruder. Returns the confirmation string "Scan was cancelled" on success. Required: scan_id.

get_single_intruder_scan_by_id

Get a single Intruder scan's details by id. Returns: id, status, created_at, target_addresses, scan_type, throttled, web_ports_only, schedule_period, start_time, completed_time, openapi, info, paths, components, servers. Required: id.

intruder_targets_bulk_create

Bulk add multiple targets in Intruder, including CIDR ranges. Returns the created target including id, address, display_address, target_status, license_type, and tags. Required: address for each target in the array.

create_a_intruder_target

Add a target in Intruder. Returns the created target including id, address, display_address, target_status, target_type, license_type, and tags. Required: address; type and url when target_authentication is supplied.

list_all_intruder_targets

List Intruder targets. Returns: id, address, display_address, has_api_schemas, has_authentications, last_scanned, license_type, waf_provider, waf_interference, tags, target_status, target_type. Filter by address, status, type, tags, or last scan date.

delete_a_intruder_target_by_id

Delete an Intruder target by id. Returns an empty 204 response on success. Required: id.

list_all_intruder_fixed_occurrences

List fixed occurrences in Intruder — vulnerabilities that have been resolved. Returns each occurrence with id, title, severity, cvss_score, affected_host, first_seen_at, and remediated_at.

list_all_intruder_licenses

List infrastructure and application license counts in Intruder. Returns: total_infrastructure_licenses, available_infrastructure_licenses, consumed_infrastructure_licenses, total_application_licenses, available_application_licenses, consumed_application_licenses.

create_a_intruder_occurrence_comment

Add a comment to an occurrence in Intruder. Returns the created comment including its id, content, commenter_type, user, and created_at. Required: issue_id, occurrence_id, content.

list_all_intruder_occurrence_comments

List comments on an occurrence in Intruder, newest first. Returns: id, content, commenter_type, user, created_at, edited_at. Required: issue_id, occurrence_id.

list_all_intruder_occurrence_scanner_output

List scanner output entries for an occurrence of an issue in Intruder. Returns: id, plugin, scanner_output. Required: issue_id, occurrence_id.

create_a_intruder_scan_schedule

Create a scan schedule in intruder that runs recurring scans on your targets. Returns: id, notice, openapi, info, paths, components, servers. Requires name, first_scan_time, and scan_frequency (monthly, daily, weekly, or quarterly); first_scan_time must be in the future and on the hour.

delete_a_intruder_scan_schedule_by_id

Delete a scan schedule in intruder by id, stopping its scheduled recurring scans. Returns an empty 204 response on success. Required: id.

list_all_intruder_scan_schedules

List all scan schedules in intruder. Returns: id, name, schedule_period, first_scan_time, next_scan_date, status, throttled, web_ports_only, latest_scan_id, latest_scan_status, last_scan_start_time, last_scan_end_time, targets, target_tags, upload_to_drata, upload_to_vanta.

update_a_intruder_scan_schedule_by_id

Update a scan schedule in intruder by id. All body fields (name, first_scan_time, scan_frequency, tags, targets, throttled, web_ports_only, upload_to_drata, upload_to_vanta) are optional for a partial update. Returns: notice, openapi, info, paths, components, servers. Required: id.

list_all_intruder_tags

List tags in Intruder. Returns the collection of tag records, each containing its name (up to 40 characters), which also serves as the tag's identifier when adding or removing it from targets. Default page size 25.

create_a_intruder_target_api_schema

Add an API schema to a target in Intruder by uploading a schema file. Returns the created schema including its id, name, base_url, and target_authentication_id. Required: target_id, name, base_url, file (multipart).

delete_a_intruder_target_api_schema_by_id

Delete an API schema from an Intruder target by id. Returns an empty 204 response on success. Required: id and target_id.

list_all_intruder_target_api_schemas

List API schemas attached to an Intruder target. Returns each schema's id, name, base_url, and target_authentication_id. Required: target_id.

update_a_intruder_target_api_schema_by_id

Update an API schema on an Intruder target, optionally replacing its schema file. Returns the updated schema including its id, name, base_url, and target_authentication_id. Required: id and target_id.

create_a_intruder_target_authentication

Add an authentication to a target in Intruder. Returns the created authentication object including its id, url, type, name, and enabled status. Required: target_id, type, url.

delete_a_intruder_target_authentication_by_id

Delete an authentication from a target in Intruder by id. Returns an empty 204 response on success. Required: target_id, id.

list_all_intruder_target_authentications

List the authentications configured for a target in Intruder. Returns each authentication's id, url, type, name, and enabled status. Required: target_id.

update_a_intruder_target_authentication_by_id

Update an authentication on a target in Intruder. Returns the updated authentication with id, url, type, name, and enabled status. Required: target_id, id. All cookies, headers, and additional_parameters key-value pairs you want present must be included in the request; omitted values are removed.

create_a_intruder_target_tag

Create a tag for a target in Intruder. Returns the created tag object including its name (up to 40 characters). Required: target_id, name.

intruder_target_tags_bulk_delete

Delete a tag from a target in Intruder by tag name. Returns an empty 204 response on success. Required: target_id, tag_name.