Automate everything with Navi 8.2.1 New and improved; far more scalable.
I created the first version of Navi in 2018 as a passion project to learn Python, Docker, SQL, and how to interact with private APIs. At the time I needed a project to keep my attention and one that involved lots of different technologies and challenges.
Now, 8 years later it has become bigger than I anticipated with hundreds of enterprises using Navi for troubleshooting, enriching asset data, evaluating scan times and a plethora of other advanced use-cases.
The use of navi has exploded over the last few years and as a result I’ve spent a great deal of time improving the user experience and making it more scalable for heavy usage. In this release everything is easier and more scalable!
Navi 8.2 will be released on pypi after RSA: May 4th, 2025!
All but two base commands changed.
The navi main menu grew to over 35 commands as you can see in the above screenshot. The number of commands made it increasingly difficult for new users to understand what they could do with this Swiss-army knife for Vulnerability Management.
To improve on the user experience and to make things easier to understand, I reorganized all of the commands in to five categories(shown above): (Configuration, Enrichment, Exploration, Action, and Exportation). This is a big change so below is a summary of each category and a few important details.
Configuration
All of the database update commands have been moved under the ‘navi config’ base command. Commands like ‘ssh’, ‘smtp’ and ‘sla’ being moved under ‘navi config’ make it more clear that these are configuration commands.
navi config —
- Update the Vulns, Assets, Compliance, Fixed, and Apps tables using ‘navi config update’ with various options for scalability and asset isolation.
- Update the database with EPSS data using ‘navi config epss’.
- Add your SSH credentials for command and control using ‘navi config ssh’.
- Add SMTP information to enable mail functions in navi using ‘navi config smtp’.
- Create a custom Service Level Agreement for each severity using ‘navi config sla’.
- Create and control various items in Tenable Vulnerability Management such as: access groups, networks, permissions, exclusions, scanner groups, target groups, users and user groups.
Action
Navi has evolved to an automation and no-code solution over the last few years. In that light, useful solutions like “Command and Control” and “Alerting” were added to navi.
The command ‘navi action push’ can push files and run commands on a remote target and the ‘navi action mail’ command can mail files and command outputs to unlock alerting and streamline workflows. These two commands provide extreme power where enterprise equivalents are not present.
navi action —
- Delete items from Tenable Vulnerability Management: Assets, tags, networks, polices, scans, users, user groups and bulk delete users by tag.
- Deploy prebuilt navi containers; these prebuilt scripts are packed use-cases like “Tagging assets by Agent Groups”.
- Control and Command by push files or commands to remote targets using ‘navi action push’.
- Unlock alerting by mail files or command outputs from navi using ‘navi action mail’
- Cancel asset and vulnerability exports when required.
Enrichment
Data enrichment is the primary reason why enterprises use navi; tagging by findings being the most popular solution. I’ve written a few articles covering the various use-cases for tagging by findings:
- Tagging assets by Plugin Output
- Tagging assets by Security End of Life
- Tagging assets by Users who have logged in
- Tagging assets by Mitre ATT&CK impact
- Tagging assets by CISA Known Exploits
- Tagging assets by Open Ports
- Tagging assets using AI
navi enrich —
- Create advanced asset groupings using ‘navi enrich tag’.
- Create Tenable Dynamic Tag Rules by using ‘navi enrich tagrule’.
- Add your own asset lists as sources for increased asset visibility and clarity using ‘navi enrich add’.
- Migrate AWS tags from AWS to TVM.
- Change your Asset Criticality Rating on all assets up or down by tag.
Exploration
Second to data enrichment is data exploration. As you begin enriching your data with context you start to become aware of previously unknown or identified assets on your network. Having a CLI tool to dive into the details of each plugin on each asset is a massive time saver. This command gives you direct access to the database as well as prebuilt search commands to help explore everything in TVM and the navi database saving you time and money.
Get Casey Reid’s stories in your inbox
Join Medium for free to get updates from this writer.
navi explore —
- Make raw API queries and get JSON data returned with ‘navi explore api’.
- Query the navi database directly with ‘navi explore data’ previously ‘navi find’.
- Canvas the TVM configurations with ‘navi explore info’ previously ‘navi display’
- Dive into asset specific data using ‘navi uuid’ previously ‘navi ip’.
NOTE: The navi ip command became navi explore uuid; which still takes uuid or IP.
Exportation
Since navi started out as a collection of scripts under a single deployment mechanism, exports were found in other commands. This led to a lack of awareness that an export existed for certain use-cases. All Exports are now found under this category.
navi export — There are no CSV exports that exist within other commands. For those new to navi, this command gives you direct access to the database to customize your export via a SQL query. The rest of the exports are built in SQL queries making it easier to use.
Two Commands remain unchanged
The command, navi was, is specific to the web application module of Tenable one. This provides a way to interact with the APIs and get information on your scans as well as control and create scans from the command line.
The second command that was left unchanged is navi scan. This command is not only used to control scans, but used to evaluate scans and get information on the history of scans. I felt there was a strong use-case to keep it as a base command.
Scalability changes
Navi wasn’t initially created to gain high customer usage. As I was building navi I found it useful to show the code to help others build their own homegrown solutions; A collection of PoCs, as it were.
Navi is often still used today to see how something is accomplished using the TVM API or pytenable, since it is open source. However, over the last few years I’ve worked with organizations around the world to make navi more suitable for the enterprise. Let’s spend some time on a few use-cases that got an upgrade in this release.
Change ACR at Scale
If you are not familiar, the Asset Criticality Rating(ACR) of an asset is automatically assigned by Tenable to ensure every asset gets an Asset Exposure Score. As a customer, you can change this value, but I find most don’t due to how many assets they have and the time dedication required to maintain accuracy.
However, there are times where you may have a massive group of assets that need to have their asset rating changed to show any level of accuracy in terms of actual risk. Previously navi would process your request to change the ACR of a Tag by submitting one asset at a time. This was extremely limited; 300 assets a minute.
Now you can change the ACR of a Tag group using: navi enrich acr; and navi will process 1999 assets at a time decreasing processing time significantly. As you guessed, it’s 1999 times faster!
Adding CSV lists to TVM as a new Source
Imagine you have a number of CSV/Excel lists of assets from different vendors or assets that a person or group has ownership. You can use navi to upload that CSV list into TVM as a source. This enables you to see if you have indeed scanned all of the assets in that source or even use RBAC functions to box teammates into seeing only assets in their scope via their provided spreadsheet.
Previously, this was also a single asset at a time and in good fashion I was able to increase it to 1999 assets. So this makes asset source ingestion 1999 times faster as well!
More to Come
I’ve worked with a number of companies in the last year to improve on the capabilities in navi and many of them I haven’t written about or documented well. To help change that, I will be writing an article on each of the major functions in navi to explain the why and how.
So stay tuned!
