[Telivy] Returns the latest published Telivy deep-scan agent versions for Windows and macOS. Useful when an MSP needs to verify whether endpoints are running outdated agents before triaging scan-status issues.

[Telivy] Looks up a finding by its short slug (e.g. "open-port", "weak-mfa") and returns the canonical name, description, risk explanation, remediation recommendation, severity, and reference links. Use this to enrich findings surfaced by telivy_get_external_scan_findings or telivy_get_external_scan_finding_detail.

[Telivy] Returns a time-windowed findings progress report for an assessment, optionally comparing two timestamp groups. Surfaces resolved vs. new vs. ongoing findings between scans. Use telivy_list_external_scans or telivy_list_risk_assessments to discover assessment IDs.

[Telivy] Create a new external (attack-surface) scan for a domain. Requires organizationName and domain. Triggers Telivy to begin scanning the domain's public-facing services.

[Telivy] Returns the full external-scan record including security grades, scan status, last-scan timestamp, and assessment details. Use telivy_list_external_scans to discover IDs.

[Telivy] Returns dark-web/breach data exposures associated with the assessment's domain — leaked passwords, exposed accounts, breach dates, and source of disclosure. Use to support incident response and credential rotation conversations.

[Telivy] Returns the per-target detail records for a specific finding slug on an external scan (e.g. all hosts/ports affected by an "open-port" finding). Use telivy_get_external_scan_findings to enumerate slugs first.

[Telivy] Returns all security findings discovered by the external scan (open ports, weak TLS, expired certs, exposed services, breach data, etc.). Each finding includes its slug — pass to telivy_get_external_scan_finding_detail or telivy_get_finding_details for more.

[Telivy] Generates and downloads the external scan report (PDF or DOCX). The binary is uploaded to StackJack blob storage and returned as a short-lived (~3 minute) read-only SAS URL. The agent should fetch the file from the URL within the expiry window — do NOT attempt to decode the URL as content.

[Telivy] List external (attack-surface) scan assessments. Returns ID, scan status, security grades, and assessment metadata. Use this to discover assessment IDs for downstream tools and to audit which client domains have been scanned.

[Telivy] Marks all devices associated with the assessment for rescan. Triggers the Telivy deep-scan agent on each endpoint to re-evaluate posture. Operates on agent-deployed devices; pure external scans without agents will no-op.

[Telivy] DESTRUCTIVE: marks all devices associated with the assessment for agent uninstall. Use only when offboarding a customer or decommissioning the assessment — this revokes Telivy's deep-scan visibility, removes posture data collection from every endpoint in the assessment, and CANNOT be undone without redeploying the agent on each device.

[Telivy] Update an external scan's organization metadata (name, domain, client category/status). Pass-through PUT with the same fields used in create. Idempotent: replaying the same body produces the same end-state.

[Telivy] Convert a Telivy 'application' (incomplete/partial assessment) into a full risk assessment. Use when an external scan has graduated to deep-scan readiness and you want to enable agent deployment + deep-scan reporting.

[Telivy] Create a new deep-scan risk assessment. Requires organizationName and domain. Optional fields configure light vs full scan, antivirus integration, and PII jurisdiction.

[Telivy] Returns a single risk assessment with full scan status, monitoring config, executive summary, and assessment details. Use telivy_list_risk_assessments to discover IDs.

[Telivy] Returns full details for a single deep-scan device — OS, deep-scan findings, encryption status, open ports, security grades, browser-saved passwords, and PII inventory. Use telivy_list_risk_assessment_devices to discover deviceId values.

[Telivy] Returns a preview of what would change if the assessment's primary domain were updated — affected scans, agents, and findings. Use before performing a destructive domain change to surface impact.

[Telivy] Returns the Google Workspace user inventory for the assessment, including login status, last login timestamps, and 2-Step Verification enrollment per user. Use to find accounts without 2SV before triaging MFA gaps.

[Telivy] Returns the Microsoft 365 user inventory for the assessment, including login status, MFA enrollment per user, and recent login failure events. Use to surface MFA-disabled accounts and suspicious login activity.

[Telivy] Returns the PII exposure summary across all deep-scanned devices — counts of SSNs, credit cards, financial records, health records, etc., and per-device distribution. Useful for compliance reporting and risk prioritization.

[Telivy] Generates and downloads a risk assessment report. The binary is uploaded to StackJack blob storage and returned as a short-lived (~3 minute) read-only SAS URL. Supported reportType values: executive_security_summary_pdf, telivy_complete_report_pdf, telivy_complete_report_docx, telivy_external_scan_report_pdf, telivy_network_inventory_report_csv, internal_vulnerabilities_top_pdf, internal_vulnerabilities_executive_pdf, internal_vulnerabilities_network_pdf, internal_vulnerabilities_detailed_csv, applications_security_overview_csv, applications_security_detailed_csv, data_security_sensitive_documents_csv, data_security_detailed_risk_xlsx, telivy_passwords_report_csv, telivy_passwords_reuse_report_csv, telivy_dark_web_report_csv, m365_security_report_pdf, m365_security_data_report_xlsx, gws_security_report_pdf, gws_security_data_report_xlsx, legacy_complete_report_pdf.

[Telivy] Returns scan completion status across all devices in a risk assessment — counts by status (queued, scanning, completed, failed) and per-device summaries. Use to monitor scan progress before pulling a fresh report.

[Telivy] List all deep-scan devices (endpoints with the Telivy agent installed) belonging to a risk assessment. Each entry includes device ID, hostname, OS, scan timestamps, and high-level scan status. Use telivy_get_risk_assessment_device for full per-device findings.

[Telivy] List risk assessments (deep-scan agent-based assessments). Returns scan status, monitoring frequency, executive summary scores, and assessment metadata. Use to discover assessment IDs for downstream device, user, PII, and report tools.

[Telivy] Triggers an out-of-band rescan on a single deep-scan device. Useful after remediation actions (e.g. enabling BitLocker, closing a port) when you want to verify the fix without waiting for the next scheduled scan.

[Telivy] Update a risk assessment's organization metadata. Pass-through PUT with the same fields used in create. Idempotent: replaying the same body produces the same end-state.

[Telivy] Update the monitoring frequency for a risk assessment. Pass DISABLE to turn off monitoring, or QUARTERLY/MONTHLY/WEEKLY to set a recurring scan cadence. Idempotent: replaying the same body produces the same end-state.