SecurityCenter scans.create(max_time: int) issue on value

[ve2tmq]

Max_time in API use hours, but pytenable documentation indicate in seconds. I tried to create scan with max_time=1 and see on web SecurityCenter, I got max duration = 1 hour.

In documentation it's write: "max_time (int, optional) – The maximum amount of time that the scan may run in seconds. 0 or less for unlimited. The default is 3600 seconds."

In reality, it's not on seconds, but in hours.
I use SecurityCenter version 6.1.0

To Reproduce

from tenable.sc import TenableSC
import configparser
import warnings
warnings.filterwarnings("ignore")

class connectSC:
SC = dict()
uri = dict()

def __init__(self, filename = 'connectSC.cfg'):
    cfg = configparser.ConfigParser()
    cfg.read(filename)
    sections = cfg.sections()
    for section in sections:
        self.uri[section] = cfg[section]['uri']
        self.SC[section] = TenableSC(self.uri[section])
        keys = list()
        for key in cfg[section]:
            keys.append(key)

        if 'access_key' in keys and 'secret_key' in keys:
            self.SC[section].login(access_key=cfg[section]['access_key'], secret_key=cfg[section]['secret_key'])
        elif 'username' in keys and 'password' in keys:
            self.SC[section].login(username=cfg[section]['username'], password=cfg[section]['password'])

sc = connectSC()
sc.SC['my_org'].scans.create(name='Test', repo=6, max_time=1, policy_id=1000290, asset_lists=['1978'])

now check on web SecurityCenter the scan Test max duration is 1 hour. If I set to 3600, it's "Nothing Selected"

[aseemsavio]

@ve2tmq pyTenable is inline with the public documentation for the POST /scan API. I'll get back to you after getting clarity on the API side of things.

[aseemsavio]

@ve2tmq - max_time should always accompany inactivity_timeout. max_time should be in multiples of 3600, and inactivity_timeout must be between 3600 and max_time.

[ve2tmq]

Hi

I understand that, but my observations indicates the unit should not be in seconds but in hours. The function works, the issue is in the doc. The doc is worng.

[SteveMcGrath]

Can confirm that max_time is indeed hours, not seconds in the upstream API