SLA Analyzer — for Tenable.io

What it does

The analyzer pulls scan results from the Tenable.io API, applies configurable SLA policies per severity, and gives operators a live dashboard of time-to-breach across the fleet. From any number on screen you can drill to the CVE, the affected assets, and the owning team, then escalate into per-owner tickets — with a ServiceNow lane in active development to carry those tickets and ownership syncs into a live SNOW instance. I wrote all of it: the ingest pipeline, the PyQt6 GUI, the crypto and audit layers, the build system, and the Store submission.

• SLA breach tracking with per-severity policies and days-to-breach math
• Asset and finding drilldowns that resolve real hostname, FQDN, and IP everywhere
• Zero-Day / KEV panel keyed to the CISA Known Exploited Vulnerabilities catalog
• Snap-in widget framework: CVE tracker, triage registry, intel feed, anomaly report
• Asset tagger with glob matching on hostname / FQDN / IP for bulk org-schema tagging
• ServiceNow lane in active development: automated past-SLA ticket escalation, ownership sync, CMDB push — running end-to-end against a mock SNOW instance today
• Attack-surface (ASM) aggregate view with bearer token held in process only, never persisted
• Search with field prefixes (ip:), token autocompletion, and paged filtering
• Multi-million-finding tenants on a single desktop: disk-backed engine, UI never freezes
• Fernet-encrypted state, HMAC-chained audit log, 0600-permission credential storage

stack: Python · PyQt6 · Textual · cryptography · orjson · zstandard · Nuitka one-file builds · MSIX packaging

Shipping is part of engineering

Building the tool is half the job. I also took it all the way to a certified, signed release:

• Trademark-safe naming. Renamed "Tenable SLA Analyzer" to "SLA Analyzer — for Tenable.io" for nominative fair use, with non-affiliation disclaimers on five surfaces.
• Signed distribution. Authenticode signing with an SSL.com IV (Individual Validation) certificate — key held in SSL.com's HSM, CodeSignTool signing gated by YubiKey TOTP — with an AV pre-submission pass before Store upload.
• Store certification. Partner Center identity, MSIX packaging, and full Microsoft Store certification — published as a private-audience listing (a distribution decision; access or a live demo is available on request). Store ID 9N94QX8NNFJ1.
• A repeatable playbook. The entire path is written down so the next release is a procedure, not an adventure.