Custom Vulnerability check to identify TLS 1.2 enabled services

Hi All,

I am looking for some guidance from experts and community about writing custom vulnerability checks.
As I understood there is support for custom checks, and your can define in XML validation criteria, but it still remains unclear what is the underlying mechanism that enables custom checks and provide data.

Can I use nmap to test if service supports TLS 1.2 or is there another built-in protocol discovery check that can feed the data to custom check?

Thanks!

nmap can check that
https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html