AppOmni

Cloud Security

Overview

The AppOmni Connector integrates with AppOmni, a SaaS Security Posture Management (SSPM) platform, to synchronize monitored SaaS services, security posture findings, policy definitions, users, and groups into Brinqa.

Data retrieved from AppOmni

Connector Object	Required	Maps to Data Model
MonitoredService → Application	Yes	Application
PostureFinding → Violation	Yes	Violation
PostureFindingDefinition → ViolationDefinition	Yes	Violation Definition
User → Person	Yes	Person
Group → Team	Yes	Team

Model relationships

note

For detailed steps on how to view the data retrieved from AppOmni in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select AppOmni from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	Yes	—	AppOmni API URL for your instance, including /api/v1 (e.g. https://your-instance.appomni.com/api/v1)
API Token	Yes	—	AppOmni API token for authentication
Page size	No	100	Maximum number of records to get per API request
Maximum retries	No	5	The maximum number of retry attempts before giving up a request

Authentication

The connector authenticates using an API Token.

Endpoint

Method	URL
GET	https://<your-instance>.appomni.com/api/v1/core/monitoredservice/

Request Headers

Header	Value
Authorization	Bearer <access_token>
Content-Type	application/json
Accept	application/json

Request Body

None. The connector sends a pre-existing Access Token on every request via the Authorization header; it does not perform the OAuth token exchange.

Sample Response

A successful connectivity check against the monitored-service list endpoint returns the standard paginated envelope:

{
  "count": 1922,
  "next": "https://<your-instance>.appomni.com/api/v1/core/monitoredservice/?limit=1&offset=1",
  "previous": null,
  "results": [
    {
      "id": "a1b2c3d4",
      "name": "Production Salesforce",
      "service_type": "salesforce",
      "enforcement_mode": "monitoring"
    }
  ]
}

Response Fields

Field	Type	Description
count	Integer	Total number of records available
next	String	URL of the next page, or null when on the last page
previous	String	URL of the previous page, or null when on the first page
results	Array	Page of resource objects

Usage

All API requests include the token in the Authorization header:

Authorization: Bearer <access_token>

The Access Token is generated from the AppOmni platform under Settings → API Settings.

---

Sync Behavior

The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.

How to obtain AppOmni credentials

Obtain the required credentials (url, apiToken) from your AppOmni administrator or the AppOmni admin console, then enter them in the connection settings above.

note

The User and Group models use AppOmni's SCIM 2.0 API, which is served at the host root (https://<your-instance>.appomni.com/scim/v2/) rather than under /api/v1. The connector derives that address from the configured API URL automatically.

note

Access tokens expire on the date set when they are created, and the connector cannot renew them. For scheduled syncs, generate a long-lived token via Settings → API Settings → Manage Tokens → "Manually Grant Access Token with Specific Expiration Date". The connector validates connectivity by calling GET /core/monitoredservice/?limit=1 during the test operation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

MonitoredService → Application

Source Field Name	SDM Attribute
"Application" + serviceType	CATEGORIES
Derived from isArchived / enforcementMode	STATUS
MonitoredServiceResource.created	SOURCE_CREATED_DATE
MonitoredServiceResource.description	DESCRIPTION
MonitoredServiceResource.enforcementMode	ENFORCEMENT_MODE
MonitoredServiceResource.externalId	EXTERNAL_ID
MonitoredServiceResource.id	UID
MonitoredServiceResource.integrationConnected	INTEGRATION_CONNECTED
MonitoredServiceResource.isArchived	IS_ARCHIVED
MonitoredServiceResource.modified	SOURCE_LAST_MODIFIED
MonitoredServiceResource.name or serviceName	NAME
MonitoredServiceResource.openIssuesCount	OPEN_ISSUES_COUNT
MonitoredServiceResource.score	SCORE
MonitoredServiceResource.serviceId	SERVICE_ID
MonitoredServiceResource.serviceName	SERVICE_NAME
MonitoredServiceResource.serviceType	SERVICE_TYPE
Sync timestamp	LAST_CAPTURED
tags of type environment via /core/tag/	ENVIRONMENTS
tags resolved via GET /core/tag/	TAGS

PostureFinding → Violation

Source Field Name	SDM Attribute
FindingResource.appomniRiskLevel	RISK_LEVEL
FindingResource.appomniRiskScore	RISK_SCORE
FindingResource.assignee	ASSIGNEE
FindingResource.description	NAME
FindingResource.firstOpened	FIRST_OPENED
FindingResource.id	UID
FindingResource.lastClosed	LAST_CLOSED
FindingResource.lastOpened	LAST_OPENED
FindingResource.monitoredServiceId	TARGETS
FindingResource.monitoredServiceName	MONITORED_SERVICE
FindingResource.policyId	TYPE
FindingResource.policyId	POLICY_ID
FindingResource.policyName	POLICY_NAME
FindingResource.remediationDescription.content	REMEDIATION_STEPS
FindingResource.riskDescription.content	DESCRIPTION
FindingResource.severity or appomniRiskLevel (normalized)	SEVERITY
FindingResource.status	PROVIDER_STATUS
FindingResource.status (normalized)	SOURCE_STATUS
FindingResource.tags	TAGS
monitoredServiceOwner.firstName + lastName	MONITORED_SERVICE_OWNER
monitoredServiceTags of type environment	ENVIRONMENTS
Sync timestamp	LAST_CAPTURED
—	SOURCE_CREATED_DATE
—	SOURCE_LAST_MODIFIED
—	SUMMARY
—	FINDING_TYPE

PostureFindingDefinition → ViolationDefinition

Source Field Name	SDM Attribute
Computed from normalized severity	SEVERITY_SCORE
PolicyResource.category	CATEGORIES
PolicyResource.category	CATEGORY
PolicyResource.created	SOURCE_CREATED_DATE
PolicyResource.description	DESCRIPTION
PolicyResource.externalId	EXTERNAL_ID
PolicyResource.id	UID
PolicyResource.isReference	IS_REFERENCE
PolicyResource.modified	SOURCE_LAST_MODIFIED
PolicyResource.name	NAME
PolicyResource.policyType	TAGS
PolicyResource.policyType	POLICY_TYPE
PolicyResource.severity (normalized)	SEVERITY
PolicyResource.severity (raw)	SOURCE_SEVERITY
Sync timestamp	LAST_CAPTURED
—	POLICY_FRAMEWORK

User → Person

Source Field Name	SDM Attribute
"Person"	CATEGORIES
active (active/inactive)	STATUS
active (active/inactive)	EMPLOYMENT_STATUS
displayName	NAME
displayName	DESCRIPTION
emails[*].value	EMAILS
groups[*].value	GROUPS
id	UID
meta.created	SOURCE_CREATED_DATE
meta.lastModified	SOURCE_LAST_MODIFIED
name.familyName	LAST_NAME
name.givenName	FIRST_NAME
Primary email from emails	EMAIL
Sync timestamp	LAST_CAPTURED
userName	USERNAME
—	JOB_TITLE
—	DEPARTMENT

Group → Team

Source Field Name	SDM Attribute
"active"	STATUS
"Team"	CATEGORIES
displayName	NAME
displayName	DESCRIPTION
id	UID
members.size()	MEMBER_COUNT
members[*].value	MEMBERS
meta.created	SOURCE_CREATED_DATE
meta.lastModified	SOURCE_LAST_MODIFIED
Sync timestamp	LAST_CAPTURED

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

MonitoredService → Application

Operation options

Option	Type	Default	Description
serviceType	String	—	Filter by service type (e.g. google_workspace, salesforce)
isArchived	String	—	Filter by archived status (true or false)
enforcementMode	String	—	Filter by enforcement mode (e.g. monitoring, enforcing)
annotations	String	1	Include computed fields like open_issues_count

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on modified__gte.

API

• Type: REST endpoint · Endpoint: GET /core/monitoredservice/, plus GET /core/tag/ once per sync to resolve tag IDs to names
• Default filters: annotations=1 (to include computed fields like open_issues_count)

PostureFinding → Violation

Operation options

Option	Type	Default	Description
status	String	—	Filter by status (open or closed)
sourceType	String	—	Filter by source type (scanner or insight)
riskScoreGte	String	—	Minimum risk score threshold
riskScoreLte	String	—	Maximum risk score threshold
monitoredServiceIn	String	—	Comma-separated monitored service IDs

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on modified__gte.

API

• Type: REST endpoint · Endpoint: GET /findings/finding/
• Default filters: None

PostureFindingDefinition → ViolationDefinition

Operation options

Option	Type	Default	Description
isReference	String	—	Filter by reference policies (true or false)

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on modified__gte.

API

• Type: REST endpoint · Endpoint: GET /core/policy/
• Default filters: None

User → Person

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on meta.lastModified.

API

• Type: SCIM 2.0 REST endpoint · Endpoint: GET /scim/v2/Users
• Default filters: None

Group → Team

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on meta.lastModified.

API

• Type: SCIM 2.0 REST endpoint · Endpoint: GET /scim/v2/Groups
• Default filters: None

Changelog

Changelog

The AppOmni connector has undergone the following changes:

Version	Description	Migration Steps
3.0.2	New Features - Posture Findings now include the environment, the monitored service's owner, and the finding's own tags. - Monitored Services now include their tags and environments, resolved to names rather than internal IDs. Improvements - The API URL is now validated when the connector is configured, with guidance when the instance subdomain or the required /api/v1 path is missing. - The API URL is now a required field and no longer defaults to a value that cannot be used. - The posture score and open issue count on Monitored Services are now labelled as AppOmni labels them. - Documented that compliance framework on Posture Finding Definitions has no source in the AppOmni API, so it is expected to stay empty. Bug Fixes - Corrected the authentication scheme used with the AppOmni API. Syncs that previously failed with authentication errors now complete. - User and Group syncs now request AppOmni's SCIM endpoint at the correct address. These two sources previously failed on every run. - Posture Findings are now linked to the Monitored Service they were raised against, and show its name. Both were previously empty. - Remediation guidance now populates on Posture Findings. It was previously read from a field AppOmni does not return.	N/A
3.0.1	Improvements - Updated the AppOmni connector logo	N/A
3.0.0	Overview The AppOmni connector integrates with AppOmni, a SaaS Security Posture Management (SSPM) platform, to synchronize monitored SaaS services, security posture findings, policy definitions, users, and groups. Category: Cloud Security Models	N/A