AppOmni

Cloud Security

Overview

The AppOmni Connector integrates with AppOmni, a SaaS Security Posture Management (SSPM) platform, to synchronize monitored SaaS services, security posture findings, policy definitions, users, and groups into Brinqa.

Data retrieved from AppOmni

Connector Object	Required	Maps to Data Model
MonitoredService → Application	Yes	Application
PostureFinding → Violation	Yes	Violation
PostureFindingDefinition → ViolationDefinition	Yes	Violation Definition
User → Person	Yes	Person
Group → Team	Yes	Team

Model relationships

note

For detailed steps on how to view the data retrieved from AppOmni in the Brinqa Platform, see How to view your data.

note

Note: The SCIM Users endpoint does not support additional query parameter filters beyond the standard SCIM filter on meta.lastModified.

note

Note: The SCIM Groups endpoint does not support additional query parameter filters beyond the standard SCIM filter on meta.lastModified.

Setup

Connection settings

When setting up a data integration, select AppOmni from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	No	https://app.appomni.com/api/v1	AppOmni API URL (e.g. https://your-instance.appomni.com/api/v1)
API Token	Yes	—	AppOmni API token for authentication
Page size	No	100	Maximum number of records to get per API request
Maximum retries	No	5	The maximum number of retry attempts before giving up a request

Authentication

The connector authenticates using an API Token.

Endpoint

Method	URL
GET	https://app.appomni.com/api/v1/core/monitoredservice/

Request Headers

Header	Value
Authorization	Token <api_token>
Content-Type	application/json
Accept	application/json

Request Body

None. Authentication uses a static API token; no token-exchange request or request body is required. The token is sent on every request via the Authorization header.

Sample Response

A successful connectivity check against the monitored-service list endpoint returns the standard paginated envelope:

{
  "count": 1922,
  "next": "https://app.appomni.com/api/v1/core/monitoredservice/?limit=1&offset=1",
  "previous": null,
  "results": [
    {
      "id": "a1b2c3d4",
      "name": "Production Salesforce",
      "service_type": "salesforce",
      "is_archived": false,
      "enforcement_mode": "monitoring"
    }
  ]
}

Response Fields

Field	Type	Description
count	Integer	Total number of records available
next	String	URL of the next page, or null when on the last page
previous	String	URL of the previous page, or null when on the first page
results	Array	Page of resource objects

Usage

All API requests include the token in the Authorization header:

Authorization: Token <api_token>

The API token is generated from the AppOmni platform under Settings → API. The connector validates connectivity by calling GET /core/monitoredservice/?limit=1 during the test operation.

---

Sync Behavior

The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.

How to obtain AppOmni credentials

Obtain the required credentials (apiToken) from your AppOmni administrator or the AppOmni admin console, then enter them in the connection settings above.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

MonitoredService → Application

Source Field Name	SDM Attribute
"Application" + serviceType	CATEGORIES
Derived from isArchived / enforcementMode	STATUS
MonitoredServiceResource.created	SOURCE_CREATED_DATE
MonitoredServiceResource.description	DESCRIPTION
MonitoredServiceResource.enforcementMode	ENFORCEMENT_MODE
MonitoredServiceResource.externalId	EXTERNAL_ID
MonitoredServiceResource.id	UID
MonitoredServiceResource.integrationConnected	INTEGRATION_CONNECTED
MonitoredServiceResource.isArchived	IS_ARCHIVED
MonitoredServiceResource.modified	SOURCE_LAST_MODIFIED
MonitoredServiceResource.name or serviceName	NAME
MonitoredServiceResource.openIssuesCount	OPEN_ISSUES_COUNT
MonitoredServiceResource.score	SCORE
MonitoredServiceResource.serviceId	SERVICE_ID
MonitoredServiceResource.serviceName	SERVICE_NAME
MonitoredServiceResource.serviceType	SERVICE_TYPE
Sync timestamp	LAST_CAPTURED

PostureFinding → Violation

Source Field Name	SDM Attribute
FindingResource.appomniRiskLevel	RISK_LEVEL
FindingResource.appomniRiskScore	RISK_SCORE
FindingResource.assignee	ASSIGNEE
FindingResource.created	SOURCE_CREATED_DATE
FindingResource.description or summary	DESCRIPTION
FindingResource.findingType	FINDING_TYPE
FindingResource.firstOpened	FIRST_OPENED
FindingResource.id	UID
FindingResource.lastClosed	LAST_CLOSED
FindingResource.lastOpened	LAST_OPENED
FindingResource.modified	SOURCE_LAST_MODIFIED
FindingResource.monitoredService	TARGETS
FindingResource.monitoredService	MONITORED_SERVICE
FindingResource.policyId	TYPE
FindingResource.policyId	POLICY_ID
FindingResource.policyName	POLICY_NAME
FindingResource.remediationSteps	REMEDIATION_STEPS
FindingResource.severity or appomniRiskLevel (normalized)	SEVERITY
FindingResource.status	PROVIDER_STATUS
FindingResource.status (normalized)	SOURCE_STATUS
FindingResource.summary	SUMMARY
FindingResource.title	NAME
Sync timestamp	LAST_CAPTURED

PostureFindingDefinition → ViolationDefinition

Source Field Name	SDM Attribute
Computed from normalized severity	SEVERITY_SCORE
PolicyResource.category	CATEGORIES
PolicyResource.category	CATEGORY
PolicyResource.created	SOURCE_CREATED_DATE
PolicyResource.description	DESCRIPTION
PolicyResource.externalId	EXTERNAL_ID
PolicyResource.id	UID
PolicyResource.isReference	IS_REFERENCE
PolicyResource.modified	SOURCE_LAST_MODIFIED
PolicyResource.name	NAME
PolicyResource.policyFramework	POLICY_FRAMEWORK
PolicyResource.policyType	TAGS
PolicyResource.policyType	POLICY_TYPE
PolicyResource.severity (normalized)	SEVERITY
PolicyResource.severity (raw)	SOURCE_SEVERITY
Sync timestamp	LAST_CAPTURED

User → Person

Source Field Name	SDM Attribute
"Person"	CATEGORIES
active (active/inactive)	STATUS
active (active/inactive)	EMPLOYMENT_STATUS
displayName	NAME
displayName	DESCRIPTION
emails[*].value	EMAILS
Enterprise extension department	DEPARTMENT
groups[*].value	GROUPS
id	UID
meta.created	SOURCE_CREATED_DATE
meta.lastModified	SOURCE_LAST_MODIFIED
name.familyName	LAST_NAME
name.givenName	FIRST_NAME
Primary email from emails	EMAIL
Sync timestamp	LAST_CAPTURED
title	JOB_TITLE
userName	USERNAME

Group → Team

Source Field Name	SDM Attribute
"active"	STATUS
"Team"	CATEGORIES
displayName	NAME
displayName	DESCRIPTION
id	UID
members.size()	MEMBER_COUNT
members[*].value	MEMBERS
meta.created	SOURCE_CREATED_DATE
meta.lastModified	SOURCE_LAST_MODIFIED
Sync timestamp	LAST_CAPTURED

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

MonitoredService → Application

Operation options

Option	Type	Default	Description
serviceType	String	—	Filter by service type (e.g. google_workspace, salesforce)
isArchived	String	—	Filter by archived status (true or false)
enforcementMode	String	—	Filter by enforcement mode (e.g. monitoring, enforcing)
annotations	String	1	Include computed fields like open_issues_count

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /core/monitoredservice/
• Default filters: annotations=1 (to include computed fields like open_issues_count)

PostureFinding → Violation

Operation options

Option	Type	Default	Description
status	String	—	Filter by status (open or closed)
sourceType	String	—	Filter by source type (scanner or insight)
riskScoreGte	String	—	Minimum risk score threshold
riskScoreLte	String	—	Maximum risk score threshold
monitoredServiceIn	String	—	Comma-separated monitored service IDs

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /findings/finding/
• Default filters: None

PostureFindingDefinition → ViolationDefinition

Operation options

Option	Type	Default	Description
isReference	String	—	Filter by reference policies (true or false)

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /core/policy/
• Default filters: None

User → Person

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: SCIM 2.0 REST endpoint · Endpoint: GET /scim/v2/Users
• Default filters: None

Group → Team

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: SCIM 2.0 REST endpoint · Endpoint: GET /scim/v2/Groups
• Default filters: None

Changelog

Changelog

The AppOmni connector has undergone the following changes:

Version	Description	Migration Steps
3.0.1	Improvements - Updated the AppOmni connector logo	N/A
3.0.0	Overview The AppOmni connector integrates with AppOmni, a SaaS Security Posture Management (SSPM) platform, to synchronize monitored SaaS services, security posture findings, policy definitions, users, and groups. Category: Cloud Security Models	N/A