Aqua Enterprise
Cloud Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Aqua Enterprise connector integrates with self-hosted Aqua Security deployments to synchronize cloud-native security data, including hosts, container images, containers, serverless functions, vulnerability findings, and vulnerability definitions.
Category: Cloud Security
Data retrieved from Aqua Enterprise
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| 🏢 Host | Yes | Host |
| 📦 Container Image | Yes | Container Image |
| 🐳 Container | Yes | Container |
| ⚡ Function | Yes | Serverless |
| 📋 Vulnerability Definition | Yes | Vulnerability Definition |
| ⚠️ Vulnerability | Yes | Vulnerability |
Model relationships
For detailed steps on how to view the data retrieved from Aqua Enterprise in the Brinqa Platform, see How to view your data.
The has_workloads filter is not reliably honored by the Aqua Enterprise export API. In practice, the API can return the full, unfiltered record set for an entity type even when has_workloads is set — the hosts export in particular has been observed exporting the total number of records (exported_count well above the reported total_count) rather than only those with running workloads. The images export honored the filter in the same session. If you only need one entity type, set asset_types accordingly (e.g. asset_types = images) to avoid pulling the unfiltered hosts report.
Connection settings
When setting up a data integration, select Aqua Enterprise from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Server URL | Yes | — | Aqua server URL |
| Username | Yes | — | Aqua account username |
| Password | Yes | — | Aqua account password |
| Page size | No | 100 | Maximum number of records to get per API request |
| Parallel requests | No | min(CPUs, 4) | Maximum number of parallel API requests |
| Request timeout (secs) | No | 120 | The maximum seconds allotted before a request will time out. Enter zero (0) to disable timeouts (not recommended). |
| Maximum retries | No | 5 | The maximum number of retry attempts before giving up a request |
| SSL / TLS | No | false | Skip certificate verification |
Authentication
Authenticates using username/password credentials against the Aqua Enterprise API.
Endpoint
| Method | URL |
|---|---|
POST | {url}/api/v1/login |
Request Headers
| Header | Value |
|---|---|
Content-Type | application/json |
Request Body
{
"id": "your-username",
"password": "your-password"
}
Sample Response
{
"data": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"status": 200,
"message": "Login successful"
}
Response Fields
| Field | Description |
|---|---|
data | The bearer token used to authenticate subsequent API requests |
status | HTTP status of the login request |
message | Human-readable result message |
Usage
The token is read from the data field and cached with a client-side expiry of ~9 hours. It is supplied on every subsequent API request via the Authorization header:
Authorization: Bearer <token>
When the cached token nears expiry, the connector automatically re-authenticates.
Sync Behavior
Each sync is a full sync. The connector does not apply an incremental since filter to the Aqua API, so every run re-fetches the complete set of records for each enabled model. A since value derived from the sync token is accepted but is not sent to the API as a server-side filter; instead, lifecycle handling ages out records that are no longer returned. The per-model mechanics are documented under each model's Data Source below.
How to obtain Aqua Enterprise credentials
Obtain the required credentials (url, username, password) from your Aqua Enterprise administrator or the Aqua Enterprise admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
🏢 Host
| Source Field Name | SDM Attribute |
|---|---|
AssetResource.createdDate() | SOURCE_CREATED_DATE |
AssetResource.isAgentless() | AGENTLESS |
AssetResource.isEnforced() | ENFORCED |
AssetResource.isGatewayExists() | GATEWAY_EXISTS |
AssetResource.name() | NAME |
AssetResource.nodeId() ∥ id() | UID |
CloudInfo.vmAccountId() | CLOUD_ACCOUNT_ID |
CloudInfo.vmId() | INSTANCE_ID |
CloudInfo.vmImageId() | VM_IMAGE_ID |
CloudInfo.vmLocation() | REGION |
CloudInfo.vmPrivateIps() | PRIVATE_IP_ADDRESSES |
CloudInfo.vmPublicDns() | PUBLIC_DNS_NAMES |
CloudInfo.vmPublicIps() | PUBLIC_IP_ADDRESSES |
CloudInfo.vmSubnets() | VM_SUBNETS |
CloudInfo.vmTags() | TAGS |
CloudInfo.vmVendorName() | CLOUD_PROVIDER |
CloudInfo.vmVpcIds() | VM_VPC_IDS |
| Derived from cloud metadata | DESCRIPTION |
| Filtered from hostnames | PRIVATE_DNS_NAMES |
Host OS (when reported by the platform) | OPERATING_SYSTEM |
Instant.now() | LAST_CAPTURED |
SecurityIssues.lastVulnScan() | LAST_ASSESSED |
SecurityIssues.lastVulnScan() | LAST_SEEN |
| Static: Active | STATUS |
| Static: Host | CATEGORIES |
| vmHostname, vmLogicalName | HOSTNAMES |
| vmHostname, vmLogicalName, vmPublicDns | DNS_NAMES |
| vmPrivateIps, vmPublicIps | IP_ADDRESSES |
📦 Container Image
| Source Field Name | SDM Attribute |
|---|---|
ImageResource.architecture() | ARCHITECTURE |
ImageResource.author() | AUTHOR |
ImageResource.created() | FIRST_SEEN |
ImageResource.created() | SOURCE_CREATED_DATE |
ImageResource.digest() | DIGEST |
ImageResource.disallowed() | DISALLOWED |
ImageResource.name() | UID |
ImageResource.name() | NAME |
ImageResource.os() | OPERATING_SYSTEM |
ImageResource.osVersion() | OS_VERSION |
ImageResource.registry() | REGISTRY |
ImageResource.registryType() | REGISTRY_TYPE |
ImageResource.repository() | REPOSITORY |
ImageResource.scan_error() | SCAN_ERROR |
ImageResource.scanDate() | LAST_ASSESSED |
ImageResource.scanDate() | LAST_SEEN |
ImageResource.scanStatus() | SCAN_STATUS |
ImageResource.tag() | TAG |
ImageResource.whitelisted() | WHITELISTED |
Instant.now() | LAST_CAPTURED |
labels(), Metadata.dockerLabels() | TAGS |
| Static: Active | STATUS |
| Static: Container Image | CATEGORIES |
🐳 Container
| Source Field Name | SDM Attribute |
|---|---|
ContainerResource.id() ∥ name() | UID |
ContainerResource.modifyTime() | LAST_SEEN |
ContainerResource.name() | NAME |
ContainerResource.status() (normalized) | STATUS |
Earlier of createTime() / startTime() | FIRST_SEEN |
hostId() ∥ hostName() | Host |
imageId() ∥ imageName() | IMAGE |
Instant.now() | LAST_CAPTURED |
| Static: Container | CATEGORIES |
⚡ Function
| Source Field Name | SDM Attribute |
|---|---|
FunctionResource.description() | DESCRIPTION |
FunctionResource.getFunctionId() | UID |
FunctionResource.lastScan() | LAST_ASSESSED |
FunctionResource.lastScan() | LAST_SEEN |
FunctionResource.name() | NAME |
FunctionResource.runtimeLanguage() | RUNTIME_LANGUAGE |
FunctionResource.runtimeVersion() | RUNTIME_VERSION |
FunctionResource.tags() | TAGS |
FunctionResource.version() | REVISION |
Instant.now() | LAST_CAPTURED |
| Static: Active | STATUS |
| Static: Serverless | CATEGORIES |
📋 Vulnerability Definition
| Source Field Name | SDM Attribute |
|---|---|
cisaDueDate | CISA_DUE_DATE |
cisaPublishedDate | CISA_ADDED_DATE |
classification | CATEGORIES |
classification | AQUA_CLASSIFICATION |
| cpe, resource | AFFECTED |
| Derived from exploit type / CISA dates | CISA_EXPLOITED |
| Derived from severity | SEVERITY_SCORE |
| Derived from vulnerabilityName | UID |
| Derived: Actively used / Available / Unproven | EXPLOITABILITY |
description | DESCRIPTION |
epssPercentile | EPSS_PERCENTILE |
epssScore | EPSS_SCORE |
exploitType | EXPLOIT_TYPE |
fixVersion | FIXED_VERSION |
installedVersion | AFFECTED_VERSION |
Instant.now() | LAST_CAPTURED |
modificationDate | SOURCE_LAST_MODIFIED |
| Normalized from severity | SEVERITY |
nvdSeverity | NVD_SEVERITY |
| Parsed from aquaVectors | CVSS_V2_* |
| Parsed from aquaVectors | CVSS_V3_* |
publishDate | PUBLISHED_DATE |
remoteExploit | REMOTE_EXPLOIT |
severity | SOURCE_SEVERITY |
vendorCvssv3Severity | VENDOR_SEVERITY |
vendorStatement | VENDOR_STATEMENT |
| vendorUrl, nvdUrl, exploitAvailability | REFERENCES |
vulnerabilityName | NAME |
vulnerabilityName (if CVE-prefixed) | CVE_IDS |
vulnerabilityName (if CVE-prefixed) | CVE_RECORDS |
⚠️ Vulnerability
| Source Field Name | SDM Attribute |
|---|---|
| "Image" / "Host" / "Function" | ASSET_TYPE |
aquaUniqueId | UID |
| Asset-specific IDs | TARGETS |
customSeverity | CUSTOM_SEVERITY |
| Derived from resource/CPE/versions/path | RESULTS |
| Derived from severity | SEVERITY_SCORE |
| Derived from source severity | SOURCE_SEVERITY_SCORE |
| Derived from status | STATUS_CATEGORY |
description | DESCRIPTION |
firstFound | FIRST_FOUND |
functionId | FUNCTION_ID |
functionName | FUNCTION_NAME |
functionUid | FUNCTION_UID |
imageDigest | IMAGE_DIGEST |
imageName | IMAGE_NAME |
imageUid | IMAGE_UID |
Instant.now() | LAST_CAPTURED |
lastFound | LAST_FOUND |
| Links to Vulnerability Definition | TYPE |
namespace | NAMESPACE |
| Normalized from severity | SEVERITY |
| Normalized from status | SOURCE_STATUS |
| Normalized from status | STATUS |
runningWorkloadsCount | RUNNING_WORKLOADS_COUNT |
severity | SOURCE_SEVERITY |
solution | RECOMMENDATION |
status | PROVIDER_STATUS |
vmId | VM_ID |
vmName | VM_NAME |
vulnerabilityName | NAME |
workloads | HAS_RUNNING_WORKLOADS |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
🏢 Host
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of 🏢 Host on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET {url}/api/v2/infrastructure - Default filters: None
📦 Container Image
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of 📦 Container Image on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET {url}/api/v2/images - Default filters: None
🐳 Container
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of 🐳 Container on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET {url}/api/v2/containers - Default filters: None
⚡ Function
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of ⚡ Function on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET {url}/api/v2/serverless/functions - Default filters: None
📋 Vulnerability Definition
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of 📋 Vulnerability Definition on every run and applies no incremental date filter.
API
- Type: REST asynchronous export (CSV records delivered in a ZIP archive)
- Default filters: None (all export filters are optional; see Sync Options)
⚠️ Vulnerability
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of ⚠️ Vulnerability on every run and applies no incremental date filter.
API
- Type: REST asynchronous export (CSV records delivered in a ZIP archive) — the same export pipeline as the Vulnerability Definition model above
- Default filters: None (all export filters are optional; see Sync Options)
Changelog
The Aqua Enterprise connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 4.0.6 | Bug Fixes - Fixed connector failing to deserialize authentication token on certain platform versions by restoring bundled Jackson dependencies | N/A |
| 4.0.5 | Improvements - Added LAST_CAPTURED timestamp tracking across all models (Host, Container, Container Image, Function, Vulnerability Definition) for more accurate lifecycle management - Added STATUS and CATEGORIES attributes to asset models, enabling standardized asset status reporting and category-based classification Bug Fixes - Fixed has_workloads filter parameter to use string type instead of boolean, resolving API compatibility issues with the Aqua vulnerability export endpoint | N/A |
| 4.0.4 | New Features - Added a LAST_CAPTURED timestamp to the Vulnerability model, recording when each finding was last observed during synchronization. Improvements - Vulnerability lifecycle management now retires findings based on when they were last captured ( LAST_CAPTURED) rather than last seen, giving more accurate aging for vulnerabilities that are no longer reported. - Refreshed automatic retirement of Host, Container, and Container Image assets that have not been seen in the last 7 days. | N/A |
| 4.0.3 | New Features - Added a Namespace attribute to the Vulnerability model, capturing the Kubernetes namespace associated with each finding. - Added a namespace_names collection option to filter the vulnerability export by one or more namespaces. | N/A |
| 4.0.2 | New Features - Added an include_vpatch_info option to include Aqua vShield (vPatch) information in the vulnerability export. | N/A |
| 4.0.1 | New Features - Added Has running workloads and Running workloads count attributes to the Vulnerability model, indicating whether a vulnerable image or function has active workloads and how many. Bug Fixes - Corrected JSON mapping of several image scan result fields (partial results, newer image exists, pending disallowed, and microenforcer detected) so they populate reliably. | N/A |
| 4.0.0 | Overview The Aqua Enterprise connector integrates with Aqua Security to synchronize container, host, and serverless workload inventory along with their vulnerability findings and definitions. Category: Cloud Security Models | N/A |
| 3.1.3 | Improvements - Added automatic lifecycle management so Host, Container, Container Image, and Vulnerability records that have not been seen in the last 7 days are retired automatically. | N/A |
| 3.1.2 | Bug Fixes - Fixed CVSS v3 vector parsing so malformed vectors are skipped gracefully instead of failing the sync, with the affected CVE logged. - Corrected the NVD CVSS v3 vector fallback to return the vector string rather than the severity value. | N/A |
| 3.1.1 | No changes in this release. | N/A |
| 3.1.0 | Improvements - Split the Aqua integration into separate SaaS and self-hosted connectors, each with authentication tailored to its platform. | N/A |
| 3.0.3 | Bug Fixes - Fixed Container Image tags to be sourced from the image's Docker labels, resolving cases where tags were populated incorrectly. | N/A |
| 3.0.2 | New Features - Added an Exploit type attribute to the Vulnerability Definition model and included exploitability references in the definition's reference list. | N/A |
| 3.0.1 | No changes in this release. | N/A |
| 3.0.0 | Overview The Aqua Enterprise connector integrates with Aqua Security to synchronize container and host inventory along with their vulnerability findings and definitions. Category: Container Security Models | N/A |