Aqua SaaS

Cloud Security

Overview
Setup
Data & mappings
Operations & API
Changelog

The Aqua SaaS connector integrates with cloud-hosted Aqua Security deployments to synchronize cloud-native security data, including hosts, container images, containers, serverless functions, vulnerability findings, and vulnerability definitions.

Category: Cloud Security

Data retrieved from Aqua SaaS

Connector Object	Required	Maps to Data Model
🏢 Host	Yes	Host
📦 Container Image	Yes	Container Image
🐳 Container	Yes	Container
⚡ Function	Yes	Serverless
📋 Vulnerability Definition	Yes	Vulnerability Definition
⚠️ Vulnerability	Yes	Vulnerability

Model relationships

note

For detailed steps on how to view the data retrieved from Aqua SaaS in the Brinqa Platform, see How to view your data.

Connection settings

When setting up a data integration, select Aqua SaaS from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	Yes	`https://<tenantId>.cloud.aquasec.com`	Aqua API URL
Auth URL	Yes	`https://api.cloudsploit.com`	Aqua authentication API URL
API key	No	—	Aqua API key
API secret	Yes	—	Aqua API secret
Page size	No	`100`	Maximum number of records to get per API request
Parallel requests	No	`min(CPUs, 4)`	Maximum number of parallel API requests
Request timeout (secs)	No	`120`	The maximum seconds allotted before a request will time out. Enter zero (0) to disable timeouts (not recommended).
Maximum retries	No	`5`	The maximum number of retry attempts before giving up a request

Authentication

Authenticates using API Key + HMAC-SHA256 signed requests against the Aqua SaaS token endpoint.

Endpoint

Method	URL
`POST`	`{loginUrl}/v2/tokens`

Request Headers

Header	Value
`Content-Type`	`application/json`
`X-API-Key`	`<api-key>`
`X-Timestamp`	`<unix-epoch-seconds>`
`X-Signature`	`HMAC-SHA256(secret, timestamp + method + path + body)`

Request Body

{
  "validity": 1500,
  "allowed_endpoints": ["ANY"]
}

Sample Response

{
  "data": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "status": 200,
  "message": "Token generated successfully"
}

Response Fields

Field	Description
`data`	The bearer token used to authenticate subsequent API requests
`status`	HTTP status of the token request
`message`	Human-readable result message

Usage

The token is read from the data field and cached with a client-side expiry of ~25 hours (the requested validity of 1500 minutes). It is supplied on every subsequent API request via the Authorization header:

Authorization: Bearer <token>

When the cached token nears expiry, the connector automatically requests a new one.

Sync Behavior

Each sync is a full sync. The connector does not apply an incremental since filter to the Aqua API, so every run re-fetches the complete set of records for each enabled model. A since value derived from the sync token is accepted but is not sent to the API as a server-side filter; instead, lifecycle handling ages out records that are no longer returned. The per-model mechanics are documented under each model's Data Source below.

How to obtain Aqua SaaS credentials

Generate Aqua SaaS API credentials

For the Aqua SaaS connector to retrieve data from the Aqua API, you must provide API credentials with the necessary permissions. To do so, follow these steps:

Log in to your organization's Aqua portal as an administrator.
Navigate to Account Management > Settings > API Keys.
Click Generate Key.
Provide a Description for the API key, and then click Create.

Your API key and API secret display. You cannot view the API secret again after this. Copy and save it to a secure location.
After generating the API key, click the kebab (three vertical dots) next to the new API key, and then click Edit.
Disable the Global Permissions toggle and enable the following Granular Permissions, as these are the minimum permissions required to retrieve data from the Aqua API:
- roles:assign
- tokens:readwrite
  - Click the dropdown under the tokens-readwrite permission and select Read-Only.
Click Save.

Note: If you do not have permissions to generate API credentials, contact your Aqua administrator. For additional information, see Aqua Platform documentation on API credentials and API key permissions.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

🏢 Host

Source Field Name	SDM Attribute
`AssetResource.createdDate()`	SOURCE_CREATED_DATE
`AssetResource.isAgentless()`	AGENTLESS
`AssetResource.isEnforced()`	ENFORCED
`AssetResource.isGatewayExists()`	GATEWAY_EXISTS
`AssetResource.name()`	NAME
`AssetResource.nodeId() ∥ id()`	UID
`CloudInfo.vmAccountId()`	CLOUD_ACCOUNT_ID
`CloudInfo.vmId()`	INSTANCE_ID
`CloudInfo.vmImageId()`	VM_IMAGE_ID
`CloudInfo.vmLocation()`	REGION
`CloudInfo.vmPrivateIps()`	PRIVATE_IP_ADDRESSES
`CloudInfo.vmPublicDns()`	PUBLIC_DNS_NAMES
`CloudInfo.vmPublicIps()`	PUBLIC_IP_ADDRESSES
`CloudInfo.vmSubnets()`	VM_SUBNETS
`CloudInfo.vmTags()`	TAGS
`CloudInfo.vmVendorName()`	CLOUD_PROVIDER
`CloudInfo.vmVpcIds()`	VM_VPC_IDS
Derived from cloud metadata	DESCRIPTION
Filtered from hostnames	PRIVATE_DNS_NAMES
`Host OS (when reported by the platform)`	OPERATING_SYSTEM
`Instant.now()`	LAST_CAPTURED
`SecurityIssues.lastVulnScan()`	LAST_ASSESSED
`SecurityIssues.lastVulnScan()`	LAST_SEEN
Static: Active	STATUS
Static: Host	CATEGORIES
vmHostname, vmLogicalName	HOSTNAMES
vmHostname, vmLogicalName, vmPublicDns	DNS_NAMES
vmPrivateIps, vmPublicIps	IP_ADDRESSES

📦 Container Image

Source Field Name	SDM Attribute
`ImageResource.architecture()`	ARCHITECTURE
`ImageResource.author()`	AUTHOR
`ImageResource.created()`	FIRST_SEEN
`ImageResource.created()`	SOURCE_CREATED_DATE
`ImageResource.digest()`	DIGEST
`ImageResource.disallowed()`	DISALLOWED
`ImageResource.name()`	UID
`ImageResource.name()`	NAME
`ImageResource.os()`	OPERATING_SYSTEM
`ImageResource.osVersion()`	OS_VERSION
`ImageResource.registry()`	REGISTRY
`ImageResource.registryType()`	REGISTRY_TYPE
`ImageResource.repository()`	REPOSITORY
`ImageResource.scan_error()`	SCAN_ERROR
`ImageResource.scanDate()`	LAST_ASSESSED
`ImageResource.scanDate()`	LAST_SEEN
`ImageResource.scanStatus()`	SCAN_STATUS
`ImageResource.tag()`	TAG
`ImageResource.whitelisted()`	WHITELISTED
`Instant.now()`	LAST_CAPTURED
`labels(), Metadata.dockerLabels()`	TAGS
Static: Active	STATUS
Static: Container Image	CATEGORIES

🐳 Container

Source Field Name	SDM Attribute
`ContainerResource.id() ∥ name()`	UID
`ContainerResource.modifyTime()`	LAST_SEEN
`ContainerResource.name()`	NAME
`ContainerResource.status() (normalized)`	STATUS
`Earlier of createTime() / startTime()`	FIRST_SEEN
`hostId() ∥ hostName()`	Host
`imageId() ∥ imageName()`	IMAGE
`Instant.now()`	LAST_CAPTURED
Static: Container	CATEGORIES

⚡ Function

Source Field Name	SDM Attribute
`FunctionResource.description()`	DESCRIPTION
`FunctionResource.getFunctionId()`	UID
`FunctionResource.lastScan()`	LAST_ASSESSED
`FunctionResource.lastScan()`	LAST_SEEN
`FunctionResource.name()`	NAME
`FunctionResource.runtimeLanguage()`	RUNTIME_LANGUAGE
`FunctionResource.runtimeVersion()`	RUNTIME_VERSION
`FunctionResource.tags()`	TAGS
`FunctionResource.version()`	REVISION
`Instant.now()`	LAST_CAPTURED
Static: Active	STATUS
Static: Serverless	CATEGORIES

📋 Vulnerability Definition

Source Field Name	SDM Attribute
`cisaDueDate`	CISA_DUE_DATE
`cisaPublishedDate`	CISA_ADDED_DATE
`classification`	CATEGORIES
`classification`	AQUA_CLASSIFICATION
cpe, resource	AFFECTED
Derived from exploit type / CISA dates	CISA_EXPLOITED
Derived from severity	SEVERITY_SCORE
Derived from vulnerabilityName	UID
Derived: Actively used / Available / Unproven	EXPLOITABILITY
`description`	DESCRIPTION
`epssPercentile`	EPSS_PERCENTILE
`epssScore`	EPSS_SCORE
`exploitType`	EXPLOIT_TYPE
`fixVersion`	FIXED_VERSION
`installedVersion`	AFFECTED_VERSION
`Instant.now()`	LAST_CAPTURED
`modificationDate`	SOURCE_LAST_MODIFIED
Normalized from severity	SEVERITY
`nvdSeverity`	NVD_SEVERITY
Parsed from aquaVectors	CVSS_V2_*
Parsed from aquaVectors	CVSS_V3_*
`publishDate`	PUBLISHED_DATE
`remoteExploit`	REMOTE_EXPLOIT
`severity`	SOURCE_SEVERITY
`vendorCvssv3Severity`	VENDOR_SEVERITY
`vendorStatement`	VENDOR_STATEMENT
vendorUrl, nvdUrl, exploitAvailability	REFERENCES
`vulnerabilityName`	NAME
`vulnerabilityName (if CVE-prefixed)`	CVE_IDS
`vulnerabilityName (if CVE-prefixed)`	CVE_RECORDS

⚠️ Vulnerability

Source Field Name	SDM Attribute
"Image" / "Host" / "Function"	ASSET_TYPE
`aquaUniqueId`	UID
Asset-specific IDs	TARGETS
`customSeverity`	CUSTOM_SEVERITY
Derived from resource/CPE/versions/path	RESULTS
Derived from severity	SEVERITY_SCORE
Derived from source severity	SOURCE_SEVERITY_SCORE
Derived from status	STATUS_CATEGORY
`description`	DESCRIPTION
`firstFound`	FIRST_FOUND
`functionId`	FUNCTION_ID
`functionName`	FUNCTION_NAME
`functionUid`	FUNCTION_UID
`imageDigest`	IMAGE_DIGEST
`imageName`	IMAGE_NAME
`imageUid`	IMAGE_UID
`Instant.now()`	LAST_CAPTURED
`lastFound`	LAST_FOUND
Links to Vulnerability Definition	TYPE
`namespace`	NAMESPACE
Normalized from severity	SEVERITY
Normalized from status	SOURCE_STATUS
Normalized from status	STATUS
`runningWorkloadsCount`	RUNNING_WORKLOADS_COUNT
`severity`	SOURCE_SEVERITY
`solution`	RECOMMENDATION
`status`	PROVIDER_STATUS
`vmId`	VM_ID
`vmName`	VM_NAME
`vulnerabilityName`	NAME
`workloads`	HAS_RUNNING_WORKLOADS

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

🏢 Host

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of 🏢 Host on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: GET {url}/api/v2/infrastructure
Default filters: None

📦 Container Image

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of 📦 Container Image on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: GET {url}/api/v2/images
Default filters: None

🐳 Container

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of 🐳 Container on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: GET {url}/api/v2/containers
Default filters: None

⚡ Function

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of ⚡ Function on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: GET {url}/api/v2/serverless/functions
Default filters: None

📋 Vulnerability Definition

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of 📋 Vulnerability Definition on every run and applies no incremental date filter.

API

Type: REST asynchronous export (CSV records delivered in a ZIP archive)
Default filters: None (all export filters are optional; see Sync Options)

⚠️ Vulnerability

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of ⚠️ Vulnerability on every run and applies no incremental date filter.

API

Type: REST asynchronous export (CSV records delivered in a ZIP archive) — the same export pipeline as the Vulnerability Definition model above
Default filters: None (all export filters are optional; see Sync Options)

Changelog

The Aqua SaaS connector has undergone the following changes:

Version	Description	Migration Steps
4.0.6	Bug Fixes - Fixed connector failing to deserialize authentication token on certain platform versions by restoring bundled Jackson dependencies	N/A
4.0.5	Improvements - Added `LAST_CAPTURED` timestamp tracking across all models (Host, Container, Container Image, Function, Vulnerability Definition) for more accurate lifecycle management - Added `STATUS` and `CATEGORIES` attributes to asset models, enabling standardized asset status reporting and category-based classification Bug Fixes - Fixed `has_workloads` filter parameter to use string type instead of boolean, resolving API compatibility issues with the Aqua vulnerability export endpoint	N/A
4.0.4	New Features - Added a `LAST_CAPTURED` timestamp to the Vulnerability model, recording when each finding was last observed during synchronization. Improvements - Vulnerability lifecycle management now retires findings based on when they were last captured (`LAST_CAPTURED`) rather than last seen, giving more accurate aging for vulnerabilities that are no longer reported. - Refreshed automatic retirement of Host, Container, and Container Image assets that have not been seen in the last 7 days.	N/A
4.0.3	New Features - Added a `Namespace` attribute to the Vulnerability model, capturing the Kubernetes namespace associated with each finding. - Added a `namespace_names` collection option to filter the vulnerability export by one or more namespaces.	N/A
4.0.2	New Features - Added an `include_vpatch_info` option to include Aqua vShield (vPatch) information in the vulnerability export.	N/A
4.0.1	New Features - Added `Has running workloads` and `Running workloads count` attributes to the Vulnerability model, indicating whether a vulnerable image or function has active workloads and how many. Bug Fixes - Corrected JSON mapping of several image scan result fields (partial results, newer image exists, pending disallowed, and microenforcer detected) so they populate reliably.	N/A
4.0.0	Overview The Aqua SaaS connector integrates with Aqua Security to synchronize container, host, and serverless workload inventory along with their vulnerability findings and definitions. Category: Cloud Security Models	N/A
3.1.3	Improvements - Added automatic lifecycle management so Host, Container, Container Image, and Vulnerability records that have not been seen in the last 7 days are retired automatically.	N/A
3.1.2	Bug Fixes - Fixed CVSS v3 vector parsing so malformed vectors are skipped gracefully instead of failing the sync, with the affected CVE logged. - Corrected the NVD CVSS v3 vector fallback to return the vector string rather than the severity value.	N/A
3.1.1	No changes in this release.	N/A
3.1.0	Improvements - Split the Aqua integration into separate SaaS and self-hosted connectors, each with authentication tailored to its platform.	N/A
3.0.3	Bug Fixes - Fixed Container Image tags to be sourced from the image's Docker labels, resolving cases where tags were populated incorrectly.	N/A
3.0.2	New Features - Added an `Exploit type` attribute to the Vulnerability Definition model and included exploitability references in the definition's reference list.	N/A
3.0.1	No changes in this release.	N/A
3.0.0	Overview The Aqua SaaS connector integrates with Aqua Security to synchronize container and host inventory along with their vulnerability findings and definitions. Category: Container Security Models	N/A

Data retrieved from Aqua SaaS​

Model relationships​

Connection settings​

Authentication​

Endpoint​

Request Headers​

Request Body​

Sample Response​

Response Fields​

Usage​

Sync Behavior​

Generate Aqua SaaS API credentials​

Attribute mappings​

Operations & API​

Changelog​

Data retrieved from Aqua SaaS

Model relationships

Connection settings

Authentication

Endpoint

Request Headers

Request Body

Sample Response

Response Fields

Usage

Sync Behavior

Generate Aqua SaaS API credentials

Attribute mappings

Operations & API

Changelog