Black Duck Continuous Dynamic
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The WhiteHat Sentinel connector integrates with Black Duck DAST (formerly Synopsys WhiteHat / Sentinel), a dynamic application security testing platform. It synchronizes scanned web applications and mobile apps, sites, vulnerability definitions, dynamic-code findings (DAST), source-code issues, and individual attack vectors into the Brinqa platform.
Data retrieved from Black Duck Continuous Dynamic
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Application | Yes | Application |
| Site | Yes | Site |
| Vulnerability Definition | Yes | Dynamic Code Finding Definition |
| Finding | Yes | Dynamic Code Finding |
| Issue | Yes | Static Code Finding |
| Attack Vector | Yes | Attack Vector |
Model relationships
note
For detailed steps on how to view the data retrieved from Black Duck Continuous Dynamic in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Black Duck Continuous Dynamic from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Service URL | Yes | https://sentinel.whitehatsec.com | Black Duck Continuous Dynamic Service URL |
| API Key | Yes | — | Each Black Duck Continuous Dynamic account uses a unique 32-character API key like a password to authenticate requests. |
| Page size | No | 100 | Maximum number of records to get per API request |
| Parallel requests | No | min(4, availableProcessors) | Maximum number of parallel API requests |
Authentication
Method
API-key authentication via the Key request header. There is no separate authentication call; the key is attached to every request.
Endpoint
No dedicated authentication endpoint. A connection test is performed against GET /api/user?format=json.
Request Headers
| Header | Value |
|---|---|
Key | <api-key> |
Content-Type | application/json |
Usage
The Key header is set on every outgoing request via setHeaders() in SentinelConnector. Generate API keys from the Sentinel UI under Account → API Keys.
Sync Behavior
- Parameter:
since(Instant). - Logic:
sincehandling depends on the model:- Application, Site, and Vulnerability Definition —
sinceis accepted but not used; the assets, sites, and vulnerability-classes endpoints do not support timestamp filtering, so these models are always fully enumerated. - Finding —
sinceis formatted asyyyy-MM-dd'T'HH:mm:ss'Z'and applied as theopenedStartandclosedStartquery params. - Issue and Attack Vector —
sinceis formatted asyyyy-MM-dd'T'HH:mm:ss'Z'and applied as thequery_modifiedquery param.
- Application, Site, and Vulnerability Definition —
How to obtain Black Duck Continuous Dynamic credentials
Generate a Black Duck Continuous Dynamic API key
For the Black Duck Continuous Dynamic connector to use the Black Duck API, you must provide an API key. You can access an existing API key or generate a new one. To obtain an API key, follow these steps:
-
Log in to your organization's Black Duck Continuous Dynamic account.
-
Click My Profile and then the API Key tab.
-
Type your password in the Verify password field and click Authenticate.
The API key displays. If this is your first time requesting an API key, a new key is generated. Click Regenerate API key if you want to replace your existing key.
Note: If you do not have the permissions to create an API key, contact your Black Duck Continuous Dynamic administrator. For additional information, see Black Duck Continuous Dynamic documentation.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Application
| Source Field Name | SDM Attribute |
|---|---|
ApplicationResource.lang | LANGUAGES |
ApplicationResource.packageName | PACKAGE_NAME |
ApplicationResource.platform | PLATFORM |
AssetResource.actionItems | ACTION_ITEMS |
AssetResource.activeUser | ACTIVE_USER |
AssetResource.applianceID | INSTANCE_ID |
AssetResource.assetOwnerID | ASSET_OWNER_ID |
AssetResource.assetOwnerName | OWNER |
AssetResource.assetSize | ASSET_SIZE |
AssetResource.averageFileSize | AVERAGE_FILE_SIZE |
AssetResource.averageLinesScanned | AVERAGE_LINES_SCANNED |
AssetResource.client.name | ORG |
AssetResource.clientRatingMethod | CLIENT_RATING_METHOD |
AssetResource.creationT | SOURCE_CREATED_DATE |
AssetResource.customAssetID | APP_ID |
AssetResource.customPolicyID | CUSTOM_POLICY_ID |
AssetResource.id | UID |
AssetResource.id | NAME |
AssetResource.industry | INDUSTRY |
AssetResource.isWhiteHatEnabled | IS_WHITEHAT_ENABLED |
AssetResource.lastScanDateT | LAST_SCANNED |
AssetResource.location | LOCATIONS |
AssetResource.phase | PHASE |
AssetResource.preScanStatus | PRE_SCAN_STATUS |
AssetResource.remainingScans | REMAINING_SCANS |
AssetResource.scanStatus | SCAN_STATUS |
AssetResource.scheduleName | SCHEDULE_NAME |
AssetResource.scheduleTimeZone | SCHEDULE_TIME_ZONE |
AssetResource.serviceLevel | SE |
AssetResource.status | SOURCE_STATUS |
AssetResource.subID | SUB_ID |
AssetResource.tags | TAGS |
AssetResource.type | ASSET_TYPE |
AssetResource.weight | WEIGHT |
constant | CATEGORIES |
normalized from AssetResource.status | STATUS |
| sync timestamp | LAST_CAPTURED |
Site
| Source Field Name | SDM Attribute |
|---|---|
constant | CATEGORIES |
constant | STATUS |
SiteResource.abbreviation | ABBREVIATION |
SiteResource.applianceID | APPLIANCE_ID |
SiteResource.associatedHostname | ASSOCIATED_HOSTNAME |
SiteResource.clientID | CLIENT_ID |
SiteResource.customAssetID | CUSTOM_ASSET_ID |
SiteResource.hostname | HOSTNAMES |
SiteResource.id | UID |
SiteResource.industry | INDUSTRY |
SiteResource.name | NAME |
SiteResource.notes | NOTES |
SiteResource.organization | ORG |
SiteResource.speed | SPEED |
SiteResource.usesSatellite | USES_SATELLITE |
SiteResource.weight | WEIGHT |
| sync timestamp | LAST_CAPTURED |
Vulnerability Definition
| Source Field Name | SDM Attribute |
|---|---|
cvssV3Vector.s | CVSS_V3_SCOPE |
| derived from the parsed CVSS v3 base metrics | CVSS_V3_SEVERITY |
derived from VulnerabilityClassResource.cvssV3Vector | CVSS_V3_VECTOR |
| parsed CVSS v3 metrics | CVSS_V3_AV / _AC / _PR / _UI / _CI / _II / _AI / _E / _RL / _RC |
| sync timestamp | LAST_CAPTURED |
VulnerabilityClassResource.cvssV3Score | CVSS_V3_BASE_SCORE |
VulnerabilityClassResource.defaultRisk | RISK |
VulnerabilityClassResource.description | DESCRIPTION |
VulnerabilityClassResource.hasApplications | HAS_APPLICATIONS |
VulnerabilityClassResource.hasSites | HAS_SITES |
VulnerabilityClassResource.id | UID |
VulnerabilityClassResource.name | TITLE |
VulnerabilityClassResource.retired | RETIRED |
VulnerabilityClassResource.shortName | NAME |
VulnerabilityClassResource.solution | RECOMMENDATION |
Finding
| Source Field Name | SDM Attribute |
|---|---|
| aggregated from attack-vector requests | REQUEST |
| aggregated from attack-vector responses | RESPONSE |
cvssV3.environmentalVector merged over cvssV3.vector | CVSS_ENV_VECTOR |
cvssV3.vector.s | CVSS_V3_SCOPE |
derived from FindingResource.cvssV3.vector | CVSS_V3_VECTOR |
| derived from normalized severity | SEVERITY_SCORE |
| derived from STATUS | STATUS_CATEGORY |
| derived from the parsed CVSS v3 base metrics | CVSS_V3_SEVERITY |
derived risk text from FindingResource.customRisk | CUSTOM_RISK |
derived risk text from FindingResource.risk | RISK |
filtered CVE entries from FindingResource.cveTags | CVE_IDS |
filtered CVE entries from FindingResource.cveTags | CVE_RECORDS |
FindingResource.asset.id | SITE_ID |
FindingResource.asset.name | SITE_NAME |
FindingResource.asset.subID | SUB_ID |
FindingResource.asset.subID | TARGETS |
FindingResource.attackVectors | ATTACK_VECTOR_IDS |
FindingResource.class.id | TYPE |
FindingResource.class.name | CATEGORIES |
FindingResource.closed | LAST_FIXED |
FindingResource.customAccepted | ACCEPTED |
FindingResource.cvssScore (fallback when v3 absent) | CVSS_V2_BASE_SCORE |
FindingResource.cvssV3.environmentalScore | CVSS_ENV_SCORE |
FindingResource.cvssV3.score | CVSS_V3_BASE_SCORE |
FindingResource.directRemediationAvailable | PATCHABLE |
FindingResource.firstOpened | FIRST_FOUND |
FindingResource.foundRevision | REVISION |
FindingResource.hasInstanceLevelCustomization | HAS_INSTANCE_LEVEL_CUSTOMIZATION |
FindingResource.hasInstanceLevelCVSSCustomization | HAS_INSTANCE_LEVEL_CVSS_CUSTOMIZATION |
FindingResource.id | UID |
FindingResource.id | NAME |
FindingResource.impact | IMPACT |
FindingResource.impactRating | IMPACT_RATING |
FindingResource.isAccessible | IS_ACCESSIBLE |
FindingResource.lastModified | SOURCE_LAST_MODIFIED |
FindingResource.lastRetested | LAST_RETESTED |
FindingResource.likelihood | LIKELIHOOD |
FindingResource.likelihoodRating | LIKELIHOOD_RATING |
FindingResource.location | URL |
FindingResource.manual | MANUAL |
FindingResource.nonAcceptedStatus | NON_ACCEPTED_STATUS |
FindingResource.notesCount | NOTES_COUNT |
FindingResource.opened | LAST_FOUND |
FindingResource.outOfScopeReasons | OUT_OF_SCOPE_REASONS |
FindingResource.reason | REASON |
FindingResource.retestStatus | RETEST_STATUS |
FindingResource.severity | SOURCE_SEVERITY |
FindingResource.status | SOURCE_STATUS |
FindingResource.subTypeTags | SUB_TYPE_TAGS |
FindingResource.tags | TAGS |
FindingResource.threat | THREAT |
FindingResource.unreachable | UNREACHABLE |
FindingResource.verificationStatus | VERIFICATION_STATUS |
FindingResource.zeroDayTags | ZERO_DAY_TAGS |
| normalized from severity | SEVERITY |
| normalized from status | STATUS |
| parsed CVSS v3 metrics | CVSS_V3_AV / _AC / _PR / _UI / _CI / _II / _AI / _E / _RL / _RC |
| sync timestamp | LAST_CAPTURED |
Issue
| Source Field Name | SDM Attribute |
|---|---|
capitalized vuln.custom_risk | CUSTOM_RISK |
capitalized vuln.risk | RISK |
| derived from STATUS | STATUS_CATEGORY |
| derived from the parsed CVSS v3 base metrics | CVSS_V3_SEVERITY |
derived from vuln.cvss_v3_vector | CVSS_V3_VECTOR |
normalized from vuln.status | STATUS |
parsed CVSS v2 metrics (fallback) | CVSS_V2_VECTOR / _AV / _AC / _AU / _CI / _II / _AI / _E / _RL / _RC |
| parsed CVSS v3 metrics | CVSS_V3_AV / _AC / _PR / _UI / _CI / _II / _AI / _E / _RL / _RC |
parsed from vuln.cvss_v3_vector | CVSS_V3_SCOPE |
SourceVulnResource.id | UID |
SourceVulnResource.location | NAME |
| sync timestamp | LAST_CAPTURED |
vuln.application_id | TARGETS |
vuln.class_readable | CATEGORIES |
vuln.clean_description | DESCRIPTION |
vuln.clean_solution | SOLUTION |
vuln.closed | LAST_FIXED |
vuln.cve_reference[].title | CVE_IDS |
vuln.cve_reference[].title | CVE_RECORDS |
vuln.cvss_score (fallback when v3 absent) | CVSS_V2_BASE_SCORE |
vuln.cvss_v3_environmental_score | CVSS_ENV_SCORE |
vuln.cvss_v3_environmental_vector | CVSS_ENV_VECTOR |
vuln.cvss_v3_score | CVSS_V3_BASE_SCORE |
vuln.dast_classes[].name | DAST_CLASSES |
vuln.found | FIRST_FOUND |
vuln.impact | IMPACT |
vuln.likelihood | LIKELIHOOD |
vuln.modified | SOURCE_LAST_MODIFIED |
vuln.opened | LAST_FOUND |
vuln.score | SCORE |
vuln.status | SOURCE_STATUS |
vuln.tags | TAGS |
vuln.threat | THREAT |
VulnerabilityClassResource.id | TYPE |
VulnerabilityClassResource.id | DEFINITION_ID |
Attack Vector
| Source Field Name | SDM Attribute |
|---|---|
[VulnResource.id, VulnResource.site] | TARGETS |
AttackVectorResource.auth_details | AUTH_DETAILS |
AttackVectorResource.found | FIRST_FOUND |
AttackVectorResource.id | UID |
AttackVectorResource.id | NAME |
AttackVectorResource.opened | OPENED |
AttackVectorResource.scanner_tags | TAGS |
AttackVectorResource.state | STATE |
AttackVectorResource.tested | TESTED |
serialized AttackVectorResource.request | REQUEST |
serialized AttackVectorResource.response | RESPONSE |
| sync timestamp | LAST_CAPTURED |
VulnResource.id | FINDING_ID |
VulnResource.site | SITE_ID |
VulnResource.url + AttackVectorResource.request.url | URL |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Application
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Application on every run and applies no incremental date filter.
API
- Type: REST · Endpoint:
GET /api/assets?type=,mobile_application,application
Site
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Site on every run and applies no incremental date filter.
API
- Type: REST · Endpoint:
GET /api/v2/sites
Vulnerability Definition
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Vulnerability Definition on every run and applies no incremental date filter.
API
- Type: REST · Endpoint:
GET /api/vulnerabilityClasses
Finding
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
status | Comma-separated finding statuses | open,closed,mitigated,accepted,out_of_scope,invalid |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token.
API
- Type: REST
Issue
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
status | Comma-separated issue statuses | open,closed,false,discovered |
Delta sync
Supported. The connector performs an incremental (delta) sync via the query_modified sync token, filtering on modified.
API
- Type: REST
Attack Vector
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
status | Comma-separated vulnerability statuses | open, closed, certified, accepted |
Delta sync
Supported. The connector performs an incremental (delta) sync via the query_modified sync token, filtering on modified.
API
- Type: REST · Endpoint:
GET /api/vuln(with attack-vector projection)
Changelog
The Black Duck Continuous Dynamic connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.2.10 | New Features - Added "CVSS v3 scope" to Dynamic Code Finding, Dynamic Code Finding Definition and Issue, reporting whether an exploited vulnerability can affect resources beyond its own security scope (Unchanged or Changed). The metric was already being read from the API to calculate the CVSS score but was not exposed as an attribute. Improvements - CVSS vectors the vendor reports in a format the connector cannot interpret are now recorded in the log instead of being skipped without explanation, so the cause is visible in a sync log rather than showing up only as an empty attribute. Bug Fixes - Fixed the "CVSS v3 severity" attribute on Dynamic Code Finding, Dynamic Code Finding Definition and Issue, which never populated. The attribute was already part of all three models but was never given a value; it now carries the qualitative rating (Critical, High, Medium, Low, None) derived from the CVSS v3 base metrics. - Fixed Dynamic Code Finding and Dynamic Code Finding Definition syncs failing with a "CVSS_V3_BASE_SCORE attribute mismatch" error. CVSS scores were read from the API as single-precision numbers while the platform stores them as double-precision, so a sync aborted as soon as a finding or finding definition carried a CVSS v3 score. CVSS v3 base score, CVSS v2 base score, and CVSS environmental score are now read at double precision and populate correctly. - Fixed the same precision mismatch on the Issue model's "Cvss env score" attribute, which would have aborted the Issue sync for any vulnerability carrying a CVSS v3 environmental score. - Fixed the Dynamic Code Finding "Zero day tags" attribute, which never populated because the connector read a misspelled field name from the findings API. Zero-day tags are now captured and populate on the next sync. - Fixed the CVSS v3 vector attributes on Dynamic Code Finding and Dynamic Code Finding Definition, which never populated. The API returns a CVSS vector as a set of metric/value pairs whose casing and ordering do not match the vector format defined by the CVSS specification, so the connector could not interpret it and skipped the affected attributes without reporting an error. The connector now assembles a specification-conformant vector, so "CVSS v3 vector", "CVSS v3 attack vector", "CVSS v3 attack complexity", "CVSS v3 privileges required", "CVSS v3 user interaction", "CVSS v3 confidentiality impact", "CVSS v3 integrity impact" and "CVSS v3 availability impact" populate on the next sync. When a vector still cannot be assembled, the connector now records it in the log rather than skipping it silently. - Fixed the Dynamic Code Finding "Cvss env vector" attribute, which stored the vendor's metric set joined as-is rather than a CVSS vector, so it did not match the format of the "CVSS v3 vector" attribute on the same record. It now carries a specification-conformant vector: the base metrics followed by the security requirements and modified base metrics the vendor supplies. Where the environmental data reports only the metrics it overrides, the base metrics are taken from the finding's own CVSS vector, which is the relationship the CVSS specification defines between the two. An environmental vector that cannot be assembled is now left empty and recorded in the log, in place of the blank value previously written whenever the vendor sent no environmental data. | • Dynamic Code Finding, Issue: the "Cvss env score" attribute changed from a single-precision to a double-precision number — Action: re-sync the WhiteHat Sentinel connector to repopulate these records with the corrected type. • Dynamic Code Finding: the "Cvss env vector" attribute changed format, from the vendor's metric set joined as-is to a specification-conformant CVSS vector — Action: re-sync the WhiteHat Sentinel connector to repopulate these records in the corrected format. |
| 3.2.9 | No changes in this release. | N/A |
| 3.2.8 | No changes in this release. | N/A |
| 3.2.7 | Improvements - Models now write attributes through the platform's shared, type-validating attribute helper instead of connector-local helpers. Attribute values are now validated against the declared schema type at write time, which surfaces type mismatches early rather than silently storing the wrong type. Bug Fixes - Corrected numerous date/time attributes that were being stored as numbers instead of proper timestamps, which caused data integration failures on the affected syncs. The values are now stored as timestamps, matching the connector schema: - Attack Vector — "Tested", "Opened", "First found" - Asset — "Source created date", "Last scanned" - Dynamic Code Finding — "Last retested", "First found", "Last found", "Last fixed", "Source last modified" - Issue — "First found", "Last found", "Last fixed", "Source last modified" | • The date attributes listed above changed from numbers to timestamps. Re-sync the WhiteHat Sentinel connector to repopulate these records with the corrected type. |
| 3.2.6 | Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so Synopsys data is no longer overridden by lower-priority sources. Bug Fixes - Corrected the finding "Solution" attribute from a numeric type to text (it is populated with the remediation/solution text). | • Findings: the "Solution" attribute changed from numeric to text. Re-sync the WhiteHat Sentinel connector to repopulate these records with the corrected type. |
| 3.2.5 | New Features - Expanded asset and dynamic code finding ingestion with additional fields from the WhiteHat Sentinel API, including asset locations, action items, scheduling details, scan metrics, ownership, and finding-level ratings, customization flags, sub-type and zero-day tags, attack vector IDs, and CVE references. - Added the LAST_CAPTURED attribute to all models (Application, Site, Dynamic Code Finding, Dynamic Code Finding Definition, Issue, Attack Vector). The connector now stamps each captured record with the sync start timestamp so the platform can identify records that have not been seen on a recent sync. Bug Fixes - Fixed a deserialization error in Dynamic Code Finding sync caused by the location field on nested asset data being returned as a single string in the findings endpoint while returned as an array in the assets endpoint, resulting in failed finding retrieval. | N/A |
| 3.2.4 | New Features - Expanded asset and dynamic code finding ingestion with many additional fields from the WhiteHat Sentinel API, including asset locations, action items, ownership and scheduling details, scan metrics (average file size, average lines scanned, remaining scans), policy and weighting attributes, finding-level impact and likelihood ratings, instance-level customization flags, sub-type and zero-day tags, attack vector IDs, and CVE references. | N/A |
| 3.2.3 | No changes in this release. | N/A |
| 3.2.2 | No changes in this release. | N/A |
| 3.2.1 | No changes in this release. | N/A |
| 3.2.0 | No changes in this release. | N/A |
| 3.1.2 | No changes in this release. | N/A |
| 3.1.1 | No changes in this release. | N/A |
| 3.1.0 | No changes in this release. | N/A |
| 3.0.5 | No changes in this release. | N/A |
| 3.0.4 | New Features - Added a "Custom asset ID" attribute to the Site model, exposing the customer-defined asset identifier from the WhiteHat Sentinel API. | N/A |
| 3.0.3 | Improvements - Renamed the "Patch available" finding attribute to "Patchable" on Dynamic Code Findings to align with the platform's standard finding schema. | • Dynamic Code Finding: the "Patch available" attribute was re-keyed to "Patchable". Re-sync the WhiteHat Sentinel connector so findings repopulate under the new attribute. |
| 3.0.2 | New Features - Added a "Source severity" attribute to Dynamic Code Findings, carrying the raw severity reported by WhiteHat Sentinel. Bug Fixes - Corrected the Dynamic Code Finding "Manual" attribute from text to a true/false value, matching the boolean flag returned by the API. | • Dynamic Code Finding: the "Manual" attribute changed from text to a boolean. Re-sync the WhiteHat Sentinel connector to repopulate these records with the corrected type. |
| 3.0.1 | No changes in this release. | N/A |
| 3.0.0 | Overview The WhiteHat Sentinel connector integrates with WhiteHat Sentinel (Synopsys) to synchronize dynamic application security testing assets and findings, including sites, dynamic code findings, and their attack vectors. Category: Application Security Models | N/A |