Black Duck Polaris Platform
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Synopsys Polaris connector integrates with the Black Duck Polaris Platform to synchronize security findings, projects, and applications. It fetches findings across Static Application Security Testing (SAST) and Software Composition Analysis (SCA) domains.
Data retrieved from Black Duck Polaris Platform
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Application | Yes | Application |
| Project | Yes | Code Project |
| SAST Finding (Static Code Finding) | Yes | Static Code Finding |
| SCA Finding (Open Source Finding) | Yes | Open Source Finding |
| SAST Finding Definition (Static Code Finding Definition) | Yes | Static Code Finding Definition |
| SCA Finding Definition (Open Source Finding Definition) | Yes | Open Source Finding Definition |
Model relationships
For detailed steps on how to view the data retrieved from Black Duck Polaris Platform in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Black Duck Polaris Platform from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| API URL | Yes | — | Polaris API URL |
| API key | Yes | — | Polaris API key |
| Page size | No | 100 | Maximum number of records to get per API request |
| Parallel requests | No | min(4, availableProcessors) | Maximum number of parallel API requests |
| Maximum retries | No | 5 | The maximum number of retry attempts before giving up a request |
Authentication
The connector uses API Token authentication.
Endpoint
| Method | URL |
|---|---|
GET | https://<polaris-api-url>/portfolio/portfolios |
Request Headers
| Header | Value |
|---|---|
Api-Token | <your-api-key> |
Content-Type | application/json |
Usage
All API requests must include the Api-Token header.
Api-Token: <your-api-key>
Sync Behavior
Each sync is a full sync. Every run enumerates all records; the connector accepts a sync token but does not apply it as an incremental filter.
How to obtain Black Duck Polaris Platform credentials
Generate a Polaris access token
For the Black Duck Polaris Platform connector to use the Polaris APIs, you must provide an access token. Since Black Duck prohibits retrieving access tokens for existing users, you'll need to generate a new one. To do so, follow these steps:
-
Log in to your organization's Black Duck Polaris Platform account.
-
Open your user profile and select Account.
-
Click Access Tokens, and then Create New Token.
-
Provide a name for the API token and click Save.
The new API token displays. You cannot view the token again. Copy the token and save it in a secure location.
Note: If you do not have the permissions to create an API token, contact your Black Duck Polaris Platform administrator. For additional information, see Black Duck documentation.
(Optional) Create a service account for Black Duck Polaris Platform
In addition to creating an access token from a user account, you can also create a service account for Polaris and assign it a global or application-level role. A service account is a dedicated account that is used for automated processes and integrations, such as the Black Duck Polaris Platform connector. Service accounts have their own set of tokens that can be used for authentication. For additional information, see Black Duck documentation on how to create a service account for Polaris.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Application
| Source Field Name | SDM Attribute |
|---|---|
| constant ASSET_CATEGORY_APPLICATION | CATEGORIES |
derived from portfolio.inTrash() | STATUS |
Instant.now() | LAST_CAPTURED |
portfolio.createdAt() | SOURCE_CREATED_DATE |
portfolio.description() | DESCRIPTION |
portfolio.id() | UID |
portfolio.inTrash() | IN_TRASH |
portfolio.name() | NAME |
portfolio.portfolioId() | PORTFOLIO_ID |
portfolio.subscriptionTypeUsed() | SUBSCRIPTION_TYPE_USED |
portfolio.updatedAt() | SOURCE_LAST_MODIFIED |
Black Duck Polaris Platform refers to Portfolio items as applications and Portfolio subitems as projects.
Project
| Source Field Name | SDM Attribute |
|---|---|
| constant ASSET_CATEGORY_PROJECT | CATEGORIES |
defaultBranch.description() | DEFAULT_BRANCH_DESCRIPTION |
defaultBranch.id() | DEFAULT_BRANCH_ID |
defaultBranch.isDefault() | DEFAULT_BRANCH_IS_DEFAULT |
defaultBranch.name() | DEFAULT_BRANCH_NAME |
defaultBranch.source() | DEFAULT_BRANCH_SOURCE |
derived from portfolioSubItemResource.inTrash() | STATUS |
portfolioSubItemResource.createdAt() | SOURCE_CREATED_DATE |
portfolioSubItemResource.description() | DESCRIPTION |
portfolioSubItemResource.id() | UID |
portfolioSubItemResource.inTrash() | IN_TRASH |
portfolioSubItemResource.name() | NAME |
portfolioSubItemResource.portfolioItemId() | APPLICATION |
portfolioSubItemResource.updatedAt() | SOURCE_LAST_MODIFIED |
SAST Finding (Static Code Finding)
| Source Field Name | SDM Attribute |
|---|---|
| :------------------------------------------ | :------------------ |
| aggregated from APPLICATION, PROJECT, BRANCH, OTHER_BRANCH | TARGETS |
| concatenated summary of above fields | RESULTS |
context.date() | TESTED_ON |
context.tenantId() | TENANT_ID |
context.toolId() | TOOL_ID |
context.toolType() | TOOL_TYPE |
extracted from context._links (rel=branch) | APPLICATION |
extracted from context._links (rel=branch) | PROJECT |
extracted from context._links (rel=branch) | BRANCH_ID |
extracted from context._links (rel=other-branches) | OTHER_BRANCH_IDS |
extracted from context._links (rel=test) | TEST_ID |
getFindingSeverityScore(normalizedSeverity) | SEVERITY_SCORE |
Instant.now() | LAST_CAPTURED |
issueResource.firstDetectedOn() | FIRST_FOUND |
issueResource.id() | NAME |
issueResource.id() | ISSUE_ID |
issueType.id() | ISSUE_TYPE_ID |
MD5(issueResource.id() + ":" + projectId) | UID |
MD5(issueTypeId, getCveId(occurrenceProperties)) | TYPE |
normalizeFindingSeverity(occurrenceProperties["severity"]) | SEVERITY |
normalizeFindingStatus(triageProperties["status"]) | SOURCE_STATUS |
| occurrenceProperties key:value pairs | ISSUE_PROPERTIES |
occurrenceProperties["coverity-events"] | COVERITY_EVENTS |
occurrenceProperties["cwe"] | CWE_IDS |
occurrenceProperties["cwe"] | WEAKNESSES |
occurrenceProperties["description"] | DESCRIPTION |
occurrenceProperties["filename"] | FILENAME |
occurrenceProperties["language"] | LANGUAGE |
occurrenceProperties["line-number"] | LINE_NUMBER |
occurrenceProperties["local-effect"] | LOCAL_EFFECT |
occurrenceProperties["location"] | FILE_NAME |
occurrenceProperties["location"] | LOCATION |
occurrenceProperties["severity"] | SOURCE_SEVERITY |
occurrenceProperties["vulnerability-id"] | CVE_IDS |
occurrenceProperties["vulnerability-id"] | CVE_RECORDS |
occurrenceProperties["workaround"] | WORKAROUND |
| Source Field | Attribute Name |
| triageProperties key:value pairs | TRIAGE_PROPERTIES |
triageProperties["dismissal-reason"] | DISMISSAL_REASON |
triageProperties["is-dismissed"] | DISMISSED |
triageProperties["status"] | PROVIDER_STATUS |
SCA Finding (Open Source Finding)
| Source Field Name | SDM Attribute |
|---|---|
| :------------------------------------------------- | :----------------------- |
| aggregated from APPLICATION, PROJECT, BRANCH, OTHER_BRANCH | TARGETS |
| concatenated summary of above fields | RESULTS |
context.date() | TESTED_ON |
context.tenantId() | TENANT_ID |
context.toolId() | TOOL_ID |
context.toolType() | TOOL_TYPE |
extracted from context._links (rel=branch) | APPLICATION |
extracted from context._links (rel=branch) | PROJECT |
extracted from context._links (rel=branch) | BRANCH_ID |
extracted from context._links (rel=other-branches) | OTHER_BRANCH_IDS |
extracted from context._links (rel=test) | TEST_ID |
getFindingSeverityScore(normalizedSeverity) | SEVERITY_SCORE |
Instant.now() | LAST_CAPTURED |
issueResource.firstDetectedOn() | FIRST_FOUND |
issueResource.id() | NAME |
issueResource.id() | ISSUE_ID |
issueType.id() | ISSUE_TYPE_ID |
MD5(issueResource.id() + ":" + projectId) | UID |
MD5(issueTypeId, getCveId(occurrenceProperties)) | TYPE |
normalizeFindingSeverity(occurrenceProperties["severity"]) | SEVERITY |
normalizeFindingStatus(triageProperties["status"]) | SOURCE_STATUS |
| occurrenceProperties key:value pairs | ISSUE_PROPERTIES |
occurrenceProperties["component-id"] | COMPONENT_ID |
occurrenceProperties["component-name"] | COMPONENT |
occurrenceProperties["component-version-id"] | COMPONENT_VERSION_ID |
occurrenceProperties["component-version-name"] | COMPONENT_VERSION |
occurrenceProperties["cwe"] | CWE_IDS |
occurrenceProperties["cwe"] | WEAKNESSES |
occurrenceProperties["description"] | DESCRIPTION |
occurrenceProperties["location"] | FILE_NAME |
occurrenceProperties["severity"] | SOURCE_SEVERITY |
occurrenceProperties["vulnerability-id"] | CVE_IDS |
occurrenceProperties["vulnerability-id"] | CVE_RECORDS |
occurrenceProperties["workaround"] | WORKAROUND |
| Source Field | Attribute Name |
| triageProperties key:value pairs | TRIAGE_PROPERTIES |
triageProperties["dismissal-reason"] | DISMISSAL_REASON |
triageProperties["is-dismissed"] | DISMISSED |
triageProperties["status"] | PROVIDER_STATUS |
SAST Finding Definition (Static Code Finding Definition)
| Source Field Name | SDM Attribute |
|---|---|
getFindingSeverityScore(normalizedSeverity) | SEVERITY_SCORE |
Instant.now() | LAST_CAPTURED |
issueResource.weaknessId() | WEAKNESSES |
issueType.id() | ISSUE_TYPE_ID |
issueType.localized().name() | ISSUE_TYPE_LOCALIZED_NAME |
issueType.localized().name() | CATEGORIES |
issueType.name() | NAME |
issueType.name() | ISSUE_TYPE_NAME |
localized.otherDetails["description"] or occurrenceProperties["description"] | DESCRIPTION |
localized.otherDetails["remediation"] or occurrenceProperties["solution"] | REMEDIATION |
localized.otherDetails["remediation"] or occurrenceProperties["solution"] | RECOMMENDATION |
localized.otherDetails["subcategory"] | SUBCATEGORY |
MD5(issueType.id(), getCveId(occurrenceProperties)) | UID |
normalizeFindingSeverity(occurrenceProperties["severity"]) | SEVERITY |
occurrenceProperties["cwe"] | CWE_IDS |
occurrenceProperties["severity"] | SOURCE_SEVERITY |
occurrenceProperties["vulnerability-id"] | CVE_IDS |
occurrenceProperties["vulnerability-id"] | CVE_RECORDS |
SCA Finding Definition (Open Source Finding Definition)
| Source Field Name | SDM Attribute |
|---|---|
getFindingSeverityScore(normalizedSeverity) | SEVERITY_SCORE |
Instant.now() | LAST_CAPTURED |
issueResource.weaknessId() | WEAKNESSES |
issueType.id() | ISSUE_TYPE_ID |
issueType.localized().name() | ISSUE_TYPE_LOCALIZED_NAME |
issueType.localized().name() | CATEGORIES |
issueType.name() | NAME |
issueType.name() | ISSUE_TYPE_NAME |
localized.otherDetails["description"] or occurrenceProperties["description"] | DESCRIPTION |
localized.otherDetails["remediation"] or occurrenceProperties["solution"] | REMEDIATION |
localized.otherDetails["remediation"] or occurrenceProperties["solution"] | RECOMMENDATION |
localized.otherDetails["subcategory"] | SUBCATEGORY |
MD5(issueType.id(), getCveId(occurrenceProperties)) | UID |
normalizeFindingSeverity(occurrenceProperties["severity"]) | SEVERITY |
occurrenceProperties["cwe"] | CWE_IDS |
occurrenceProperties["linked-vulnerability-id"] | LINKED_VULNERABILITY_ID |
occurrenceProperties["overall-score"] | OVERALL_SCORE |
occurrenceProperties["severity"] | SOURCE_SEVERITY |
occurrenceProperties["vulnerability-id"] | CVE_IDS |
occurrenceProperties["vulnerability-id"] | CVE_RECORDS |
occurrenceProperties["vulnerability-id"] | VULNERABILITY_ID |
occurrenceProperties["vulnerability-source"] | VULNERABILITY_SOURCE |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Application
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Application on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET api/portfolios/{portfolioId}/applications
Project
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Project on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET api/portfolios/{portfolioId}/applications/{applicationId}/projects
SAST Finding (Static Code Finding)
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of SAST Finding (Static Code Finding) on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET /api/findings/issues - Default filters:
_filter=context:tool-type==sast(optionally combined withtriage:status=in=(...)andoccurrence:severity=in=(...)from operation options); scoped per application viaapplicationId
SCA Finding (Open Source Finding)
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of SCA Finding (Open Source Finding) on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET /api/findings/issues - Default filters:
_filter=context:tool-type==sca(optionally combined withtriage:status=in=(...)andoccurrence:severity=in=(...)from operation options); scoped per application viaapplicationId
SAST Finding Definition (Static Code Finding Definition)
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of SAST Finding Definition (Static Code Finding Definition) on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET /api/findings/issues - Default filters:
_filter=context:tool-type==sast; scoped per application viaapplicationId. Definitions are derived from each finding'sissueTypeand de-duplicated byMD5(issueType.id, vulnerability-id)
SCA Finding Definition (Open Source Finding Definition)
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of SCA Finding Definition (Open Source Finding Definition) on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET /api/findings/issues - Default filters:
_filter=context:tool-type==sca; scoped per application viaapplicationId. Definitions are derived from each finding'sissueTypeand de-duplicated byMD5(issueType.id, vulnerability-id)
Changelog
The Black Duck Polaris Platform connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.2.8 | Bug Fixes - Fixed the Polaris models failing to load. Three multivalued Polaris finding attributes ("Other branch IDs", "Triage properties", "Issue properties") registered a consolidation rule twice for the same attribute, which aborted the Polaris schema build and prevented every Polaris object type from syncing. The duplicate registration is removed; Polaris syncs now build and run normally. | N/A |
| 3.2.7 | Improvements - Models now write attributes through the platform's shared, type-validating attribute helper instead of connector-local helpers. Attribute values are now validated against the declared schema type at write time, which surfaces type mismatches early rather than silently storing the wrong type. | N/A |
| 3.2.6 | Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so Synopsys data is no longer overridden by lower-priority sources. | N/A |
| 3.2.5 | Improvements - Finding Definitions — Consolidated finding definitions by implementing type-based UIDs (hash of issue type and CVE ID). This ensures that findings of the same type correctly reference a shared definition, significantly reducing data volume and improving linkage. Bug Fixes - CVE ID Extraction — Fixed a bug where CVE IDs were incorrectly processed as Java Optional strings, ensuring stable and accurate hash generation for findings and definitions. | • Open Source Finding Definition: UID logic updated to type-specific hashing — Action: purge existing definitions. • Static Code Finding Definition: UID logic updated to type-specific hashing — Action: purge existing definitions. |
| 3.2.4 | No changes in this release. | N/A |
| 3.2.3 | No changes in this release. | N/A |
| 3.2.2 | No changes in this release. | N/A |
| 3.2.1 | No changes in this release. | N/A |
| 3.2.0 | Overview The Polaris connector integrates with the Black Duck Polaris Platform (Synopsys) to synchronize application security testing portfolios and findings, including applications, projects, and both static code and open source findings with their definitions. Category: Application Security Models | N/A |