Burp Suite Professional
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Burp Suite Professional connector ingests web application security scan results produced by Burp Suite Professional. It is a file-based connector: it reads Burp Suite Professional XML report files from a local or mounted directory that the Brinqa platform can access, parses the issues found during the scan, and maps them into dynamic application-security findings, their shared definitions, and the sites (web applications) they were found on.
Data Category: Application Security
Data retrieved from Burp Suite Professional
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| DynamicCodeFinding | Yes | Dynamic Code Finding |
| DynamicCodeFindingDefinition | Yes | Dynamic Code Finding Definition |
| Site | Yes | Site |
Model relationships
For detailed steps on how to view the data retrieved from Burp Suite Professional in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Burp Suite Professional from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Reports Directory | Yes | — | Fully qualified path to the Burp reports directory. Wildcards are allowed (e.g. /feeds/burpsuite/*.xml). |
| Max Age | Yes | — | Maximum number of days a processed file is retained. Less than 0 = keep forever; 0 = do not keep the file. |
| Max Files | Yes | — | Maximum number of files to retain. Less than 0 = retain all; 0 = retain none. |
| Path Patterns | No | — | Path patterns used for including/excluding XML files. |
| Post Process | No | true | Rename or move each file after it has been processed. |
Authentication
This connector does not authenticate against a vendor API. It is file-based and reads exported Burp Suite Professional XML reports from a configured directory. No API key, OAuth token, or other credential is required; access is controlled by the file system permissions of the directory the platform reads from.
Sync Behavior
The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.
How to obtain Burp Suite Professional credentials
Obtain the required credentials (Reports Directory, Max Age, Max Files) from your Burp Suite Professional administrator or the Burp Suite Professional admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
DynamicCodeFinding
| Source Field Name | SDM Attribute |
|---|---|
derived | PROVIDER_STATUS |
derived | SOURCE_STATUS |
derived | STATUS |
derived | STATUS_CATEGORY |
Issue.appId | APP_ID |
Issue.appName | APP_NAME |
Issue.burpVersion | BURP_VERSION |
Issue.confidence | CONFIDENCE |
Issue.details | RESULTS |
Issue.host | TARGETS |
Issue.ipAddress | IP_ADDRESSES |
Issue.lastFound | LAST_FOUND |
Issue.location | LOCATION |
Issue.path | PATH |
Issue.reportName | REPORT_NAME |
Issue.request | REQUEST |
Issue.response | RESPONSE |
Issue.serialNumber | UID |
Issue.severity | SEVERITY |
Issue.type | TYPE |
DynamicCodeFindingDefinition
| Source Field Name | SDM Attribute |
|---|---|
Issue.classifications | WEAKNESSES |
Issue.description | DESCRIPTION |
Issue.name | NAME |
Issue.name | SUMMARY |
Issue.recommendation | RECOMMENDATION |
Issue.references | REFERENCES |
Issue.severity | SOURCE_SEVERITY |
Issue.severity | SEVERITY |
Issue.severity | SEVERITY_SCORE |
Issue.type | UID |
Site
| Source Field Name | SDM Attribute |
|---|---|
derived | CATEGORIES |
Issue.appId | APP_ID |
Issue.appName | APP_NAME |
Issue.host | UID |
Issue.host | NAME |
Issue.host | URL |
Issue.lastFound | LAST_SEEN |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
DynamicCodeFinding
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: See connector README
DynamicCodeFindingDefinition
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: See connector README
Site
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: See connector README
Changelog
The Burp Suite Professional connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.1.8 | Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so Burp Suite data is no longer overridden by lower-priority sources. Bug Fixes - Dynamic Code Finding: "Last found" is now stored as a proper timestamp (was a numeric epoch value), and "Type" is now stored as text (was a numeric value). - Site: "Last seen" is now stored as a proper timestamp. | • Dynamic Code Finding, Site: the attributes listed above changed type. Re-sync the Burp Suite Professional connector to repopulate these records with the corrected types. |
| 3.1.7 | No changes in this release. | N/A |
| 3.1.6 | New Features - Finding status is now reported with greater fidelity: a provider status value (the raw status as reported by Burp Suite) is captured alongside the normalized status and status category, giving clearer insight into the lifecycle state of each finding. Improvements - Sites that have not been seen in a scan for 180 days are now automatically retired, keeping the inventory aligned with what Burp Suite currently reports. Dependency Upgrades - Updated underlying storage and supporting libraries. | • Dynamic Code Finding: finding status attributes were re-worked (a new provider status was added and status values are now derived differently). Re-sync the Burp Suite Professional connector to repopulate findings with the updated status values. |
| 3.1.5 | No changes in this release. | N/A |
| 3.1.4 | No changes in this release. | N/A |
| 3.1.3 | New Features - Dynamic Code Finding and Site records now include "App ID" and "App name", making it easier to associate findings and sites with the originating application. Improvements Dependency Upgrades - Updated supporting libraries. | N/A |
| 3.1.2 | New Features - Dynamic Code Finding records now include "App name" and "Burp version", providing additional context about the source of each finding. Dependency Upgrades - Updated supporting libraries. | • Dynamic Code Finding: the internal identifiers for several finding attributes were standardized. Re-sync the Burp Suite Professional connector to ensure these attributes are repopulated correctly. |
| 3.1.1 | Improvements Dependency Upgrades - Updated supporting libraries. | N/A |
| 3.1.0 | Improvements Dependency Upgrades - Migrated to the shared connectors platform and updated supporting libraries. | N/A |
| 3.0.4 | New Features - Site records now include a "Last seen" timestamp, indicating when each site was most recently observed in a report. | N/A |
| 3.0.3 | New Features - Findings now report a normalized severity alongside the original source severity and a numeric severity score, enabling consistent severity-based filtering, sorting, and risk scoring across connectors. - Added support for ingesting findings from multiple Burp Suite reports. Improvements Dependency Upgrades - Updated supporting libraries. | • Dynamic Code Finding Definition: severity values were normalized and new severity attributes were added. Re-sync the Burp Suite Professional connector to repopulate findings with the normalized severity, source severity, and severity score. |
| 3.0.2 | No changes in this release. | N/A |
| 3.0.1 | Improvements Dependency Upgrades - Updated supporting libraries. | N/A |
| 3.0.0 | Overview The Burp Suite Professional connector integrates with Burp Suite Professional to synchronize web application security findings, finding definitions, and the sites they were discovered on, sourced from exported Burp Suite reports. Category: Application Security Models | N/A |