Censys

External Attack Surface Management

Overview

The Censys connector integrates with the Censys External Attack Surface Management (ASM) platform. It synchronizes externally discovered attack-surface assets — hosts, domains, certificates, storage buckets, and web entities — along with the risks Censys identifies against them (risk instances), the risk definitions that describe those risks (risk types), and the lifecycle events recorded for each risk (risk events).

Assets are retrieved from the Censys Inventory Search API and scoped to one or more configured workspaces. Risk data is retrieved from the Censys Risk API. The data is mapped into Brinqa Unified Data Model (UDM) targets such as Host, Site, Certificate, Cloud Resource, Vulnerability, and Vulnerability Definition.

Data retrieved from Censys

Connector Object	Required	Maps to Data Model
Host	Yes	Host
Domain	Yes	Site
Certificate	Yes	Certificate
Storage Bucket	Yes	Cloud Resource
Web Entity	Yes	Site
Risk Instance	Yes	Vulnerability
Risk Type	Yes	Vulnerability Definition
RiskEvent	Yes	RiskEvent

Model relationships

note

For detailed steps on how to view the data retrieved from Censys in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Censys from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	No	—	Censys API URL
API key	No	—	Censys api key
Workspace ID	No	—	Censys workspace ID. Comma separated in case of multiple workspace IDs
Page size	No	—	Maximum number of records to get per API request
Maximum retries	No	—	The maximum number of retry attempts before giving up a request

Authentication

The connector authenticates with a Censys API key sent as a custom request header on every API call. No token-exchange or login round-trip is performed; the configured API key is attached directly to each request.

Credential Usage

Every request sets the following headers:

Header	Value
Censys-Api-Key	The configured API key (confidential)
Accept	application/json

Connection Test

On test, the connector issues a minimal authenticated request to verify the credential and base URL.

Method	URL
GET	{API URL}/api/v1/assets/hosts?pageSize=1

Request headers

Header	Value
Censys-Api-Key	{API key}
Accept	application/json

Sample response

{
  "results": [
    {
      "type": "HOST",
      "assetId": "34.66.152.84"
    }
  ]
}

Response Field	Description
results	Array of assets returned by the test query. A 2xx status confirms the API key and URL are valid.

A successful (2xx) response confirms the credential; a non-2xx status raises a connection error with the message parsed from the Censys error response.

Sync Behavior

Each sync is a full sync. Every run enumerates all records; the connector accepts a sync token but does not apply it as an incremental filter.

---

How to obtain Censys credentials

Generate a Censys API key

For the Censys connector to use the Censys API, you must provide an API key. To generate an API key, follow these steps:

1. Log in to your organization's Censys account.

2. Click your profile photo in the top-right corner and in the dropdown, click My Account.

3. Click Personal Access Tokens.

4. Give your access token a name and an optional description.

5. Click Create.

Your new API key displays. Although you can return to this page to view the token, you should handle it with care by ensuring that it is stored in a secure location.

Note: If you do not have permissions to generate an API key, contact your Censys administrator. For additional information, see Censys documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Host

Source Field Name	SDM Attribute
Constant Host + Resource.type	CATEGORIES
Resource.association_date	SOURCE_CREATED_DATE
Resource.host.autonomous_system.asn	ASN
Resource.host.cloud	CLOUD_PROVIDER
Resource.host.dns.names, Resource.host.dns.reverse_dns.names	DNS_NAMES
Resource.host.dns.names, Resource.host.dns.reverse_dns.names	PRIVATE_DNS_NAMES
Resource.host.ip	UID
Resource.host.ip	NAME
Resource.host.ip	IP_ADDRESSES
Resource.host.ip	PUBLIC_IP_ADDRESSES
Resource.host.ip	PRIVATE_IP_ADDRESSES
Resource.host.location.coordinates.latitude	LATITUDE
Resource.host.location.coordinates.longitude	LONGITUDE
Resource.host.location.country	COUNTRY_CODE
Resource.host.location.province	PROVINCE
Resource.host.services[].port	PORTS
Resource.tags	TAGS
Resource.type	ASSET_TYPE

Domain

Source Field Name	SDM Attribute
Constant Domain + Resource.type	CATEGORIES
Resource.association_date	SOURCE_CREATED_DATE
Resource.domain.expiration_date	TERMINATION_DATE
Resource.domain.mail_exchange_servers	MAIL_SERVERS
Resource.domain.name	UID
Resource.domain.name	NAME
Resource.domain.name_servers	NAME_SERVERS
Resource.domain.registrar	REGISTRAR
Resource.domain.registrar	REGISTRY
Resource.tags	TAGS
Resource.type	ASSET_TYPE

Certificate

Source Field Name	SDM Attribute
Constant Certificate + Resource.type	CATEGORIES
Resource.association_date	SOURCE_CREATED_DATE
Resource.certificate.fingerprint_sha256	UID
Resource.certificate.fingerprint_sha256	SHA_256
Resource.certificate.names	NAME
Resource.certificate.names	NAMES_ON_CERT
Resource.certificate.parsed.issuer.organization	OWNER
Resource.certificate.parsed.signature.self_signed	SELF_SIGNED
Resource.certificate.parsed.signature.valid	IS_VALID
Resource.certificate.parsed.subject_key_info.key_algorithm.name	KEY_TYPE
Resource.certificate.parsed.validity_period.not_after	TERMINATION_DATE
Resource.tags	TAGS
Resource.type	ASSET_TYPE

Storage Bucket

Source Field Name	SDM Attribute
Constant Storage Bucket + Resource.type	CATEGORIES
Resource.association_date	SOURCE_CREATED_DATE
Resource.source	SOURCE
Resource.storage_bucket.account_id	CLOUD_ACCOUNT_ID
Resource.storage_bucket.editable_settings	EDITABLE_SETTING
Resource.storage_bucket.name	NAME
Resource.storage_bucket.provider	CLOUD_PROVIDER
Resource.storage_bucket.readable_objects	READABLE
Resource.storage_bucket.scanned_at	LAST_SCANNED
Resource.storage_bucket.uri	UID
Resource.storage_bucket.uri	URL
Resource.storage_bucket.writable_objects	WRITABLE
Resource.tags	TAGS
Resource.type	ASSET_TYPE

Web Entity

Source Field Name	SDM Attribute
Resource.association_date	SOURCE_CREATED_DATE
Resource.tags	TAGS
Resource.type	ASSET_TYPE
Resource.type	CATEGORIES
Resource.web_entity.asset_id	UID
Resource.web_entity.asset_id	NAME
Resource.web_entity.instances[]	INSTANCES

Risk Instance

Source Field Name	SDM Attribute
categories[][]	CATEGORIES
context (ip / domain / sha256 / cri / name[:port])	TARGETS
context.port	PORT
context.service	SERVICE
context.transport	PROTOCOL
displayName	NAME
events[].id	EVENT_IDS
firstComputedAt	FIRST_FOUND
id	UID
lastComputedAt	LAST_SEEN
lastUpdatedAt	SOURCE_LAST_MODIFIED
metadata[] (cdn, classification, cloud, src, srcID)	METADATA
severity	SOURCE_SEVERITY
severity (derived)	SEVERITY_SCORE
severity (normalized)	SEVERITY
status	PROVIDER_STATUS
status (derived)	STATUS_CATEGORY
status (normalized)	SOURCE_STATUS
status (normalized)	STATUS
typeID	TYPE

Risk Type

Source Field Name	SDM Attribute
addedAt	SOURCE_CREATED_DATE
categories[][]	CATEGORIES
contextType	CONTEXT_TYPE
description	DESCRIPTION
enabled	ENABLED
id	UID
lastUpdatedAt	SOURCE_LAST_MODIFIED
name	NAME
recommendedSeverity	RECOMMENDED_SEVERITY
references[]	REFERENCES
remediations[]	RECOMMENDATION
severity	SOURCE_SEVERITY
severity (derived)	SEVERITY_SCORE
severity (normalized)	SEVERITY
subjectType	SUBJECT_TYPE

RiskEvent

Source Field Name	SDM Attribute
delta.displayName	NAME
delta.enabled	RISK_TYPE_ENABLED
delta.metadata_added[]	METADATA_ADDED
delta.metadata_added[]	METADATA_REMOVED
id	UID
op	OPERATION
reason	REASON
riskID	RISK_ID
riskType	RISK_TYPE
src	SOURCE
srcID	SOURCE_ID
ts	SOURCE_CREATED_DATE

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Host

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Host on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/inventory/v1
• Default filters: query=host:*

Domain

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Domain on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/inventory/v1
• Default filters: query=domain:*

Certificate

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Certificate on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/inventory/v1
• Default filters: query=certificate:*

Storage Bucket

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Storage Bucket on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/inventory/v1
• Default filters: query=storage_bucket:*

Web Entity

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Web Entity on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/inventory/v1
• Default filters: query=not (host.name: *) and (type: web_entity)

Risk Instance

Operation options

Option	Type	Default	Description
includeEvents	Boolean	When true, requests risk events be included in the response (default false).
includeHostData	Boolean	When true, requests host data be included in the response (default false).

Delta sync

Not supported. The connector performs a full sync of Risk Instance on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/v2/risk-instances

Risk Type

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Risk Type on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/v2/risk-types
• Default filters: formatting=markdown

RiskEvent

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of RiskEvent on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/v2/risk-events

Changelog

Changelog

The Censys connector has undergone the following changes:

Version	Description	Migration Steps
3.0.7	Improvements Optimized Risk Event Synchronization - Risk Event sync now processes records page-by-page, delivering data to the platform incrementally rather than waiting for the full dataset to be retrieved. This improves reliability and performance for large-volume Risk Event syncs.	N/A
3.0.6	New Features Tags on Web Entities - Web Entity records now include tags from Censys, making it easier to filter and group web entities by their assigned labels. Bug Fixes Certificate Tag Retrieval - Corrected the field used to retrieve tags for Certificate assets so that tag values are now populated reliably.	N/A
3.0.5	Bug Fixes Domain Tag Retrieval - Corrected the field used to retrieve tags for Domain assets so that tag values are now populated reliably. Improvements Refreshed Connector Icon - Updated the connector icon for clearer presentation in the platform.	N/A
3.0.4	Improvements Refreshed Connector Icon - Updated the connector icon for clearer presentation in the platform.	N/A
3.0.3	New Features Configurable Retry Limit - Added a "Maximum retries" setting so you can control how many times the connector retries a request before giving up, helping it adapt to your environment's API rate limits and reliability. Selective Risk Instance Data - Risk Instance sync now supports optional inclusion of associated events and host data, letting you tailor how much detail is retrieved per sync. Improvements Richer Risk Instance Status - Risk Instance findings now retain the original provider status alongside the normalized status, giving clearer insight into the source system's reported state.	• Host: The "Asn" attribute changed from text to a numeric value, and "Latitude" and "Longitude" changed from text to decimal values. Action: purge and re-sync the Host model so existing records adopt the new attribute types.
3.0.2	Improvements More Reliable Synchronization - Reworked request retry and error handling so that transient API failures are retried consistently across all data types and genuine errors are surfaced instead of being silently skipped, improving the completeness and reliability of syncs.	N/A
3.0.1	Bug Fixes Host Tag Retrieval - Corrected the field used to retrieve tags for Host assets so that tag values are now populated reliably.	N/A
3.0.0	Overview The Censys connector integrates with the Censys External Attack Surface Management platform to synchronize discovered internet-facing assets — including hosts, domains, certificates, storage buckets, and web entities — along with the risks, risk types, and risk events that Censys identifies against them. Category: External Attack Surface Management Models	N/A