Contrast Security

Application Security

Overview

The Contrast Security connector integrates with the Contrast Security Interactive Application Security Testing (IAST) platform. It synchronizes application inventory, open-source library (SCA) data, instrumented servers, and the vulnerabilities discovered by Contrast agents. Vulnerability findings are split into a finding (Vulnerability) and a shared definition (Vulnerability Definition) so that severity, recommendation, and weakness metadata can be normalized across occurrences.

The connector iterates over every organization available to the configured credentials and pulls the following data:

• Applications monitored by Contrast.
• Libraries (open-source dependencies) detected across applications and servers.
• Servers running a Contrast agent.
• Vulnerabilities (traces) and their Vulnerability Definitions, optionally enriched with analysis, consequence, and remediation details.

Data retrieved from Contrast Security

Connector Object	Required	Maps to Data Model
Application	Yes	Application
Library	Yes	Package
Server	Yes	Host
Vulnerability	Yes	Vulnerability
Vulnerability Definition	Yes	Vulnerability Definition

Model relationships

note

For detailed steps on how to view the data retrieved from Contrast Security in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Contrast Security from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	No	—	Contrast API URL
Authentication token	No	—	Contrast Authentication token
Username	No	—	Contrast account username
Service key	No	—	Contrast account service key
API key	No	—	Contrast account API key
Page size	No	—	Maximum number of records to get per API request
Maximum retries	No	—	The maximum number of retry attempts before giving up a request
Parallel requests	No	—	Maximum number of parallel API requests
Vulnerability details	No	—	Include vulnerability analysis, consequence and solution

Authentication

Contrast Security uses a custom header-based authentication scheme. Every request carries an Authorization header and an API-Key header. The Authorization value is either a pre-built Contrast authentication token, or — when an explicit token is not supplied — the Base64 encoding of username:serviceKey.

The connector verifies connectivity and resolves the available organizations using the organizations profile endpoint.

Endpoint

Method	URL
GET	{url}/Contrast/api/ng/profile/organizations

Request Headers

Header	Value
Authorization	Contrast authentication token, or Base64(username:serviceKey)
API-Key	Contrast organization API key
Accept	application/json

Sample Response

{
  "organizations": [
    {
      "name": "Brinqa - Partner Dev",
      "organization_uuid": "ed0a4f9d-48d5-41d7-8d05-49a0c9c07e54"
    }
  ]
}

Response Fields

Field	Description
name	Display name of the organization.
organization_uuid	Organization identifier used to build all subsequent data endpoints.

Credential Usage

The organization_uuid returned by the profile endpoint is substituted into every data API path (for example /Contrast/api/ng/{organization_uuid}/applications). The same Authorization and API-Key headers are attached to all subsequent requests.

Sync Behavior

The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.

How to obtain Contrast Security credentials

Obtain Contrast Security API keys

For the Contrast Security connector to use the Contrast Security API, you must generate a service key and API key. To do so, follow these steps:

1. Log in to your organization's Contrast Security portal as an administrator.

2. Navigate to your user profile and click User Settings.

3. The API Key and Service Key are displayed in the Your Keys > Your API Keys section on the page.

   Although you can return to this page to view the access keys, you should handle them with care by ensuring that they are stored in a secure location.

   

4. If you are unsure of the API URL needed for authentication, click Generate Sample API Request.

   The API request includes the correct API URL.

   

Note: If you do not have permissions to create API keys, contact your Contrast Security administrator. For additional information, see Contrast Security documentation.

warning

Enabling Vulnerability details increases the number of API requests (extra per-trace calls), which may impact performance.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Application

Source Field Name	SDM Attribute
Application.active_attacks	ACTIVE_ATTACKS
Application.app_id	UID
Application.archived	ARCHIVED
Application.assess	ASSESS
Application.assessPending	ASSESS_PENDING
Application.attack_label	ATTACK_LABEL
Application.code	CODE
Application.code_shorthand	CODE_SHORTHAND
Application.created	FIRST_SEEN
Application.defend	DEFEND
Application.defendPending	DEFEND_PENDING
Application.importance	IMPORTANCE
Application.importance_description	IMPORTANCE_DESCRIPTION
Application.language	LANGUAGES
Application.last_seen	LAST_SEEN
Application.license.licensed	LICENSED
Application.master	MASTER
Application.name	NAME
Application.notes	NOTES
Application.parentApplicationId	PARENT_ID
Application.path	PATH
Application.roles	ROLES
Application.scores.grade	SCORES_GRADE
Application.scores.letter_grade	SCORES_LETTER_GRADE
Application.scores.platform.grade	PLATFORM_GRADE
Application.scores.platform.letter_grade	PLATFORM_LETTER_GRADE
Application.scores.security.grade	SECURITY_GRADE
Application.scores.security.letter_grade	SECURITY_LETTER_GRADE
Application.servers_without_defend	SERVERS_WITHOUT_DEFEND
Application.short_name	SHORT_NAME
Application.size	SIZE
Application.size_shorthand	SIZE_SHORTHAND
Application.status	SOURCE_STATUS
Application.status (normalized)	STATUS
Application.tags	TAGS
Application.techs	TECHS
Application.total_modules	TOTAL_MODULES
constant	CATEGORIES

Library

Source Field Name	SDM Attribute
constant	CATEGORIES
constant active	STATUS
constant unknown	SOURCE_STATUS
Library.agePenalty	AGE_PENALTY
Library.app_language	LANGUAGES
Library.apps[].app_id	APPS
Library.class_count	CLASSES_TOTAL
Library.classes_used	CLASSES_USED
Library.custom	CUSTOM
Library.file_name	NAME
Library.file_version	FILE_VERSION
Library.grade	GRADE
Library.group	GROUP
Library.hash	UID
Library.invalid_version	INVALID_VERSION
Library.latest_release_date	LATEST_RELEASE_DATE
Library.latest_version	LATEST_VERSION
Library.loc	LOC
Library.loc_shorthand	LOC_SHORTHAND
Library.months_outdated	MONTHS_OUTDATED
Library.ossEnabled	OSS_ENABLED
Library.release_date	RELEASE_DATE
Library.restricted	RESTRICTED
Library.score	SCORE
Library.servers[].server_id	SERVERS
Library.tags	TAGS
Library.total_vulnerabilities	TOTAL_VULNERABILITIES
Library.version	CURRENT_VERSION
Library.versionPenalty	VERSION_PENALTY
Library.versions_behind	VERSIONS_BEHIND

Server

Source Field Name	SDM Attribute
constant	CATEGORIES
Server.agent_version	AGENT_VERSION
Server.applications[].app_id	APPS
Server.assess	ASSESS
Server.assess_last_update	ASSESS_LAST_UPDATE
Server.assess_sensors	ASSESS_SENSORS
Server.assessPending	ASSESS_PENDING
Server.container	CONTAINER
Server.defend	DEFEND
Server.defend_sensors	DEFEND_SENSORS
Server.defendPending	DEFEND_PENDING
Server.defense_last_update	DEFENSE_LAST_UPDATE
Server.environment	ENVIRONMENT
Server.hostname	HOSTNAMES
Server.language	LANGUAGE
Server.last_activity	LAST_ACTIVITY
Server.last_startup	LAST_STARTUP
Server.latest_agent_version	LATEST_AGENT_VERSION
Server.name	NAME
Server.out_of_date	OUT_OF_DATE
Server.path	PATH
Server.server_id	UID
Server.status	SOURCE_STATUS
Server.status (normalized)	STATUS
Server.syslog_enabled	SYSLOG_ENABLED
Server.syslog_ip_address	IP_ADDRESSES
Server.syslog_ip_address	PUBLIC_IP_ADDRESSES
Server.syslog_ip_address	PRIVATE_IP_ADDRESSES
Server.tags	TAGS
Server.type	HOST_TYPE

Vulnerability

Source Field Name	SDM Attribute
derived from Trace.status	STATUS_CATEGORY
Trace.application.app_id	TARGETS
Trace.closed_time	LAST_FIXED
Trace.confidence	CONFIDENCE
Trace.discovered	DISCOVERED
Trace.evidence	RESULTS
Trace.first_time_seen	FIRST_FOUND
Trace.hasParentApp	HAS_PARENT_APP
Trace.last_time_seen	LAST_FOUND
Trace.last_vuln_time_seen	LAST_VULN_TIME_SEEN
Trace.likelihood	LIKELIHOOD
Trace.organization_name	ORGANIZATION_NAME
Trace.request	REQUEST
Trace.status (normalized)	STATUS
Trace.status (normalized)	SOURCE_STATUS
Trace.story.risk.text	CONSEQUENCE
Trace.story.text	ANALYSIS
Trace.sub_status	SUB_STATUS
Trace.tags	TAGS
Trace.total_traces_received	TOTAL_TRACES_RECEIVED
Trace.uuid	UID
Trace.uuid	TYPE
Trace.visible	VISIBLE

Vulnerability Definition

Source Field Name	SDM Attribute
derived from Trace.severity	SEVERITY_SCORE
Recommendation.cwe	WEAKNESSES
Recommendation.cwe	REFERENCES
Recommendation.recommendation.text	RECOMMENDATION
Trace.category	CATEGORIES
Trace.impact	IMPACT
Trace.language	LANGUAGES
Trace.rule_name	RULE_NAME
Trace.rule_title	RULE_TITLE
Trace.severity	SOURCE_SEVERITY
Trace.severity (normalized)	SEVERITY
Trace.title	NAME
Trace.uuid	UID

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Application

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /Contrast/api/ng/{organization_uuid}/applications
• Default filters: expand=license,scores,technologies,skip_links

Library

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /Contrast/api/ng/{organization_uuid}/libraries
• Default filters: expand=apps,servers

Server

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /Contrast/api/ng/{organization_uuid}/servers
• Default filters: expand=applications

Vulnerability

Operation options

Option	Type	Default	Description
severities	String	Comma-separated severities to include. Default LOW,MEDIUM,HIGH,CRITICAL.
status	String	Comma-separated statuses (e.g. Reported,Suspicious,Confirmed,NotAProblem,Remediated,Fixed).
tracked	Boolean	Include tracked traces.
untracked	Boolean	Include untracked traces.
maxRetries	Integer	Maximum retry attempts for a request.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /Contrast/api/ng/{organization_uuid}/orgtraces/filter
• Default filters: expand=application,request, severities=LOW,MEDIUM,HIGH,CRITICAL (default; overridable via options). On delta sync, startDate, endDate=now, and timestampFilter=LAST are added.

Vulnerability Definition

Operation options

Option	Type	Default	Description
severities	String	Comma-separated severities to include. Default LOW,MEDIUM,HIGH,CRITICAL.
status	String	Comma-separated statuses to include.
tracked	String	Include tracked traces.
untracked	String	Include untracked traces.
maxRetries	Integer	Maximum retry attempts for a request.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /Contrast/api/ng/{organization_uuid}/orgtraces/filter
• Default filters: expand=application,request, severities=LOW,MEDIUM,HIGH,CRITICAL (default; overridable via options). On delta sync, startDate, endDate=now, and timestampFilter=LAST are added.

Changelog

Changelog

The Contrast Security connector has undergone the following changes:

Version	Description	Migration Steps
3.0.1	New Features - Added support for authenticating with a Contrast authentication token. You can now provide an authentication token as an alternative to the username and service key, simplifying setup for organizations that use token-based access. Improvements - The username and service key fields are no longer mandatory, allowing connections to be configured using just the authentication token and API key. Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.0	Overview The Contrast Security connector integrates with the Contrast Security platform to synchronize application assets, libraries, servers, and vulnerability findings along with their definitions. Category: Application Security Models	N/A