Edgescan

Vulnerability Management

Overview

The Edgescan connector integrates with the Edgescan full-stack vulnerability management platform. It synchronizes assets (hosts, networks, web applications, and containers), the vulnerabilities discovered against those assets, and the underlying vulnerability definitions that describe each issue. The connector reads data from the Edgescan REST API (/api/v1) and maps it into the Brinqa Unified Data Model (UDM) as Host, Network, Application, Container, Vulnerability, and Vulnerability Definition records.

All models support incremental (delta) synchronization based on the record's last-modified timestamp.

Data retrieved from Edgescan

Connector Object	Required	Maps to Data Model
Host	Yes	Host
Network	Yes	Network
Web Application	Yes	Application
Container	Yes	Container
Vulnerability	Yes	Vulnerability
Vulnerability Definition	Yes	Vulnerability Definition

Model relationships

note

For detailed steps on how to view the data retrieved from Edgescan in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Edgescan from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Server URL	Yes	https://live.edgescan.com	Edgescan URL
API token	Yes	—	Edgescan API token
Page size	No	100	Maximum number of records to get per API request

Authentication

The Edgescan connector authenticates with an API token. The token is supplied as a confidential configuration property and sent on every request in the X-API-TOKEN request header. The connector does not use HTTP Basic authentication.

Endpoint

Method	URL
GET	https://live.edgescan.com/api/v1/vulnerabilities.json?o=0&l=1

The connection test issues this request to validate the token and base URL.

Request Headers

Header	Value
X-API-TOKEN	<API Token>
Accept	application/json

Request Body

No request body is required. All requests are GET requests; filtering, paging, and detail level are passed as query parameters.

Sample Request

GET /api/v1/vulnerabilities.json?o=0&l=1 HTTP/1.1
Host: live.edgescan.com
X-API-TOKEN: <API Token>
Accept: application/json

Sample Response

{
  "vulnerabilities": [
    {
      "id": 123456,
      "asset_id": 789,
      "definition_id": 4567,
      "status": "open",
      "severity": 4,
      "location": "https://app.example.com/login",
      "updated_at": "2026-05-01T10:15:30.000Z"
    }
  ]
}

Response Fields

Field	Description
vulnerabilities / assets / hosts / definitions	The array of records for the requested object type. The wrapping field name varies by endpoint.
id	Unique identifier of the record, used as the connector object UID.

Token Usage in Subsequent Requests

The same X-API-TOKEN header is set on every request the connector makes (paged listing requests and per-vulnerability request/response detail lookups). No session or refresh exchange is performed; the static token authenticates each call directly.

Sync Behavior

The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.

How to obtain Edgescan credentials

Generate an Edgescan API token

For the Edgescan connector to use the Edgescan API, you must generate an API token. To do so, follow these steps:

1. Log in to your organization's Edgescan portal as an administrator.

2. Click the user profile icon in the top right corner and select Account settings from the drop-down.

3. Locate the API tokens section, provide a label, and set an optional expiry date.

4. Click Create.

   Your new API key token displays. You can't view the token again after this. Copy and save it to a secure location.

   The API token inherits the permissions of the user who created it. Brinqa recommends generating the token from a user account with the Viewer User role and View permissions for the relevant assets or resources. This is the minimum role and permission set required to retrieve data from the Edgescan API without administrative privileges. For more information, see the Edgescan documentation for creating users and assigning permissions.

Note: If you do not have permission to create an API token, contact your Edgescan administrator. For additional information, see the Edgescan documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Host

Source Field Name	SDM Attribute
HostResource.apis_detected	API_DETECTED
HostResource.asset_id	ASSET_ID
HostResource.hostnames	HOSTNAMES
HostResource.id	UID
HostResource.id	HOST_ID
HostResource.label	LABEL
HostResource.location	IP_ADDRESSES
HostResource.location	PUBLIC_IP_ADDRESSES
HostResource.location	PRIVATE_IP_ADDRESSES
HostResource.os_name	OPERATING_SYSTEM
HostResource.services[].discovered_apis[].type	DISCOVERED_APIS
HostResource.services[].port	OPEN_PORTS
HostResource.services[].service_name	SERVICES
HostResource.status	SOURCE_STATUS
HostResource.status	STATUS
HostResource.updated_at	SOURCE_LAST_MODIFIED

Network

Source Field Name	SDM Attribute
AssetResource.active_licence.expired	LICENSED
AssetResource.asset_status	SOURCE_STATUS
AssetResource.asset_status	STATUS
AssetResource.authenticated	AUTHENTICATED
AssetResource.blocked_status	BLOCKED_STATUS
AssetResource.combined_risk_score	COMBINED_RISK_SCORE
AssetResource.created_at	SOURCE_CREATED_DATE
AssetResource.current_assessment.status	CURRENT_ASSESSMENT_STATUS
AssetResource.current_assessment.type	CURRENT_ASSESSMENT_TYPE
AssetResource.id	UID
AssetResource.last_assessment_date	LAST_ASSESSMENT_DATE
AssetResource.last_host_scan	LAST_HOST_SCAN
AssetResource.location_specifiers (type api_descriptor)	API_DESCRIPTORS
AssetResource.location_specifiers (type block)	IP_BLOCKS
AssetResource.location_specifiers (type cidr)	CIDR
AssetResource.location_specifiers (type cidrv6)	CIDRV6
AssetResource.location_specifiers (type hostname)	HOSTNAMES
AssetResource.location_specifiers (type ip, iv6p)	IP_ADDRESSES
AssetResource.location_specifiers (type url)	URLS
AssetResource.name	NAME
AssetResource.network_access	NETWORK_ACCESS
AssetResource.next_assessment_date	NEXT_ASSESSMENT_DATE
AssetResource.next_host_scan	NEXT_HOST_SCAN
AssetResource.pci_enabled	PCI_ENABLED
AssetResource.priority	PRIORITY
AssetResource.tags	TAGS
AssetResource.updated_at	SOURCE_LAST_MODIFIED

Web Application

Source Field Name	SDM Attribute
AssetResource.active_licence.expired	LICENSED
AssetResource.asset_status	SOURCE_STATUS
AssetResource.asset_status	STATUS
AssetResource.authenticated	AUTHENTICATED
AssetResource.blocked_status	BLOCKED_STATUS
AssetResource.combined_risk_score	COMBINED_RISK_SCORE
AssetResource.created_at	SOURCE_CREATED_DATE
AssetResource.current_assessment.status	CURRENT_ASSESSMENT_STATUS
AssetResource.current_assessment.type	CURRENT_ASSESSMENT_TYPE
AssetResource.id	UID
AssetResource.last_assessment_date	LAST_ASSESSMENT_DATE
AssetResource.last_host_scan	LAST_HOST_SCAN
AssetResource.location_specifiers (type api_descriptor)	API_DESCRIPTORS
AssetResource.location_specifiers (type block)	IP_BLOCKS
AssetResource.location_specifiers (type cidr)	CIDR
AssetResource.location_specifiers (type cidrv6)	CIDRV6
AssetResource.location_specifiers (type hostname)	HOSTNAMES
AssetResource.location_specifiers (type ip, iv6p)	IP_ADDRESSES
AssetResource.location_specifiers (type url)	URLS
AssetResource.name	NAME
AssetResource.network_access	NETWORK_ACCESS
AssetResource.next_assessment_date	NEXT_ASSESSMENT_DATE
AssetResource.next_host_scan	NEXT_HOST_SCAN
AssetResource.pci_enabled	PCI_ENABLED
AssetResource.priority	PRIORITY
AssetResource.tags	TAGS
AssetResource.updated_at	SOURCE_LAST_MODIFIED

Container

Source Field Name	SDM Attribute
AssetResource.active_licence.expired	LICENSED
AssetResource.asset_status	SOURCE_STATUS
AssetResource.asset_status	STATUS
AssetResource.authenticated	AUTHENTICATED
AssetResource.blocked_status	BLOCKED_STATUS
AssetResource.combined_risk_score	COMBINED_RISK_SCORE
AssetResource.created_at	SOURCE_CREATED_DATE
AssetResource.current_assessment.status	CURRENT_ASSESSMENT_STATUS
AssetResource.current_assessment.type	CURRENT_ASSESSMENT_TYPE
AssetResource.id	UID
AssetResource.last_assessment_date	LAST_ASSESSMENT_DATE
AssetResource.last_host_scan	LAST_HOST_SCAN
AssetResource.location_specifiers (type api_descriptor)	API_DESCRIPTORS
AssetResource.location_specifiers (type block)	IP_BLOCKS
AssetResource.location_specifiers (type cidr)	CIDR
AssetResource.location_specifiers (type cidrv6)	CIDRV6
AssetResource.location_specifiers (type hostname)	HOSTNAMES
AssetResource.location_specifiers (type ip, iv6p)	IP_ADDRESSES
AssetResource.location_specifiers (type url)	URLS
AssetResource.name	NAME
AssetResource.network_access	NETWORK_ACCESS
AssetResource.next_assessment_date	NEXT_ASSESSMENT_DATE
AssetResource.next_host_scan	NEXT_HOST_SCAN
AssetResource.pci_enabled	PCI_ENABLED
AssetResource.priority	PRIORITY
AssetResource.tags	TAGS
AssetResource.updated_at	SOURCE_LAST_MODIFIED

Vulnerability

Source Field Name	SDM Attribute
Derived	STATUS_CATEGORY
Derived	SEVERITY_SCORE
request/response detail lookup	REQUEST
request/response detail lookup	RESPONSE
VulnerabilityResource.altered_score	ALTERED_SCORE
VulnerabilityResource.asset_id	TARGETS
VulnerabilityResource.asset_name	ASSET_NAME
VulnerabilityResource.created_at	SOURCE_CREATED_DATE
VulnerabilityResource.date_closed	LAST_FIXED
VulnerabilityResource.date_opened	FIRST_FOUND
VulnerabilityResource.definition_id	TYPE
VulnerabilityResource.details[0].port	PORT
VulnerabilityResource.details[0].protocol	PROTOCOL
VulnerabilityResource.details[0].src	DETAILS
VulnerabilityResource.id	UID
VulnerabilityResource.label	LABEL
VulnerabilityResource.layer	LAYER
VulnerabilityResource.location	LOCATION
VulnerabilityResource.pci_compliance_status	PCI_COMPLIANCE_STATUS
VulnerabilityResource.risk	RISK
VulnerabilityResource.severity	SOURCE_SEVERITY
VulnerabilityResource.severity	SEVERITY
VulnerabilityResource.status	PROVIDER_STATUS
VulnerabilityResource.status	SOURCE_STATUS
VulnerabilityResource.status	STATUS
VulnerabilityResource.threat	THREAT
VulnerabilityResource.updated_at	SOURCE_LAST_MODIFIED

Vulnerability Definition

Source Field Name	SDM Attribute
DefinitionResource.cves	CVE_IDS
DefinitionResource.cves	CVE_RECORDS
DefinitionResource.cvss_score	CVSS_V3_BASE_SCORE
DefinitionResource.cvss_vector	CVSS_V3_VECTOR
DefinitionResource.cvss_vector	CVSS metric attributes
DefinitionResource.cwes	CWE_IDS
DefinitionResource.cwes	WEAKNESSES
DefinitionResource.description_src	SUMMARY
DefinitionResource.id	UID
DefinitionResource.layer	LAYER
DefinitionResource.name	NAME
DefinitionResource.remediation_src	RECOMMENDATION
DefinitionResource.risk	RISK
DefinitionResource.severity	SOURCE_SEVERITY
DefinitionResource.severity	SEVERITY
DefinitionResource.threat	THREAT
Derived	SEVERITY_SCORE

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Host

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /api/v1/hosts.json
• Default filters: detail_level=high

Network

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /api/v1/assets.json
• Default filters: c[type]=net, detail_level=high

Web Application

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /api/v1/assets.json
• Default filters: c[type]=app, detail_level=high

Container

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /api/v1/assets.json
• Default filters: c[type]=container, detail_level=high

Vulnerability

Operation options

Option	Type	Default	Description
includeRequestResponse	boolean	false	When enabled, the connector performs an additional per-vulnerability lookup to retrieve and populate the REQUEST and RESPONSE attributes.
maxRetries	int	Configuration value	Number of retry attempts for failed requests.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /api/v1/vulnerabilities.json
• Default filters: detail_level=high

Vulnerability Definition

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /api/v1/definitions.json
• Default filters: detail_level=high

Changelog

Changelog

The Edgescan connector has undergone the following changes:

Version	Description	Migration Steps
3.0.1	Bug Fixes - Corrected the authentication method used to connect to Edgescan. The connector now authenticates using Edgescan's dedicated API token header, resolving authorization failures that could prevent data from synchronizing. Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.0	Overview The Edgescan connector integrates with Edgescan to synchronize assets, vulnerability findings, and vulnerability definitions, giving you unified visibility into your environment's security posture. Category: Vulnerability Management Models	N/A