Entro Security
Identity Risk Management- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Entro Connector integrates with the Entro external security framework to fetch and synchronize security-related data into the internal Unified Data Model (UDM). It retrieves information such as accounts, employees, non-human identities, risks, and exposed secrets, and maps them to the corresponding UDM models for further analysis and correlation.
Data retrieved from Entro
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Account | Yes | Cloud Resource |
| Employee | Yes | Person |
| Risk | Yes | Violation |
| Risk Definition | Yes | Violation Definition |
| Exposed Secret | Yes | Alert |
| Exposed Secret Definition | Yes | Alert Definition |
| NHI Token | Yes | NHI Token |
Model relationships
For detailed steps on how to view the data retrieved from Entro in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Entro from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Server URL | Yes | https://<server>/ | Entro Platform server URL |
| API token | Yes | (none) | Entro Platform API token |
| Page size | No | 50 | Maximum number of records to get per API request |
| Maximum retries | No | 5 | The maximum number of retry attempts before giving up a request |
| Parallel requests | No | min(4, CPU cores) | Maximum number of parallel API requests |
Authentication
The connector authenticates with the Entro API using an API Key. The key is supplied through the apiKey configuration property and is sent verbatim in the Authorization request header on every API call. No separate token-exchange or login step is performed — the same credential is reused for each request.
Connectivity Test Endpoint
On connection test, the connector issues a request against the accounts endpoint to confirm the API base URL and credential are valid.
| Method | URL |
|---|---|
| GET | {baseUrl}/v1/accounts |
Request Headers
| Header | Value | Description |
|---|---|---|
Authorization | {apiKey} | The configured Entro API key, sent as-is. |
Content-Type | application/json | Request/response content type. |
Sample Response
A successful call returns the requested resource collection. For the accounts endpoint:
[
{
"uid": "aws-123456789012",
"accountType": "AWS",
"connectorId": "conn-001",
"environment": "production",
"status": "ENABLED",
"createdAt": "2024-01-15T10:22:31Z"
}
]
Response Fields
| Field | Description |
|---|---|
uid | Unique identifier of the account. |
accountType | Account type (e.g. AWS, AZURE). |
connectorId | Identifier of the originating connector. |
environment | Environment the account belongs to. |
status | Provider-reported account status. |
createdAt | Timestamp the account was created. |
The credential is not refreshed or rotated by the connector; the configured apiKey is attached to the Authorization header of every subsequent request (paged listing requests use the limit/skip query parameters for pagination).
Sync Behavior
The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.
How to obtain Entro credentials
Obtain the required credentials (url, apiKey) from your Entro administrator or the Entro admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Account
| Source Field Name | SDM Attribute |
|---|---|
AccountResource.accountType | ACCOUNT_TYPE |
AccountResource.connectorId | CONNECTOR_ID |
AccountResource.createdAt | CREATED_AT |
AccountResource.createdAt | SOURCE_CREATED_DATE |
AccountResource.environment | ENVIRONMENT |
AccountResource.status | PROVIDER_STATUS |
AccountResource.status (normalized) | SOURCE_STATUS |
AccountResource.uid | UID |
AccountResource.uid | NAME |
AccountResource.uid | ACCOUNT_UID |
| N/A | CATEGORIES |
| sync time | LAST_CAPTURED |
Employee
| Source Field Name | SDM Attribute |
|---|---|
EmployeeReource.accounts | ACCOUNTS |
EmployeeReource.aliases | ALIASES |
EmployeeReource.azureEmployeeType | AZURE_EMPLOYEE_TYPE |
EmployeeReource.creationDate | CREATION_DATE |
EmployeeReource.creationDate | SOURCE_CREATED_DATE |
EmployeeReource.division | DIVISION |
EmployeeReource.email | EMAILS |
EmployeeReource.employeeType | EMPLOYEE_TYPE |
EmployeeReource.fullName | NAME |
EmployeeReource.fullName | FULL_NAME |
EmployeeReource.idpSources | IDP_SOURCES |
EmployeeReource.lastLogin | LAST_LOGIN |
EmployeeReource.manager | MANAGERS |
EmployeeReource.organization | ORGANIZATION |
EmployeeReource.ownerUid | OWNER_UID |
EmployeeReource.phone | PHONE_NUMBERS |
EmployeeReource.status | PROVIDER_STATUS |
EmployeeReource.status (normalized) | SOURCE_STATUS |
EmployeeReource.title | TITLE |
EmployeeReource.title | JOB_TITLE |
md5 of (EmployeeReource.email, EmployeeReource.fullName) | UID |
| N/A | CATEGORIES |
| sync time | LAST_CAPTURED |
Risk
| Source Field Name | SDM Attribute |
|---|---|
| --------------- | ---------- |
| Default Value | Option |
md5 of (RiskResource.category, RiskResource.ruleCode, RiskResource.source, RiskResource.severity) | TYPE |
md5 of (RiskResource.employee.email, RiskResource.employee.name) | TARGETS |
null | severity |
null | status |
null | category |
RiskResource.category | CATEGORIES |
RiskResource.creationDate | CREATION_DATE |
RiskResource.creationDate | SOURCE_CREATED_DATE |
RiskResource.customerId | CUSTOMER_ID |
RiskResource.detectionTime | DETECTION_TIME |
RiskResource.detectionTime | FIRST_FOUND |
RiskResource.exposureTime | EXPOSURE_TIME |
RiskResource.exposureUrls | EXPOSURE_URLS |
RiskResource.guid | UID |
RiskResource.hasWebhookMessage | HAS_WEBHOOK_MESSAGE |
RiskResource.isArchived | IS_ARCHIVED |
RiskResource.modifyDate | MODIFY_DATE |
RiskResource.modifyDate | SOURCE_LAST_MODIFIED |
RiskResource.owner | OWNER |
RiskResource.ownerUid | OWNER_UID |
RiskResource.path | PATH |
RiskResource.payload | RESULTS |
RiskResource.payload[].account.uid | TARGETS |
RiskResource.ruleCode | RULE_CODE |
RiskResource.status | PROVIDER_STATUS |
RiskResource.status (normalized) | SOURCE_STATUS |
RiskResource.tags | TAGS |
RiskResource.type | RISK_TYPE |
| sync time | LAST_CAPTURED |
Risk Definition
| Source Field Name | SDM Attribute |
|---|---|
md5 of (RiskResource.category, RiskResource.ruleCode, RiskResource.source, RiskResource.severity) | UID |
RiskResource.mitigation | MITIGATION |
RiskResource.mitigation | RECOMMENDATION |
RiskResource.name | NAME |
RiskResource.severity | SOURCE_SEVERITY |
RiskResource.severity (normalized) | SEVERITY |
RiskResource.severity (normalized, scored) | SEVERITY_SCORE |
RiskResource.threatDescription | THREAT_DESCRIPTION |
RiskResource.threatDescription | DESCRIPTION |
| sync time | LAST_CAPTURED |
Exposed Secret
| Source Field Name | SDM Attribute |
|---|---|
ExposedSecretResource.account.accountId | ACCOUNT_ID |
ExposedSecretResource.account.accountType | ACCOUNT_TYPE |
ExposedSecretResource.account.environment | ACCOUNT_ENVIRONMENT |
ExposedSecretResource.account.environmentType | ACCOUNT_ENVIRONMENT_TYPE |
ExposedSecretResource.account.uid | TARGETS |
ExposedSecretResource.account.uid | ACCOUNT_UID |
ExposedSecretResource.employee.email | EMPLOYEE_EMAIL |
ExposedSecretResource.employee.name | EMPLOYEE_NAME |
ExposedSecretResource.exposedId | UID |
ExposedSecretResource.exposureTime | FIRST_FOUND |
ExposedSecretResource.exposureTime | EXPOSURE_TIME |
ExposedSecretResource.exposureUrl | EXPOSURE_URL |
ExposedSecretResource.hash | HASH |
ExposedSecretResource.isGeneric | IS_GENERIC |
ExposedSecretResource.isPublic | IS_PUBLIC |
ExposedSecretResource.keyId | KEY_ID |
ExposedSecretResource.location | LOCATION |
ExposedSecretResource.locationType | LOCATION_TYPE |
ExposedSecretResource.occurrences | OCCURRENCES |
ExposedSecretResource.owner | OWNER |
ExposedSecretResource.path | PATH |
ExposedSecretResource.redactedSecret | REDACTED_SECRET |
ExposedSecretResource.scope | SCOPE |
ExposedSecretResource.secretValue | SECRET_VALUE |
ExposedSecretResource.snippet | SNIPPET |
ExposedSecretResource.status | PROVIDER_STATUS |
ExposedSecretResource.status (normalized) | SOURCE_STATUS |
ExposedSecretResource.tags | TAGS |
ExposedSecretResource.targetAccount | TARGET_ACCOUNT |
ExposedSecretResource.type | EXPOSED_SECRET_TYPE |
ExposedSecretResource.vendorHash | VENDOR_HASH |
md5 of (ExposedSecretResource.employee.email, ExposedSecretResource.employee.name) | TARGETS |
md5 of (ExposedSecretResource.type, ExposedSecretResource.severity) | TYPE |
| sync time | LAST_CAPTURED |
Exposed Secret Definition
| Source Field Name | SDM Attribute |
|---|---|
ExposedSecretResource.exposedId | NAME |
ExposedSecretResource.severity | SOURCE_SEVERITY |
ExposedSecretResource.severity (normalized) | SEVERITY |
ExposedSecretResource.severity (normalized, scored) | SEVERITY_SCORE |
ExposedSecretResource.type | EXPOSED_SECRET_TYPE |
md5 of (ExposedSecretResource.type, ExposedSecretResource.severity) | UID |
| sync time | LAST_CAPTURED |
NHI Token
| Source Field Name | SDM Attribute |
|---|---|
| --------------- | -------------- |
| Default Value | Option |
NHITokenResource.attributes.account | ACCOUNT |
NHITokenResource.attributes.accountNickname | ACCOUNT_NICKNAME |
NHITokenResource.attributes.createdDate | CREATED_DATE |
NHITokenResource.attributes.createdDate | SOURCE_CREATED_DATE |
NHITokenResource.attributes.entroTokenUrl | ENTRO_TOKEN_URL |
NHITokenResource.attributes.entroUniqueIdentifier | UID |
NHITokenResource.attributes.environment | ENVIRONMENT |
NHITokenResource.attributes.expirationDate | EXPIRATION_DATE |
NHITokenResource.attributes.isActive | IS_ACTIVE |
NHITokenResource.attributes.isAdmin | IS_ADMIN |
NHITokenResource.attributes.lastActivityDate | LAST_ACTIVITY_DATE |
NHITokenResource.attributes.nhiName | NAME |
NHITokenResource.attributes.nhiName | NHI_NAME |
NHITokenResource.attributes.nhiStatus | NHI_STATUS |
NHITokenResource.attributes.nhiStatus | PROVIDER_STATUS |
NHITokenResource.attributes.nhiStatus (normalized) | SOURCE_STATUS |
NHITokenResource.attributes.nhiType | NHI_TYPE |
NHITokenResource.attributes.owner | OWNER |
NHITokenResource.attributes.ownerEmail | OWNER_EMAIL |
NHITokenResource.attributes.sourceSystem | SOURCE_SYSTEM |
NHITokenResource.attributes.tags | TAGS |
NHITokenResource.attributes.token | TOKEN |
NHITokenResource.attributes.url | URL |
null | account_type |
| sync time | LAST_CAPTURED |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Account
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Account on every run and applies no incremental date filter.
API
- Type: REST · Endpoint:
GET /v1/accounts
Employee
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Employee on every run and applies no incremental date filter.
API
- Type: REST · Endpoint:
GET /v1/employees
Risk
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on fromDate.
API
- Type: REST · Endpoint:
GET /v1/risks - Default filters: When a
sincevalue is supplied, the connector sendsfromDate(formattedMM-dd-yyyy). Operation options map to query parameters:severity→severity,status→riskStatus,category→category(all uppercased).
Risk Definition
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
severity | null | severity=CRITICAL | Available values : UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL (String) |
status | null | status=OPEN | Available values : OPEN, IN_PROGRESS, DISCARDED, MITIGATED, APPROVED, RESOLVED (String) |
category | null | category=MONITORING | Available values : CLOUD_SERVICE_RISKS, ABNORMAL_BEHAVIOR, MISCONFIGURATION, SECRET_HYGINE, EXPOSED_SECRET, LEAST_PRIVILEGE, MONITORING (String) |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on fromDate.
API
- Type: REST (derived from the risks endpoint; definitions are de-duplicated by an MD5 of category, ruleCode, source, and severity) · Endpoint:
GET /v1/risks - Default filters: When a
sincevalue is supplied, the connector sendsfromDate(formattedMM-dd-yyyy). Operation options map to query parameters:severity→severity,status→riskStatus,category→category(all uppercased).
Exposed Secret
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
severity | null | severity=CRITICAL | Available values : UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL (String) |
status | null | status=OPEN | Available values : INVALID, ENABLED, DISABLED, UNSUPPORTED, UNREACHABLE, REVOKED (String) |
type | null | type=GITHUB_API_TOKEN | Filter by secret type (String) |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on fromDate.
API
- Type: REST · Endpoint:
GET /v1/exposed-secrets - Default filters: When a
sincevalue is supplied, the connector sendsfromDate(formattedMM-dd-yyyy). Operation options map to query parameters:severity→severity,status→status,type→type(all uppercased).
Exposed Secret Definition
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
severity | null | severity=CRITICAL | Available values : UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL (String) |
status | null | status=OPEN | Available values : INVALID, ENABLED, DISABLED, UNSUPPORTED, UNREACHABLE, REVOKED (String) |
type | null | type=GITHUB_API_TOKEN | Filter by secret type (String) |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on fromDate.
API
- Type: REST (derived from the exposed-secrets endpoint; definitions are de-duplicated by an MD5 of type and severity) · Endpoint:
GET /v1/exposed-secrets - Default filters: When a
sincevalue is supplied, the connector sendsfromDate(formattedMM-dd-yyyy). Operation options map to query parameters:severity→severity,status→status,type→type(all uppercased).
NHI Token
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of NHI Token on every run and applies no incremental date filter.
API
- Type: REST · Endpoint:
GET /v1/identity-now/nhi - Default filters: The
account_typeoperation option maps to theaccountTypequery parameter.
Changelog
The Entro connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.1 | Improvements - Accounts are now retrieved from Entro's dedicated accounts endpoint, providing more complete and consistent account data along with additional details such as provider status, normalized source status, and creation timestamps. - Expanded the attributes captured for accounts, employees, non-human identities, risks, and exposed secrets to give a richer view of synchronized data. | • Account: The unique identifier for accounts has changed from the prior account ID to Entro's account UID, and accounts are now sourced from the dedicated accounts endpoint. Action: purge existing Account data and re-sync the connector so accounts (and the risk and exposed-secret findings that reference them) are rebuilt with the new identifiers. |
| 3.0.0 | Overview The Entro connector integrates with the Entro platform to synchronize identity-related security data, including cloud accounts, employees, non-human identities, risks, and exposed secrets. Category: Identity Risk Management Models | N/A |