Exterro FTK
Forensic Intelligence- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Exterro FTK connector integrates with the Exterro Forensic Toolkit (FTK) Enterprise platform to synchronize target host records. It connects to the FTK Enterprise API v2 to pull endpoint/host records into Brinqa for asset management and compliance tracking.
Data retrieved from Exterro FTK
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Device | Yes | Device |
For detailed steps on how to view the data retrieved from Exterro FTK in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Exterro FTK from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| URL | Yes | — | Base URL of the Exterro FTK server (e.g., https://server.example.com) |
| Enterprise API key | Yes | — | Enterprise Api Key for authentication with the Exterro FTK API |
| Page size | No | 10 | Number of records per page for paginated API queries (default: 10) |
| Parallelism level | No | — | Number of parallel threads for API requests (default: number of available processors, max: 2x available processors) |
| Max retries | No | 5 | Maximum number of retry attempts for failed API requests (default: 5) |
Authentication
Method
API Key authentication using the EnterpriseApiKey HTTP header.
Endpoint
| Method | URL |
|---|---|
GET | https://<SERVER FQDN>/api/v2/enterpriseapi/datasources/targets |
Request Headers
| Header | Value |
|---|---|
EnterpriseApiKey | <your-api-key> |
Content-Type | application/json |
Accept | application/json |
Sample Request
curl -L -X GET "https://SERVER_FQDN/api/v2/enterpriseapi/datasources/targets" \
-H "EnterpriseApiKey: keygoeshere"
Usage
Once configured, all API requests include the EnterpriseApiKey header automatically. No token refresh or OAuth flow is required — the key is long-lived.
Sync Behavior
Each sync is a full sync. Every run enumerates all records; the connector accepts a sync token but does not apply it as an incremental filter.
How to obtain Exterro FTK credentials
Obtain the required credentials (url, apiKey) from your Exterro FTK administrator or the Exterro FTK admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Device
| Source Field Name | SDM Attribute |
|---|---|
| "Host" | CATEGORIES |
| Derived from isAlive/isDeleted | STATUS |
DeviceResource.activeDirectoryStatus | ACTIVE_DIRECTORY_STATUS |
DeviceResource.agentId | AGENT_ID |
DeviceResource.agentIsTemporary | AGENT_IS_TEMPORARY |
DeviceResource.agentLastContacted | LAST_SEEN |
DeviceResource.agentOperatingsystem | OPERATING_SYSTEM |
DeviceResource.agentVersion | AGENT_VERSION |
DeviceResource.canPhoneHome | CAN_PHONE_HOME |
DeviceResource.computerDescription | DESCRIPTION |
DeviceResource.computerId | UID |
DeviceResource.computerName | NAME |
DeviceResource.computerName | HOSTNAMES |
DeviceResource.createdBy | CREATED_BY |
DeviceResource.createdByType | CREATED_BY_TYPE |
DeviceResource.createdByUsername | CREATED_BY_USERNAME |
DeviceResource.createdDate | SOURCE_CREATED_DATE |
DeviceResource.deletedBy | DELETED_BY |
DeviceResource.deletionDate | DELETION_DATE |
DeviceResource.groups | GROUPS |
DeviceResource.hasPersonAssociation | HAS_PERSON_ASSOCIATION |
DeviceResource.isAlive | IS_ALIVE |
DeviceResource.isDeleted | IS_DELETED |
DeviceResource.processorName | PROCESSOR_NAME |
DeviceResource.username | USERNAME |
Instant.now() | LAST_CAPTURED |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Device
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Device on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET /api/v2/enterpriseapi/datasources/targets - Default filters: None (all target host records are returned)
Changelog
The Exterro FTK connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.1 | Improvements - The published connector reference page now documents the API data source for the Device model, including the REST endpoint, page-number pagination behavior, and a sample request and response, making it clearer how host records are retrieved from Exterro FTK. | N/A |
| 3.0.0 | Overview The Exterro FTK connector integrates with the Exterro Forensic Toolkit (FTK) Enterprise platform to synchronize managed endpoint records. It connects to the FTK Enterprise API v2 to pull target host data into Brinqa for asset management and compliance tracking. Category: Forensic Intelligence Models | N/A |