Fortify WebInspect
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Fortify WebInspect connector ingests dynamic application security testing (DAST) report files produced by Micro Focus / OpenText Fortify WebInspect. It parses the scanned issues into sites (the scanned web applications), dynamic code findings, and reusable dynamic code finding definitions.
Data retrieved from Fortify WebInspect
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Site | Yes | Site |
| Dynamic Code Finding | Yes | Dynamic Code Finding |
| Dynamic Code Finding Definition | Yes | Dynamic Code Finding Definition |
Model relationships
For detailed steps on how to view the data retrieved from Fortify WebInspect in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Fortify WebInspect from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Data Directory | Yes | — | File system directory the connector reads report files from |
| Max Age | Yes | — | Maximum number of days a file will be retained; a value less than 0 indicates forever, 0 indicates do not keep the file |
| Max Files | Yes | — | Maximum number of files to retain; less than 0 indicates all, 0 indicates none |
| Suppressed | Yes | false | Include suppressed findings |
| Removed | Yes | false | Include removed findings |
| Post Process | No | false | Rename or move the file after it is processed |
Authentication
This is a file-ingestion connector — it does not authenticate against a remote API. WebInspect report files are read from a configured data directory on the file system. Access is controlled by the connector host's file system permissions.
Sync Behavior
Each sync is a full sync. Every run enumerates all records; the connector accepts a sync token but does not apply it as an incremental filter.
How to obtain Fortify WebInspect credentials
Obtain the required credentials (Data Directory, Max Age, Max Files, Suppressed, Removed) from your Fortify WebInspect administrator or the Fortify WebInspect admin console, then enter them in the connection settings above.
When Post Process is enabled, each ingested file is renamed by appending .processed to the file name, so the same file is not ingested again on subsequent syncs.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Site
| Source Field Name | SDM Attribute |
|---|---|
(generated) | CATEGORIES |
Issue.host | UID |
Issue.host | NAME |
Issue.host | URL |
Dynamic Code Finding
| Source Field Name | SDM Attribute |
|---|---|
derived from Issue.url | PATH |
| derived from removed/suppressed flags | STATUS |
| derived from status | STATUS_CATEGORY |
Issue.checkType | CHECK_TYPE |
Issue.dateRemoved | DATE_REMOVED |
Issue.engineType | ENGINE_TYPE |
Issue.host | TARGETS |
Issue.lastFound | LAST_FOUND |
Issue.port | PORT |
Issue.removed | REMOVED |
Issue.scheme | SCHEME |
Issue.suppressed | SUPPRESSED |
Issue.sysId | UID |
Issue.url | URL |
Issue.vulnerabilityID | TYPE |
Dynamic Code Finding Definition
| Source Field Name | SDM Attribute |
|---|---|
| derived from normalized severity | SEVERITY_SCORE |
Issue.category | CATEGORIES |
Issue.checkType | TAGS |
Issue.cweIds | CWE_IDS |
Issue.cweIds | WEAKNESSES |
Issue.fix | RECOMMENDATION |
Issue.kingdom | KINGDOM |
Issue.name | NAME |
Issue.referenceInfo | REFERENCES |
Issue.severity | SOURCE_SEVERITY |
Issue.summary + Issue.implication + Issue.execution | DESCRIPTION |
Issue.vulnerabilityID | UID |
normalized Issue.severity | SEVERITY |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Site
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Site on every run and applies no incremental date filter.
API
- Type: File ingestion (WebInspect report file) · Endpoint:
Parsed from the WebInspect report file in the configured data directory; sites are de-duplicated by host
Dynamic Code Finding
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Dynamic Code Finding on every run and applies no incremental date filter.
API
- Type: File ingestion (WebInspect report file) · Endpoint:
Parsed from the WebInspect report file in the configured data directory
Dynamic Code Finding Definition
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Dynamic Code Finding Definition on every run and applies no incremental date filter.
API
- Type: File ingestion (WebInspect report file) · Endpoint:
Derived from the same parsed report as Dynamic Code Finding; definitions are de-duplicated by vulnerability id
Changelog
The Fortify WebInspect connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.1.3 | No changes in this release. | N/A |
| 3.1.2 | Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so MicroFocus Fortify data is no longer overridden by lower-priority sources. Bug Fixes - Corrected the "Source severity" attribute on the finding definitions to hold a true numeric value. The numeric severity was being written as text into a numeric attribute, so it could not be sorted, filtered by range, or used in numeric conditions. - Corrected the finding "Date removed" and "Last found" attributes to be real dates. They were stored as raw millisecond numbers, and a finding with no removal date was recorded as 1 January 1970 instead of being left empty. | • Findings and definitions: the "Source severity", "Date removed", and "Last found" attributes now store correctly-typed values. Existing records still hold the old wrong-typed values, so re-sync the Fortify WebInspect connector to repopulate them. |
| 3.1.1 | No changes in this release. | N/A |
| 3.1.0 | Improvements Dependency Upgrades - Updated underlying platform model and storage libraries along with the JSON processing library. No functional or schema changes for this connector. | N/A |
| 3.0.6 | Improvements - The "Source severity" value on dynamic code finding definitions is now captured as a numeric severity, making it consistent with the rest of the finding data. | • Dynamic Code Finding Definition: the "Source severity" attribute now stores a numeric severity. Re-sync the Fortify WebInspect connector to repopulate finding definitions with this value. |
| 3.0.5 | No changes in this release. | N/A |
| 3.0.4 | No changes in this release. | N/A |
| 3.0.3 | No changes in this release. | N/A |
| 3.0.2 | No changes in this release. | N/A |
| 3.0.1 | Improvements Dependency Upgrades - Updated underlying platform model and storage libraries and the JSON processing library, and added supporting libraries (HTML parsing, embedded storage). No functional or schema changes for this connector. | N/A |
| 3.0.0 | Overview The Fortify WebInspect connector integrates with Micro Focus Fortify WebInspect to synchronize dynamic application security testing results, including discovered sites, dynamic code findings, and their finding definitions. Category: Application Security Models | N/A |