Fortify WebInspect
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Fortify WebInspect connector ingests dynamic application security testing (DAST) report files produced by Micro Focus / OpenText Fortify WebInspect. It parses the scanned issues into sites (the scanned web applications), dynamic code findings, and reusable dynamic code finding definitions.
Data retrieved from Fortify WebInspect
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Site | Yes | Site |
| Dynamic Code Finding | Yes | Dynamic Code Finding |
| Dynamic Code Finding Definition | Yes | Dynamic Code Finding Definition |
Model relationships
For detailed steps on how to view the data retrieved from Fortify WebInspect in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Fortify WebInspect from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Data Directory | Yes | — | File system directory the connector reads report files from |
| Max Age | Yes | — | Maximum number of days a file will be retained; a value less than 0 indicates forever, 0 indicates do not keep the file |
| Max Files | Yes | — | Maximum number of files to retain; less than 0 indicates all, 0 indicates none |
| Suppressed | Yes | false | Include suppressed findings |
| Removed | Yes | false | Include removed findings |
| Post Process | No | false | Rename or move the file after it is processed |
Authentication
This is a file-ingestion connector — it does not authenticate against a remote API. WebInspect report files are read from a configured data directory on the file system. Access is controlled by the connector host's file system permissions.
How to obtain Fortify WebInspect credentials
Obtain the required credentials (Data Directory, Max Age, Max Files, Suppressed, Removed) from your Fortify WebInspect administrator or the Fortify WebInspect admin console, then enter them in the connection settings above.
When Post Process is enabled, each ingested file is renamed by appending .processed to the file name, so the same file is not ingested again on subsequent syncs.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Site
| Source Field Name | SDM Attribute |
|---|---|
(generated) | CATEGORIES |
Issue.host | UID |
Issue.host | NAME |
Issue.host | URL |
Dynamic Code Finding
| Source Field Name | SDM Attribute |
|---|---|
derived from Issue.url | PATH |
| derived from removed/suppressed flags | STATUS |
| derived from status | STATUS_CATEGORY |
Issue.checkType | CHECK_TYPE |
Issue.dateRemoved | DATE_REMOVED |
Issue.engineType | ENGINE_TYPE |
Issue.host | TARGETS |
Issue.lastFound | LAST_FOUND |
Issue.port | PORT |
Issue.removed | REMOVED |
Issue.scheme | SCHEME |
Issue.suppressed | SUPPRESSED |
Issue.sysId | UID |
Issue.url | URL |
Issue.vulnerabilityID | TYPE |
Dynamic Code Finding Definition
| Source Field Name | SDM Attribute |
|---|---|
| derived from normalized severity | SEVERITY_SCORE |
Issue.category | CATEGORIES |
Issue.checkType | TAGS |
Issue.cweIds | CWE_IDS |
Issue.cweIds | WEAKNESSES |
Issue.fix | RECOMMENDATION |
Issue.kingdom | KINGDOM |
Issue.name | NAME |
Issue.referenceInfo | REFERENCES |
Issue.severity | SOURCE_SEVERITY |
Issue.summary + Issue.implication + Issue.execution | DESCRIPTION |
Issue.vulnerabilityID | UID |
normalized Issue.severity | SEVERITY |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Site
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
TRANSACTION_ID | String | — | Controls local-store partitioning for each ingested file |
Delta sync
The connector README does not document sync behavior for this object.
API
- Type: File ingestion (WebInspect report file) · Endpoint:
Parsed from the WebInspect report file in the configured data directory; sites are de-duplicated by host
Dynamic Code Finding
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
TRANSACTION_ID | String | — | Controls local-store partitioning for each ingested file |
Delta sync
The connector README does not document sync behavior for this object.
API
- Type: File ingestion (WebInspect report file) · Endpoint:
Parsed from the WebInspect report file in the configured data directory
Dynamic Code Finding Definition
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
TRANSACTION_ID | String | — | Controls local-store partitioning for each ingested file |
Delta sync
The connector README does not document sync behavior for this object.
API
- Type: File ingestion (WebInspect report file) · Endpoint:
Derived from the same parsed report as Dynamic Code Finding; definitions are de-duplicated by vulnerability id
Changelog
The Fortify WebInspect connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.1.2 | Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so MicroFocus Fortify data is no longer overridden by lower-priority sources. Bug Fixes - Corrected the data type of the "Source severity" attribute on the finding definitions. It was declared as text but populated with a numeric value; the numeric severity is now stored as text consistently. | • Findings and definitions: the "Source severity" attribute changed type. Re-sync the Fortify WebInspect connector to repopulate these records with the corrected value. |
| 3.1.1 | No changes in this release. | N/A |
| 3.1.0 | Improvements Dependency Upgrades - Updated underlying platform model and storage libraries along with the JSON processing library. No functional or schema changes for this connector. | N/A |
| 3.0.6 | Improvements - The "Source severity" value on dynamic code finding definitions is now captured as a numeric severity, making it consistent with the rest of the finding data. | • Dynamic Code Finding Definition: the "Source severity" attribute now stores a numeric severity. Re-sync the Fortify WebInspect connector to repopulate finding definitions with this value. |
| 3.0.5 | No changes in this release. | N/A |
| 3.0.4 | No changes in this release. | N/A |
| 3.0.3 | No changes in this release. | N/A |
| 3.0.2 | No changes in this release. | N/A |
| 3.0.1 | Improvements Dependency Upgrades - Updated underlying platform model and storage libraries and the JSON processing library, and added supporting libraries (HTML parsing, embedded storage). No functional or schema changes for this connector. | N/A |
| 3.0.0 | Overview The Fortify WebInspect connector integrates with Micro Focus Fortify WebInspect to synchronize dynamic application security testing results, including discovered sites, dynamic code findings, and their finding definitions. Category: Application Security Models | N/A |