Skip to main content

Halo Security

Halo Security is an external attack surface management platform that discovers and monitors an organization's internet-facing assets and vulnerabilities. You can bring host, issue, and scan data from Halo Security into Brinqa to gain a unified view of your attack surface, thus strengthening your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Halo Security and how to obtain that information from Halo Security. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings

When setting up a data integration, select Halo Security from the Connector dropdown. If you cannot find the connector in the dropdown, make sure that you have installed it first. You must provide the following information to authenticate Halo Security with Brinqa:

  • API URL: The URL of the Halo Security API. The default URL is https://api.halosecurity.com.
  • API Key: The API key used to authenticate with Halo Security.

Generate Halo Security API keys

  1. Log in to the Halo Security portal.
  2. Go to the Account/API section.
  3. Create an API key with the type "Account".
  4. Copy the generated API key.
note

If you do not have permissions to create a key, contact your Halo Security administrator. For additional information, see Halo Security API Documentation.

Additional settings

The Halo Security connector contains additional options for specific configuration:

  • Page size: The maximum number of records to get per API request. The default setting is 100.
  • Parallel requests: The maximum number of parallel API requests. The default setting is 4.
  • Maximum retries: The maximum number of times that the integration attempts to connect to the Halo Security API before giving up and reporting a failure. The default setting is 5.

Types of data to retrieve

The Halo Security connector can retrieve the following types of data from the Halo Security API:

Table 1: Data retrieved from Halo Security

Connector ObjectRequiredMaps to Data Model
HostYesHost
IssueYesVulnerability
Issue DefinitionYesVulnerability Definition
ScanYesAssessment
info

The Halo Security connector does not currently support operation options for the types of data it retrieves.

For detailed steps on how to view the data retrieved from Halo Security in the Brinqa Platform, see How to view your data.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes.

Host

Table 2: Host attribute mappings

Source Field NameSDM Attribute
connected_score_percentCONNECTED_SCORE_PERCENT
fqdnFQDN, NAME, UID
Host (ASSET_CATEGORY_HOST)CATEGORIES
target.hostDNS_NAME
target.idHOST_ID
target.ipIP_ADDRESS, PUBLIC_IP_ADDRESS
target.scan_idSCAN_ID
target.tagsTAGS
Scan

Table 3: Scan attribute mappings

Source Field NameSDM Attribute
scan.dateSCAN_DATE
scan.scan_idNAME, UID
target.hostHOST
target.idTARGETS, TARGET_ID
target.tagsTAGS
Issue

Table 4: Issue attribute mappings

Source Field NameSDM Attribute
instance.first_found_dateFIRST_FOUND
instance.hashHASH
instance.pciPCI
instance.portPORT
instance.protocolPROTOCOL
instance.summarySUMMARY
instance.target_detailTARGET_DETAIL
instance.uriURI
issue.issue_idISSUE_ID, TYPE
issue.nameISSUE_NAME, NAME
mdf of(issue.issue_id, instance.hash)UID
normalizeFindingStatus(status.status)SOURCE_STATUS
status.statusPROVIDER_STATUS
status.target_idTARGET_ID
target.hostTARGETS
target.scan_idSCAN_ID
Issue Definition

Table 5: Issue Definition attribute mappings

Source Field NameSDM Attribute
getFindingSeverityScore(issue.severity)SEVERITY_SCORE
issue.consequencePOTENTIAL_IMPACT
issue.cve_idsCVE_IDS, CVE_RECORDS
issue.cvss_base_scoreCVSS_BASE_SCORE
issue.date_last_modifiedLAST_FOUND
issue.descriptionDESCRIPTION, SUMMARY
issue.issue_idUID
issue.nameNAME
issue.pciPCI
issue.solutionRECOMMENDATION
issue.severitySOURCE_SEVERITY
issue.typeISSUE_TYPE
normalizeFindingSeverity(issue.severity)SEVERITY

APIs

The Halo Security connector uses the Halo Security API. Specifically, it uses the following endpoints:

Table 6: Halo Security API Endpoints

Connector ObjectAPI Endpoint
HostGET /api/v1/discovery/host-list.json
IssueGET /api/v1/issue/instance.json
Issue DefinitionGET /api/v1/issue/get.json
ScanGET /api/v1/scan/list.json

Changelog

The Halo Security connector has undergone the following changes:

Table 7: Halo Security Changelog

VersionDescriptionDate Published
3.0.0Initial Integration+ release.February 4, 2026