Invicti
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Invicti connector integrates with the Invicti web application security scanning platform. It synchronizes websites (assets), scan metadata, dynamic code findings (issues), and finding definitions (vulnerability types) into the Brinqa platform. The connector communicates with the Invicti REST API v1 using API-token-based authentication.
Data retrieved from Invicti
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Website | Yes | Site |
| Issue Definition | Yes | Dynamic Code Finding Definition |
| Scan | Yes | Scan |
| Issue | Yes | Dynamic Code Finding |
Model relationships
For detailed steps on how to view the data retrieved from Invicti in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Invicti from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| API URL | No | https://www.netsparkercloud.com | Invicti enterprise API URL |
| User ID | Yes | Default - (user input, Required) | Invicti enterprise API user id |
| API Token | Yes | Default - (user input, Required) | Invicti enterprise API token |
| Page size | No | 200 | Maximum number of records to get per API request |
| Parallel requests | No | min(4, availableProcessors) | Maximum number of parallel API requests |
| SSL / TLS | No | false | Skip certificate verification |
| Max retries | No | 10 | Specifies the maximum number of retries permitted during a request. The default value is 10. |
| Request timeout (secs) | No | 120 | The maximum seconds allotted before a request will time out. Maximum allowed value 300 |
Authentication
Method
API Token — HTTP Basic Authentication using a User ID and API Token.
Endpoint
| Method | URL |
|---|---|
GET | https://www.netsparkercloud.com/api/1.0/account/license |
Request Headers
| Header | Value |
|---|---|
Authorization | Basic <base64(userId:apiToken)> |
Accept | application/json |
Request Body
None. Authentication is established per request via the Authorization header; the validation call is an HTTP GET with no body.
Sample Response
{
"Bonus": 0,
"MaxScanWebsites": 100,
"RemainingScanWebsites": 42,
"SubscriptionEndDateUtc": "2026-12-31T00:00:00",
"WebsiteLimitReached": false
}
Response Fields
| Field | Description |
|---|---|
MaxScanWebsites | Maximum number of websites permitted by the license |
RemainingScanWebsites | Number of website slots still available under the license |
SubscriptionEndDateUtc | Subscription expiry timestamp (UTC) |
WebsiteLimitReached | Whether the licensed website limit has been reached |
Usage
Credentials are configured in the connector's url, username (User ID), and password (API Token) properties. Every API request — including the validation call and all model syncs — carries the same HTTP Basic Authorization header derived from the User ID and API Token; there is no token-exchange step. The connector validates connectivity by calling the account/license endpoint during the test operation and treats a non-2xx status as a failed connection.
Sync Behavior
The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.
How to obtain Invicti credentials
Generate an Invicti API token
For the Invicti connector to use the Invicti Enterprise API, you must provide an API token.
To view the API token for an existing user, follow these steps:
-
Log in to your Invicti Enterprise account.
-
Click your name on the upper-right corner of the page and navigate to API Settings.
-
Enter your password and click Submit.
Your Invicti User ID and token display. Copy the API token and save it in a secure location.
To generate a new API token, follow these steps:
-
Log in to your Invicti Enterprise account.
-
Click your name in the upper-right corner of the page and navigate to API Settings.
-
Enter your password and click Submit.
-
Click Reset API Token. A new window appears.
-
Click Reset API Token.
The new Invicti API token displays. Copy the API token and save it in a secure location.
Note: If you do not have the permissions to view or create an API token, contact your Invicti administrator. For additional information, see Invicti documentation.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Website
| Source Field Name | SDM Attribute |
|---|---|
_(generated)_ | CATEGORIES |
_(generated)_ | LAST_CAPTURED |
WebsiteResource.agentMode | AGENT_MODE |
WebsiteResource.createdAt | SOURCE_CREATED_DATE |
WebsiteResource.groups[].name | GROUPS |
WebsiteResource.id | UID |
WebsiteResource.isVerified | IS_VERIFIED |
WebsiteResource.licenseType | LICENSE_TYPE |
WebsiteResource.name | NAME |
WebsiteResource.name + rootUrl | DESCRIPTION |
WebsiteResource.rootUrl | URL |
WebsiteResource.tags | TAGS |
WebsiteResource.technicalContactEmail | TECH_CONTACT_EMAIL |
WebsiteResource.updatedAt | SOURCE_LAST_MODIFIED |
Issue Definition
| Source Field Name | SDM Attribute |
|---|---|
classification.asvs40, capec, hipaa, disaStig, iso27001, nistsp80053, pci32, wasc | CLASSIFICATION |
classification.cwe | CWE_IDS |
classification.cwe | WEAKNESSES |
classification.owasp* | OWASP_CATEGORIES |
cvssVector.base.score / cvss31Vector.base.score | CVSS_V3_BASE_SCORE |
cvssVector.temporal.score / cvss31Vector.temporal.score | CVSS_V3_TEMPORAL_SCORE |
| cvssVectorString / cvss31VectorString | CVSS_V3_VECTOR |
| parsed from CVSS v3 vector | CVSS_V3_AV |
| parsed from CVSS v3 vector | CVSS_V3_AC |
| parsed from CVSS v3 vector | CVSS_V3_PR |
| parsed from CVSS v3 vector | CVSS_V3_UI |
| parsed from CVSS v3 vector | CVSS_V3_CI |
| parsed from CVSS v3 vector | CVSS_V3_II |
| parsed from CVSS v3 vector | CVSS_V3_AI |
| parsed from CVSS v3 vector | CVSS_V3_E |
| parsed from CVSS v3 vector | CVSS_V3_RL |
| parsed from CVSS v3 vector | CVSS_V3_RC |
VulnerabilityTypeResource.actions + remedy | RECOMMENDATION |
VulnerabilityTypeResource.description | NAME |
VulnerabilityTypeResource.externalReferences + remedyReferences | REFERENCES |
VulnerabilityTypeResource.impact | DESCRIPTION |
VulnerabilityTypeResource.proofOfConcept | RESULTS |
VulnerabilityTypeResource.severity | SEVERITY |
VulnerabilityTypeResource.severity | SEVERITY_SCORE |
VulnerabilityTypeResource.severity | SOURCE_SEVERITY |
VulnerabilityTypeResource.skills | SKILLS |
VulnerabilityTypeResource.summary | SUMMARY |
VulnerabilityTypeResource.type | UID |
VulnerabilityTypeResource.type | CATEGORIES |
Scan
| Source Field Name | SDM Attribute |
|---|---|
ScanResource.id | UID |
ScanResource.id | SYS_ID |
ScanResource.initiated | Initiated at |
ScanResource.phase | Phase |
ScanResource.policyName | Scan policy |
ScanResource.reportPolicyName | Report policy |
ScanResource.scanType | Type |
ScanResource.state | State |
ScanResource.stateChanged | SOURCE_LAST_MODIFIED |
ScanResource.tags | Tags |
ScanResource.targetPath | Target path |
ScanResource.targetUrl | Target URL |
ScanResource.threatLevel | Threat level |
ScanResource.websiteId | WEBSITE_ID |
ScanResource.websiteName | WEBSITE_NAME |
Issue
| Source Field Name | SDM Attribute |
|---|---|
_(schema only)_ | TAGS |
IssueResource.assigneeName | ASSIGNEE |
IssueResource.certainty | CERTAINTY |
IssueResource.firstSeenDate | FIRST_SEEN |
IssueResource.getState | PROVIDER_STATUS |
IssueResource.getState | SOURCE_STATUS |
IssueResource.getState | STATUS |
IssueResource.getState | STATUS_CATEGORY |
IssueResource.id | UID |
IssueResource.isAddressed | IS_ADDRESSED |
IssueResource.isDetectedByShark | IS_DETECTED_BY_SHARK |
IssueResource.isPresent | IS_PRESENT |
IssueResource.isRetest | IS_RETEST |
IssueResource.isTodo | IS_TODO |
IssueResource.lastScanId | LAST_SCAN_ID |
IssueResource.lastSeenDate | LAST_SEEN |
IssueResource.severity | SEVERITY |
IssueResource.severity | SEVERITY_SCORE |
IssueResource.severity | SOURCE_SEVERITY |
IssueResource.type | TYPE |
IssueResource.updatedDate | SOURCE_LAST_MODIFIED |
IssueResource.url | URL |
IssueResource.websiteId | TARGETS |
IssueResource.websiteName | WEBSITE_NAME |
VulnerabilityContent.requestContent | REQUEST |
VulnerabilityContent.responseContent | RESPONSE |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Website
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST · Endpoint:
GET /api/1.0/websites/list
Issue Definition
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST · Endpoint:
GET /api/1.0/vulnerability/list
Scan
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST · Endpoint:
GET /api/1.0/scans/list
Issue
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST · Endpoint:
GET /api/1.0/issues/allissues - Default filters:
lastSeenDate— applied only when asincevalue is present (formatted with thedateFormatoption, defaultdd/MM/yyyy)
Changelog
The Invicti connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.10 | Bug Fixes - A single issue whose request/response content cannot be retrieved no longer aborts the entire issue sync. The issue is now synchronized without its request/response content and the failure is logged, so the remaining issues still sync. | N/A |
| 3.0.9 | Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so Invicti data is no longer overridden by lower-priority sources. Bug Fixes - Corrected the Issue model's "Last scan ID" attribute to be stored as text (was Boolean), matching the value returned by the Invicti API. | • Issue: the "Last scan ID" attribute changed from Boolean to text. Re-sync the Invicti connector to repopulate issues with the corrected type. --- |
| 3.0.8 | Improvements - Added configurable rate limiting via the rateLimit OperationOption (requests per minute). The rate limiter is initialized per model at sync time and throttles all paginated list, single-resource GET, and vulnerability type definition API calls. | N/A |
| 3.0.7 | Improvements - Added a configurable request timeout setting (up to 300 seconds) to allow for longer response times from the Invicti API. | N/A |
| 3.0.6 | New Features - Web application assets are now automatically retired after 180 days without being seen in an Invicti scan, keeping your inventory aligned with what Invicti is actively scanning. - Issues now follow the lifecycle of their parent web application, so when a web application is retired its associated issues are retired alongside it. Improvements - Added provider status and source status to issues, preserving the original Invicti status value alongside the normalized Brinqa status for clearer reporting. | N/A |
| 3.0.5 | Improvements - Single-resource lookups against the Invicti API are now retried on transient failures, improving sync reliability when the API is briefly unavailable. | N/A |
| 3.0.4 | Improvements - Errors encountered during a sync are now wrapped consistently so they surface with clearer, more actionable messages. | N/A |
| 3.0.3 | Improvements - Web application attributes (Groups, Is verified, License type, Agent mode, Technical contact email) were standardized to align with the rest of the connector platform, and source created/last modified dates are now parsed consistently. | • Website: the internal naming of several web application attributes changed. Re-sync the Invicti connector to repopulate web applications with the updated attributes. --- |
| 3.0.2 | Bug Fixes - Corrected issue status mapping when Invicti returns multiple comma-separated states (for example "Present, AcceptedRisk" or "Present, False Positive"), so override states such as Accepted Risk and False Positive now take precedence as expected. | N/A |
| 3.0.1 | Improvements - Issues now include a normalized severity, a numeric severity score, and the original source severity value from Invicti, improving severity-based reporting and prioritization. - Issue status mapping now reflects the full set of Invicti states rather than collapsing everything to Present or Accepted Risk. - Web application URLs are now stored as the host name for cleaner, more consistent asset identification. | • Issue Definition: the severity number attribute was replaced by a severity score attribute. Re-sync the Invicti connector to repopulate issue definitions with the severity score. --- |
| 3.0.0 | Overview The Invicti connector integrates with Invicti (formerly Netsparker) to synchronize web applications, scans, vulnerability findings, and vulnerability definitions for application security visibility. Category: Application Security Models | N/A |