Invicti Platform
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Invicti Platform connector integrates with the Invicti Platform (formerly Netsparker Enterprise) to synchronize security findings, asset inventory, and scan data into Brinqa. It supports four vulnerability source types — DAST, SAST, SCA, and Container — each with a corresponding finding and finding definition model, plus asset models for sites, repositories, and projects, and a scan model.
Data retrieved from Invicti Platform
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Site | Yes | Site |
| Repository | Yes | Code Repository |
| Project | Yes | Application |
| Scan | Yes | Assessment |
| DAST Finding | Yes | Dynamic Code Finding |
| DAST Finding Definition | Yes | Dynamic Code Finding Definition |
| SAST Finding | Yes | Static Code Finding |
| SAST Finding Definition | Yes | Static Code Finding Definition |
| SCA Finding | Yes | Open Source Finding |
| SCA Finding Definition | Yes | Open Source Finding Definition |
| Container Finding | Yes | Vulnerability |
| Container Finding Definition | Yes | Vulnerability Definition |
Model relationships
note
For detailed steps on how to view the data retrieved from Invicti Platform in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Invicti Platform from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| API URL | Yes | https://platform.invicti.com | Invicti Platform API URL |
| API key | Yes | — | Invicti Platform API key (X-Auth header) |
| Page size | No | 50 | Maximum number of records per API request (default 50) |
| Max retries | No | 10 | Maximum number of retries on failed requests (default 5) |
| Request timeout (secs) | No | 120 | Maximum seconds allotted before a request will time out (max limit:300) |
| SSL / TLS | No | false | Skip SSL/TLS certificate verification |
Authentication
The connector authenticates using an API Key passed as a custom HTTP request header.
Endpoint
All API requests are made against the configured base URL (default: https://platform.invicti.com).
Request Headers
| Header | Value |
|---|---|
X-Auth | <apiKey> |
Usage
Every API request includes the API key header:
X-Auth: <your-api-key>
No token exchange or OAuth flow is required. The API key is used directly on every request.
Sync Behavior
The connector performs a mix of full and incremental (delta) syncs depending on the model. The asset models (Site, Repository, Project) and the Scan model perform a full sync on every run — their APIs do not support date-based filtering, so since is ignored. The vulnerability finding and finding-definition models (DAST, SAST, SCA, Container) support incremental (delta) sync: when a since token is present, the connector adds a firstSeen query parameter so each run fetches only vulnerabilities first seen on or after the token. Each model's #### Sync Duration Parameter below is authoritative.
How to obtain Invicti Platform credentials
Generate an Invicti API token
For the Invicti connector to use the Invicti Enterprise API, you must provide an API token.
To view the API token for an existing user, follow these steps:
-
Log in to your Invicti Enterprise account.
-
Click your name on the upper-right corner of the page and navigate to API Settings.
-
Enter your password and click Submit.
Your Invicti User ID and token display. Copy the API token and save it in a secure location.
To generate a new API token, follow these steps:
-
Log in to your Invicti Enterprise account.
-
Click your name in the upper-right corner of the page and navigate to API Settings.
-
Enter your password and click Submit.
-
Click Reset API Token. A new window appears.
-
Click Reset API Token.
The new Invicti API token displays. Copy the API token and save it in a secure location.
Note: If you do not have the permissions to view or create an API token, contact your Invicti administrator. For additional information, see Invicti documentation.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Site
| Source Field Name | SDM Attribute |
|---|---|
AssetResource.applicationIds | APPLICATION_IDS |
AssetResource.assetDetail.agentId | AGENT_ID |
AssetResource.assetDetail.discoveryAssetId | DISCOVERY_ASSET_ID |
AssetResource.assetDetail.fqdnRegistrationId | FQDN_REGISTRATION_ID |
AssetResource.assetDetail.isEphemeral | IS_EPHEMERAL |
AssetResource.assetDetail.targetType | TARGET_TYPE |
AssetResource.assetDetail.url | URL |
AssetResource.assetOrigins[].originSupplier | ORIGIN_SUPPLIERS |
AssetResource.assetOrigins[].originTypes | ORIGIN_TYPES |
AssetResource.assetType | ASSET_TYPE |
AssetResource.businessImpact | BUSINESS_IMPACT |
AssetResource.collectionIds | COLLECTION_IDS |
AssetResource.createdBy | CREATED_BY |
AssetResource.description | DESCRIPTION |
AssetResource.environmentId | ENVIRONMENT_ID |
AssetResource.id | UID |
AssetResource.isDemo | IS_DEMO |
AssetResource.lastScanDate | LAST_SCANNED |
AssetResource.name | NAME |
AssetResource.organizationId | ORGANIZATION_ID |
AssetResource.originIds | ORIGIN_IDS |
AssetResource.tags | TAGS |
| constant Web Application | CATEGORIES |
| sync timestamp | LAST_CAPTURED |
Repository
| Source Field Name | SDM Attribute |
|---|---|
AssetResource.applicationIds | APPLICATION_IDS |
AssetResource.assetDetail.languages | LANGUAGES |
AssetResource.assetOrigins[].originSupplier | ORIGIN_SUPPLIERS |
AssetResource.assetOrigins[].originTypes | ORIGIN_TYPES |
AssetResource.assetType | ASSET_TYPE |
AssetResource.businessImpact | BUSINESS_IMPACT |
AssetResource.collectionIds | COLLECTION_IDS |
AssetResource.createdBy | CREATED_BY |
AssetResource.description | DESCRIPTION |
AssetResource.environmentId | ENVIRONMENT_ID |
AssetResource.id | UID |
AssetResource.isDemo | IS_DEMO |
AssetResource.lastScanDate | LAST_SCANNED |
AssetResource.name | NAME |
AssetResource.organizationId | ORGANIZATION_ID |
AssetResource.originIds | ORIGIN_IDS |
AssetResource.tags | TAGS |
| constant Code Repository | CATEGORIES |
| sync timestamp | LAST_CAPTURED |
Project
| Source Field Name | SDM Attribute |
|---|---|
AssetResource.applicationIds | APPLICATION_IDS |
AssetResource.assetOrigins[].originSupplier | ORIGIN_SUPPLIERS |
AssetResource.assetOrigins[].originTypes | ORIGIN_TYPES |
AssetResource.assetType | ASSET_TYPE |
AssetResource.businessImpact | BUSINESS_IMPACT |
AssetResource.collectionIds | COLLECTION_IDS |
AssetResource.createdBy | CREATED_BY |
AssetResource.description | DESCRIPTION |
AssetResource.environmentId | ENVIRONMENT_ID |
AssetResource.id | UID |
AssetResource.isDemo | IS_DEMO |
AssetResource.lastScanDate | LAST_SCANNED |
AssetResource.name | NAME |
AssetResource.organizationId | ORGANIZATION_ID |
AssetResource.originIds | ORIGIN_IDS |
AssetResource.tags | TAGS |
| constant Application | CATEGORIES |
| sync timestamp | LAST_CAPTURED |
Scan
| Source Field Name | SDM Attribute |
|---|---|
ScanResource.address | SCAN_ADDRESS |
ScanResource.continuous | CONTINUOUS |
ScanResource.created | SOURCE_CREATED_DATE |
ScanResource.creatorId | CREATOR_ID |
ScanResource.currentSession.endDate | LAST_STOPPED |
ScanResource.currentSession.progress | SCAN_PROGRESS |
ScanResource.currentSession.scanTaskId | SCAN_TASK_ID |
ScanResource.currentSession.severityCounts.bestPractice | BEST_PRACTICE_COUNT |
ScanResource.currentSession.severityCounts.critical | CRITICAL_COUNT |
ScanResource.currentSession.severityCounts.high | HIGH_COUNT |
ScanResource.currentSession.severityCounts.info | INFO_COUNT |
ScanResource.currentSession.severityCounts.low | LOW_COUNT |
ScanResource.currentSession.severityCounts.medium | MEDIUM_COUNT |
ScanResource.currentSession.startDate | LAST_STARTED |
ScanResource.currentSession.status | SOURCE_STATUS |
ScanResource.currentSession.threat | THREAT_LEVEL |
ScanResource.currentSession.vulnerabilityCount | VULNERABILITY_COUNT |
ScanResource.ephemeral | EPHEMERAL |
ScanResource.incremental | INCREMENTAL |
ScanResource.maxScanTime | MAX_SCAN_TIME |
ScanResource.name | NAME |
ScanResource.profileId | PROFILE_ID |
ScanResource.profileName | PROFILE_NAME |
ScanResource.reportPolicyId | REPORT_POLICY_ID |
ScanResource.scanId | UID |
ScanResource.scanType | SCAN_TYPE |
ScanResource.scheduled | SCHEDULED |
ScanResource.tags | TAGS |
ScanResource.targetAddress | TARGET_ADDRESS |
ScanResource.targetId | TARGET_ID |
| sync timestamp | LAST_CAPTURED |
DAST Finding
| Source Field Name | SDM Attribute |
|---|---|
classification.owasp2021 + .owasp2017 | OWASP_CATEGORIES |
| derived from normalized severity | SEVERITY_SCORE |
normalized from VulnerabilityResource.severity | SEVERITY |
| sync timestamp | LAST_CAPTURED |
UUID derived from VulnerabilityResource.typeId | TYPE |
VulnerabilityResource.assetId | TARGETS |
VulnerabilityResource.assetName | ASSET_NAME |
VulnerabilityResource.assignee.email | ASSIGNEE_EMAIL |
VulnerabilityResource.assignee.firstName | ASSIGNEE_FIRST_NAME |
VulnerabilityResource.assignee.fullName | ASSIGNEE |
VulnerabilityResource.assignee.lastName | ASSIGNEE_LAST_NAME |
VulnerabilityResource.classification.capec | CAPEC_CATEGORIES |
VulnerabilityResource.classification.cve | CVE_IDS |
VulnerabilityResource.classification.cve | CVE_RECORDS |
VulnerabilityResource.classification.cwe | CWE_IDS |
VulnerabilityResource.classification.cwe | WEAKNESSES |
VulnerabilityResource.classification.disastig | DISA_STIG_CATEGORIES |
VulnerabilityResource.classification.hipaa | HIPAA_CATEGORIES |
VulnerabilityResource.classification.iso27001 | ISO27001_CATEGORIES |
VulnerabilityResource.classification.owaspMobile2024 | OWASP_MOBILE_CATEGORIES |
VulnerabilityResource.classification.pci32 | PCI32_CATEGORIES |
VulnerabilityResource.classification.pci40 | PCI_CATEGORIES |
VulnerabilityResource.classification.wasc | WASC_CATEGORIES |
VulnerabilityResource.comment | COMMENT |
VulnerabilityResource.confidence | CONFIDENCE |
VulnerabilityResource.confirmed | CONFIRMED |
VulnerabilityResource.confirmedByHuman | CONFIRMED_BY_HUMAN |
VulnerabilityResource.dast.attack | ATTACK |
VulnerabilityResource.dast.method | HTTP_METHOD |
VulnerabilityResource.dast.operationId | OPERATION_ID |
VulnerabilityResource.dast.parameter | HTTP_PARAMETER |
VulnerabilityResource.dast.url | URL |
VulnerabilityResource.falsePositive | FALSE_POSITIVE |
VulnerabilityResource.firstSeen | FIRST_SEEN |
VulnerabilityResource.id | UID |
VulnerabilityResource.isRetestable | IS_RETESTABLE |
VulnerabilityResource.lastSeen | LAST_SEEN |
VulnerabilityResource.lastSeenInstanceId | LAST_SEEN_INSTANCE_ID |
VulnerabilityResource.lastSeenInstanceLink | LAST_SEEN_INSTANCE_LINK |
VulnerabilityResource.lastSeenScanId | LAST_SEEN_SCAN_ID |
VulnerabilityResource.name | NAME |
VulnerabilityResource.originId | ORIGIN_ID |
VulnerabilityResource.reopenedAt | REOPENED_AT |
VulnerabilityResource.resolvedAt | RESOLVED_AT |
VulnerabilityResource.score.cvss2.score | CVSS_V2_BASE_SCORE |
VulnerabilityResource.score.cvss2.vector | CVSS_V2_VECTOR |
VulnerabilityResource.score.cvss3.score | CVSS_V3_BASE_SCORE |
VulnerabilityResource.score.cvss3.vector | CVSS_V3_VECTOR |
VulnerabilityResource.score.cvss4.score | CVSS_V4_BASE_SCORE |
VulnerabilityResource.score.cvss4.vector | CVSS_V4_VECTOR |
VulnerabilityResource.severity | SOURCE_SEVERITY |
VulnerabilityResource.signature | SIGNATURE |
VulnerabilityResource.source.detectionTechnology | DETECTION_TECHNOLOGY |
VulnerabilityResource.source.module | SOURCE_MODULE |
VulnerabilityResource.source.system | SOURCE_SYSTEM |
VulnerabilityResource.source.type | SOURCE_TYPE |
VulnerabilityResource.status | SOURCE_STATUS |
VulnerabilityResource.status | PROVIDER_STATUS |
VulnerabilityResource.tags | TAGS |
VulnerabilityResource.typeId | VULNERABILITY_TYPE_ID |
VulnerabilityResource.updatedAt | UPDATED_AT |
DAST Finding Definition
| Source Field Name | SDM Attribute |
|---|---|
classification.owasp2021 + .owasp2017 | OWASP_CATEGORIES |
| derived from normalized severity | SEVERITY_SCORE |
normalized from VulnerabilityResource.severity | SEVERITY |
| sync timestamp | LAST_CAPTURED |
VulnerabilityResource.classification.cve | CVE_IDS |
VulnerabilityResource.classification.cve | CVE_RECORDS |
VulnerabilityResource.classification.cwe | CWE_IDS |
VulnerabilityResource.classification.cwe | WEAKNESSES |
VulnerabilityResource.name | NAME |
VulnerabilityResource.score.cvss2.score | CVSS_V2_BASE_SCORE |
VulnerabilityResource.score.cvss2.vector | CVSS_V2_VECTOR |
VulnerabilityResource.score.cvss3.score | CVSS_V3_BASE_SCORE |
VulnerabilityResource.score.cvss3.vector | CVSS_V3_VECTOR |
VulnerabilityResource.score.cvss4.score | CVSS_V4_BASE_SCORE |
VulnerabilityResource.score.cvss4.vector | CVSS_V4_VECTOR |
VulnerabilityResource.severity | SOURCE_SEVERITY |
VulnerabilityResource.tags | TAGS |
VulnerabilityResource.typeId | UID |
VulnerabilityResource.typeId | TYPE_ID |
SAST Finding
| Source Field Name | SDM Attribute |
|---|---|
classification.owasp2021 + .owasp2017 | OWASP_CATEGORIES |
| derived from normalized severity | SEVERITY_SCORE |
normalized from VulnerabilityResource.severity | SEVERITY |
| sync timestamp | LAST_CAPTURED |
UUID derived from VulnerabilityResource.typeId | TYPE |
VulnerabilityResource.assetId | TARGETS |
VulnerabilityResource.assetName | ASSET_NAME |
VulnerabilityResource.assignee.email | ASSIGNEE_EMAIL |
VulnerabilityResource.assignee.firstName | ASSIGNEE_FIRST_NAME |
VulnerabilityResource.assignee.fullName | ASSIGNEE |
VulnerabilityResource.assignee.lastName | ASSIGNEE_LAST_NAME |
VulnerabilityResource.classification.capec | CAPEC_CATEGORIES |
VulnerabilityResource.classification.cve | CVE_IDS |
VulnerabilityResource.classification.cve | CVE_RECORDS |
VulnerabilityResource.classification.cwe | CWE_IDS |
VulnerabilityResource.classification.cwe | WEAKNESSES |
VulnerabilityResource.classification.disastig | DISA_STIG_CATEGORIES |
VulnerabilityResource.classification.hipaa | HIPAA_CATEGORIES |
VulnerabilityResource.classification.iso27001 | ISO27001_CATEGORIES |
VulnerabilityResource.classification.owaspMobile2024 | OWASP_MOBILE_CATEGORIES |
VulnerabilityResource.classification.pci32 | PCI32_CATEGORIES |
VulnerabilityResource.classification.pci40 | PCI_CATEGORIES |
VulnerabilityResource.classification.wasc | WASC_CATEGORIES |
VulnerabilityResource.comment | COMMENT |
VulnerabilityResource.confidence | CONFIDENCE |
VulnerabilityResource.confirmed | CONFIRMED |
VulnerabilityResource.confirmedByHuman | CONFIRMED_BY_HUMAN |
VulnerabilityResource.falsePositive | FALSE_POSITIVE |
VulnerabilityResource.firstSeen | FIRST_SEEN |
VulnerabilityResource.id | UID |
VulnerabilityResource.isRetestable | IS_RETESTABLE |
VulnerabilityResource.lastSeen | LAST_SEEN |
VulnerabilityResource.lastSeenInstanceId | LAST_SEEN_INSTANCE_ID |
VulnerabilityResource.lastSeenInstanceLink | LAST_SEEN_INSTANCE_LINK |
VulnerabilityResource.lastSeenScanId | LAST_SEEN_SCAN_ID |
VulnerabilityResource.name | NAME |
VulnerabilityResource.originId | ORIGIN_ID |
VulnerabilityResource.reopenedAt | REOPENED_AT |
VulnerabilityResource.resolvedAt | RESOLVED_AT |
VulnerabilityResource.sast.file | SAST_FILE |
VulnerabilityResource.sast.line | SAST_LINE |
VulnerabilityResource.score.cvss2.score | CVSS_V2_BASE_SCORE |
VulnerabilityResource.score.cvss2.vector | CVSS_V2_VECTOR |
VulnerabilityResource.score.cvss3.score | CVSS_V3_BASE_SCORE |
VulnerabilityResource.score.cvss3.vector | CVSS_V3_VECTOR |
VulnerabilityResource.score.cvss4.score | CVSS_V4_BASE_SCORE |
VulnerabilityResource.score.cvss4.vector | CVSS_V4_VECTOR |
VulnerabilityResource.severity | SOURCE_SEVERITY |
VulnerabilityResource.signature | SIGNATURE |
VulnerabilityResource.source.detectionTechnology | DETECTION_TECHNOLOGY |
VulnerabilityResource.source.module | SOURCE_MODULE |
VulnerabilityResource.source.system | SOURCE_SYSTEM |
VulnerabilityResource.source.type | SOURCE_TYPE |
VulnerabilityResource.status | SOURCE_STATUS |
VulnerabilityResource.status | PROVIDER_STATUS |
VulnerabilityResource.tags | TAGS |
VulnerabilityResource.typeId | VULNERABILITY_TYPE_ID |
VulnerabilityResource.updatedAt | UPDATED_AT |
SAST Finding Definition
| Source Field Name | SDM Attribute |
|---|---|
classification.owasp2021 + .owasp2017 | OWASP_CATEGORIES |
| derived from normalized severity | SEVERITY_SCORE |
normalized from VulnerabilityResource.severity | SEVERITY |
| sync timestamp | LAST_CAPTURED |
VulnerabilityResource.classification.cve | CVE_IDS |
VulnerabilityResource.classification.cve | CVE_RECORDS |
VulnerabilityResource.classification.cwe | CWE_IDS |
VulnerabilityResource.classification.cwe | WEAKNESSES |
VulnerabilityResource.name | NAME |
VulnerabilityResource.score.cvss2.score | CVSS_V2_BASE_SCORE |
VulnerabilityResource.score.cvss2.vector | CVSS_V2_VECTOR |
VulnerabilityResource.score.cvss3.score | CVSS_V3_BASE_SCORE |
VulnerabilityResource.score.cvss3.vector | CVSS_V3_VECTOR |
VulnerabilityResource.score.cvss4.score | CVSS_V4_BASE_SCORE |
VulnerabilityResource.score.cvss4.vector | CVSS_V4_VECTOR |
VulnerabilityResource.severity | SOURCE_SEVERITY |
VulnerabilityResource.tags | TAGS |
VulnerabilityResource.typeId | UID |
VulnerabilityResource.typeId | TYPE_ID |
SCA Finding
| Source Field Name | SDM Attribute |
|---|---|
classification.owasp2021 + .owasp2017 | OWASP_CATEGORIES |
| derived from normalized severity | SEVERITY_SCORE |
normalized from VulnerabilityResource.severity | SEVERITY |
| sync timestamp | LAST_CAPTURED |
UUID derived from VulnerabilityResource.typeId | TYPE |
VulnerabilityResource.assetId | TARGETS |
VulnerabilityResource.assetName | ASSET_NAME |
VulnerabilityResource.assignee.email | ASSIGNEE_EMAIL |
VulnerabilityResource.assignee.firstName | ASSIGNEE_FIRST_NAME |
VulnerabilityResource.assignee.fullName | ASSIGNEE |
VulnerabilityResource.assignee.lastName | ASSIGNEE_LAST_NAME |
VulnerabilityResource.classification.capec | CAPEC_CATEGORIES |
VulnerabilityResource.classification.cve | CVE_IDS |
VulnerabilityResource.classification.cve | CVE_RECORDS |
VulnerabilityResource.classification.cwe | CWE_IDS |
VulnerabilityResource.classification.cwe | WEAKNESSES |
VulnerabilityResource.classification.disastig | DISA_STIG_CATEGORIES |
VulnerabilityResource.classification.hipaa | HIPAA_CATEGORIES |
VulnerabilityResource.classification.iso27001 | ISO27001_CATEGORIES |
VulnerabilityResource.classification.owaspMobile2024 | OWASP_MOBILE_CATEGORIES |
VulnerabilityResource.classification.pci32 | PCI32_CATEGORIES |
VulnerabilityResource.classification.pci40 | PCI_CATEGORIES |
VulnerabilityResource.classification.wasc | WASC_CATEGORIES |
VulnerabilityResource.comment | COMMENT |
VulnerabilityResource.confidence | CONFIDENCE |
VulnerabilityResource.confirmed | CONFIRMED |
VulnerabilityResource.confirmedByHuman | CONFIRMED_BY_HUMAN |
VulnerabilityResource.falsePositive | FALSE_POSITIVE |
VulnerabilityResource.firstSeen | FIRST_SEEN |
VulnerabilityResource.id | UID |
VulnerabilityResource.isRetestable | IS_RETESTABLE |
VulnerabilityResource.lastSeen | LAST_SEEN |
VulnerabilityResource.lastSeenInstanceId | LAST_SEEN_INSTANCE_ID |
VulnerabilityResource.lastSeenInstanceLink | LAST_SEEN_INSTANCE_LINK |
VulnerabilityResource.lastSeenScanId | LAST_SEEN_SCAN_ID |
VulnerabilityResource.name | NAME |
VulnerabilityResource.originId | ORIGIN_ID |
VulnerabilityResource.reopenedAt | REOPENED_AT |
VulnerabilityResource.resolvedAt | RESOLVED_AT |
VulnerabilityResource.sca.filePath | SCA_FILE_PATH |
VulnerabilityResource.sca.packageName() | SCA_PACKAGE |
VulnerabilityResource.sca.version | SCA_VERSION |
VulnerabilityResource.score.cvss2.score | CVSS_V2_BASE_SCORE |
VulnerabilityResource.score.cvss2.vector | CVSS_V2_VECTOR |
VulnerabilityResource.score.cvss3.score | CVSS_V3_BASE_SCORE |
VulnerabilityResource.score.cvss3.vector | CVSS_V3_VECTOR |
VulnerabilityResource.score.cvss4.score | CVSS_V4_BASE_SCORE |
VulnerabilityResource.score.cvss4.vector | CVSS_V4_VECTOR |
VulnerabilityResource.severity | SOURCE_SEVERITY |
VulnerabilityResource.signature | SIGNATURE |
VulnerabilityResource.source.detectionTechnology | DETECTION_TECHNOLOGY |
VulnerabilityResource.source.module | SOURCE_MODULE |
VulnerabilityResource.source.system | SOURCE_SYSTEM |
VulnerabilityResource.source.type | SOURCE_TYPE |
VulnerabilityResource.status | SOURCE_STATUS |
VulnerabilityResource.status | PROVIDER_STATUS |
VulnerabilityResource.tags | TAGS |
VulnerabilityResource.typeId | VULNERABILITY_TYPE_ID |
VulnerabilityResource.updatedAt | UPDATED_AT |
SCA Finding Definition
| Source Field Name | SDM Attribute |
|---|---|
classification.owasp2021 + .owasp2017 | OWASP_CATEGORIES |
| derived from normalized severity | SEVERITY_SCORE |
normalized from VulnerabilityResource.severity | SEVERITY |
| sync timestamp | LAST_CAPTURED |
VulnerabilityResource.classification.cve | CVE_IDS |
VulnerabilityResource.classification.cve | CVE_RECORDS |
VulnerabilityResource.classification.cwe | CWE_IDS |
VulnerabilityResource.classification.cwe | WEAKNESSES |
VulnerabilityResource.name | NAME |
VulnerabilityResource.score.cvss2.score | CVSS_V2_BASE_SCORE |
VulnerabilityResource.score.cvss2.vector | CVSS_V2_VECTOR |
VulnerabilityResource.score.cvss3.score | CVSS_V3_BASE_SCORE |
VulnerabilityResource.score.cvss3.vector | CVSS_V3_VECTOR |
VulnerabilityResource.score.cvss4.score | CVSS_V4_BASE_SCORE |
VulnerabilityResource.score.cvss4.vector | CVSS_V4_VECTOR |
VulnerabilityResource.severity | SOURCE_SEVERITY |
VulnerabilityResource.tags | TAGS |
VulnerabilityResource.typeId | UID |
VulnerabilityResource.typeId | TYPE_ID |
Container Finding
| Source Field Name | SDM Attribute |
|---|---|
classification.owasp2021 + .owasp2017 | OWASP_CATEGORIES |
| derived from normalized severity | SEVERITY_SCORE |
normalized from VulnerabilityResource.severity | SEVERITY |
| sync timestamp | LAST_CAPTURED |
UUID derived from VulnerabilityResource.typeId | TYPE |
VulnerabilityResource.assetId | TARGETS |
VulnerabilityResource.assetName | ASSET_NAME |
VulnerabilityResource.assignee.email | ASSIGNEE_EMAIL |
VulnerabilityResource.assignee.firstName | ASSIGNEE_FIRST_NAME |
VulnerabilityResource.assignee.fullName | ASSIGNEE |
VulnerabilityResource.assignee.lastName | ASSIGNEE_LAST_NAME |
VulnerabilityResource.classification.capec | CAPEC_CATEGORIES |
VulnerabilityResource.classification.cve | CVE_IDS |
VulnerabilityResource.classification.cve | CVE_RECORDS |
VulnerabilityResource.classification.cwe | CWE_IDS |
VulnerabilityResource.classification.cwe | WEAKNESSES |
VulnerabilityResource.classification.disastig | DISA_STIG_CATEGORIES |
VulnerabilityResource.classification.hipaa | HIPAA_CATEGORIES |
VulnerabilityResource.classification.iso27001 | ISO27001_CATEGORIES |
VulnerabilityResource.classification.owaspMobile2024 | OWASP_MOBILE_CATEGORIES |
VulnerabilityResource.classification.pci32 | PCI32_CATEGORIES |
VulnerabilityResource.classification.pci40 | PCI_CATEGORIES |
VulnerabilityResource.classification.wasc | WASC_CATEGORIES |
VulnerabilityResource.comment | COMMENT |
VulnerabilityResource.confidence | CONFIDENCE |
VulnerabilityResource.confirmed | CONFIRMED |
VulnerabilityResource.confirmedByHuman | CONFIRMED_BY_HUMAN |
VulnerabilityResource.container.description | CONTAINER_DESCRIPTION |
VulnerabilityResource.container.filePath | CONTAINER_FILE_PATH |
VulnerabilityResource.container.fixedVersion | CONTAINER_FIXED_VERSION |
VulnerabilityResource.container.imageName | CONTAINER_IMAGE_NAME |
VulnerabilityResource.container.imageTag | CONTAINER_IMAGE_TAG |
VulnerabilityResource.container.layer | CONTAINER_LAYER |
VulnerabilityResource.container.operatingSystem | CONTAINER_OPERATING_SYSTEM |
VulnerabilityResource.container.packageName() | CONTAINER_PACKAGE |
VulnerabilityResource.container.packageType | CONTAINER_PACKAGE_TYPE |
VulnerabilityResource.container.registry | CONTAINER_REGISTRY |
VulnerabilityResource.container.version | CONTAINER_VERSION |
VulnerabilityResource.falsePositive | FALSE_POSITIVE |
VulnerabilityResource.firstSeen | FIRST_SEEN |
VulnerabilityResource.id | UID |
VulnerabilityResource.isRetestable | IS_RETESTABLE |
VulnerabilityResource.lastSeen | LAST_SEEN |
VulnerabilityResource.lastSeenInstanceId | LAST_SEEN_INSTANCE_ID |
VulnerabilityResource.lastSeenInstanceLink | LAST_SEEN_INSTANCE_LINK |
VulnerabilityResource.lastSeenScanId | LAST_SEEN_SCAN_ID |
VulnerabilityResource.name | NAME |
VulnerabilityResource.originId | ORIGIN_ID |
VulnerabilityResource.reopenedAt | REOPENED_AT |
VulnerabilityResource.resolvedAt | RESOLVED_AT |
VulnerabilityResource.score.cvss2.score | CVSS_V2_BASE_SCORE |
VulnerabilityResource.score.cvss2.vector | CVSS_V2_VECTOR |
VulnerabilityResource.score.cvss3.score | CVSS_V3_BASE_SCORE |
VulnerabilityResource.score.cvss3.vector | CVSS_V3_VECTOR |
VulnerabilityResource.score.cvss4.score | CVSS_V4_BASE_SCORE |
VulnerabilityResource.score.cvss4.vector | CVSS_V4_VECTOR |
VulnerabilityResource.severity | SOURCE_SEVERITY |
VulnerabilityResource.signature | SIGNATURE |
VulnerabilityResource.source.detectionTechnology | DETECTION_TECHNOLOGY |
VulnerabilityResource.source.module | SOURCE_MODULE |
VulnerabilityResource.source.system | SOURCE_SYSTEM |
VulnerabilityResource.source.type | SOURCE_TYPE |
VulnerabilityResource.status | SOURCE_STATUS |
VulnerabilityResource.status | PROVIDER_STATUS |
VulnerabilityResource.tags | TAGS |
VulnerabilityResource.typeId | VULNERABILITY_TYPE_ID |
VulnerabilityResource.updatedAt | UPDATED_AT |
Container Finding Definition
| Source Field Name | SDM Attribute |
|---|---|
classification.owasp2021 + .owasp2017 | OWASP_CATEGORIES |
| derived from normalized severity | SEVERITY_SCORE |
normalized from VulnerabilityResource.severity | SEVERITY |
| sync timestamp | LAST_CAPTURED |
VulnerabilityResource.classification.cve | CVE_IDS |
VulnerabilityResource.classification.cve | CVE_RECORDS |
VulnerabilityResource.classification.cwe | CWE_IDS |
VulnerabilityResource.classification.cwe | WEAKNESSES |
VulnerabilityResource.name | NAME |
VulnerabilityResource.score.cvss2.score | CVSS_V2_BASE_SCORE |
VulnerabilityResource.score.cvss2.vector | CVSS_V2_VECTOR |
VulnerabilityResource.score.cvss3.score | CVSS_V3_BASE_SCORE |
VulnerabilityResource.score.cvss3.vector | CVSS_V3_VECTOR |
VulnerabilityResource.score.cvss4.score | CVSS_V4_BASE_SCORE |
VulnerabilityResource.score.cvss4.vector | CVSS_V4_VECTOR |
VulnerabilityResource.severity | SOURCE_SEVERITY |
VulnerabilityResource.tags | TAGS |
VulnerabilityResource.typeId | UID |
VulnerabilityResource.typeId | TYPE_ID |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Site
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Site on every run and applies no incremental date filter.
API
- Type: REST · Endpoint:
GET /api/inventory/v1/assets?assetType=target
Repository
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Repository on every run and applies no incremental date filter.
API
- Type: REST · Endpoint:
GET /api/inventory/v1/assets?assetType=repository
Project
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Project on every run and applies no incremental date filter.
API
- Type: REST · Endpoint:
GET /api/inventory/v1/assets?assetType=project
Scan
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Scan on every run and applies no incremental date filter.
API
- Type: REST · Endpoint:
GET /api/v1/scans
DAST Finding
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on firstSeen.
API
- Type: REST · Endpoint:
GET /api/inventory/v1/vulnerabilities?sources=dast
DAST Finding Definition
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on firstSeen.
API
- Type: REST · Endpoint:
GET /api/inventory/v1/vulnerabilities?sources=dast
SAST Finding
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on firstSeen.
API
- Type: REST · Endpoint:
GET /api/inventory/v1/vulnerabilities?sources=sast
SAST Finding Definition
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on firstSeen.
API
- Type: REST · Endpoint:
GET /api/inventory/v1/vulnerabilities?sources=sast
SCA Finding
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on firstSeen.
API
- Type: REST · Endpoint:
GET /api/inventory/v1/vulnerabilities?sources=sca
SCA Finding Definition
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on firstSeen.
API
- Type: REST · Endpoint:
GET /api/inventory/v1/vulnerabilities?sources=sca
Container Finding
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on firstSeen.
API
- Type: REST · Endpoint:
GET /api/inventory/v1/vulnerabilities?sources=container
Container Finding Definition
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on firstSeen.
API
- Type: REST · Endpoint:
GET /api/inventory/v1/vulnerabilities?sources=container
Changelog
The Invicti Platform connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.12 | No changes in this release. | N/A |
| 3.0.11 | Overview The Invicti Platform connector integrates with Invicti Platform to synchronize web application targets, source code repositories, application projects, scans, and vulnerability findings discovered across DAST, SAST, SCA, and container scanning engines for comprehensive application security visibility. Category: Application Security Models | N/A |