Ivanti Security Controls
Patch Management- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Ivanti Security Controls connector integrates with the Ivanti Security Controls patch management platform. Unlike REST-based connectors, it reads directly from the Ivanti Security Controls Microsoft SQL Server database, querying the underlying tables (and reporting views) to synchronize patch-management data into Brinqa.
The connector syncs the following data: managed machines (hosts), patches (solutions), patch scans (assessments), CVE definitions, the products patches apply to, the relationship between patches/products/CVEs, and the assessed/detected patch state of each machine. Together these models describe which machines were assessed by which scans, which patches were detected as missing or installed, and which CVEs each patch remediates.
Data retrieved from Ivanti Security Controls
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Host | Yes | Host |
| Patch | Yes | Solution |
| Patch Scan | Yes | Assessment |
| Cve record (CVE) | Yes | Vulnerability Definition |
| Detected patch state | Yes | Detected patch state |
| Assessed Machine | Yes | Assessed Machine |
| Patch Applies To | Yes | Patch Applies To |
| Product | Yes | Product |
Model relationships
For detailed steps on how to view the data retrieved from Ivanti Security Controls in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Ivanti Security Controls from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Server name | No | — | Ivanti SQL Server name. |
| Port | No | — | TCP/IP port for SQL Server, defaults to 1433. |
| Database name | No | — | Ivanti database name. |
| Authentication | No | — | Use Windows Authentication mode. |
| Domain | No | — | Windows domain to authenticate in, required when using Windows Authentication mode. |
| User name | No | — | Login for SQL Server |
| Password | No | — | Password for SQL Server |
| JDBC URI | No | — | Use URI for advance/direct usage. |
Authentication
Authentication is performed against the Microsoft SQL Server instance that hosts the Ivanti Security Controls database. The connector does not use an HTTP token flow; instead it opens a JDBC connection to SQL Server using one of the supported authentication modes.
| Mode | How it is configured |
|---|---|
| SQL Server authentication | Provide Server name, Port, Database name, User name, and Password. The connector connects with these credentials. |
| Windows authentication | Set Authentication (Windows auth) to true and supply a Domain. Integrated security is used in place of a SQL user/password. |
| Advanced JDBC URI | Provide a full JDBC URI to connect directly. When set, this overrides the discrete server/port/database settings; User name and Password are still applied to the data source. |
The connection is validated by opening a connection to the configured data source. There is no bearer token or session credential reused across requests — each sync acquires a JDBC connection from the SQL Server data source and runs the model's parameterized query.
Incremental sync
Each model supports incremental synchronization driven by a since sync token (an Instant, passed to the query as epoch milliseconds). When a sync token is present, the model's query adds a WHERE clause filtering on the timestamp column relevant to that model (see each model's Sync Duration Parameter below). The latest sync token for the Host model is computed from MAX(lastUpdated) on the managed-machines table.
Sync Behavior
The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.
How to obtain Ivanti Security Controls credentials
Note: The specified SQL server user account making queries must have EXECUTE and SELECT permissions in the Ivanti database schema. Ensure that these permissions are granted to avoid connectivity issues during data integration. For additional information on configuring object permissions, see the Ivanti documentation.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Host
| Source Field Name | SDM Attribute |
|---|---|
| constant active | Status |
| constant Host category | Categories |
lastPatchAssessment.smachID (Last Assessed Machine State Id) | Last assessed machine state ID |
lastPatchAssessment.smachScanDate (Last Patch Assessed) | Last patch assessed |
machine.dnsName (Asset DNS) | Dns Names |
machine.dnsName (Asset DNS) | Public Dns Names |
machine.dnsName (Asset DNS) | Private Dns Names |
machine.domain (Domain) | Domain |
machine.language (Language) | Languages |
machine.lastKnownIPAddress (Asset IP Address) | Ip Addresses |
machine.lastKnownIPAddress (Asset IP Address) | Public Ip Addresses |
machine.lastKnownIPAddress (Asset IP Address) | Private Ip Addresses |
machine.mmKey (UID) | Uid |
machine.mmOSID (Product Id) | Product ID |
machine.name (Name) | Name |
machine.name (Name) | Hostnames |
os.Value (Asset Operating System) | Operating System |
Patch
| Source Field Name | SDM Attribute |
|---|---|
installState.value (Patch Status) | Status |
installState.value (Patch Status) | Source Status |
lpp.pspplspplID (Product Id) | Product ID |
patch.patchBulletinDate (Patch Released On) | Published Date |
patch.patchBulletinID (Patch Bulletin Id) | Patch bulletin ID |
patch.patchBulletinTitle (Patch Title) | Name |
patch.patchBulletinTitle (Patch Title) | Bulletin title |
patch.patchID (Raw Patch Id) | Raw patch ID |
patch.patchQNumbers (Q Number) | Q number |
patchProductCve.cveId (CveId) | Type |
patchScan.Id (Patch Scan Id) | Patch scan ID |
ptype.value (Patch Type) | Patch type |
pvs.VendorSeverityId (Patch Severity) | Severity |
pvs.VendorSeverityId (Patch Severity) | Source Severity |
scanItem.installedOn (Patch Installed On) | Install Date |
scanItem.itemID (Detected Patch State Id) | Detected patch state ID |
scanMachine.smachID (UID) | Uid |
scanMachine.smachmmKey (MachineId) | Targets |
Patch Scan
| Source Field Name | SDM Attribute |
|---|---|
(Last Scanned) | Last scanned |
computed (Is Scan Completed) | Is scan completed |
| Is Scan Completed | Last scan status |
scan.ScanDate (End Date) | Last stopped |
scan.ScanID (UID) | Uid |
scan.ScanName (Name) | Name |
scan.ScanXMLDate (Definition Date) | Definition date |
scan.ScanXMLVersion (Definition Version) | Definition version |
scan.started (Start Date) | Last started |
scanTemplate.scantName (Template Name) | Scan template name |
Cve record (CVE)
| Source Field Name | SDM Attribute |
|---|---|
Cve.cveId (Name) | Name |
Cve.cvssV2 (CVSS v2) | Cvss v2 |
Cve.cvssV3 (CVSS v3) | Cvss v3 |
Cve.id (UID) | Uid |
Detected patch state
| Source Field Name | SDM Attribute |
|---|---|
installState.value (Install State) | Install state |
lpp.pspplspplID (Product Id) | Product ID |
patch.patchID (Patch Id) | Patch ID |
patchProductCve.cveId (CVE Id) | Cve Ids |
patchProductCve.cveId (CVE Id) | Cve Records |
scanItem.installedOn (Patch Installed On) | Source created date |
scanItem.itemID (UID) | Uid |
scanMachine.smachID (Assessed Machine State Id) | Assessed machine state ID |
Assessed Machine
| Source Field Name | SDM Attribute |
|---|---|
(Assessed Machine State Id) | Assessed machine state id |
patchScan.AssessedOn (Assessed On) | Last assessed |
patchScan.Id (Scan Id) | Patch scan Id |
scanMachine.smachID (UID) | Uid |
scanMachine.smachmmKey (Asset Sys ID) | Machine ID |
Patch Applies To
| Source Field Name | SDM Attribute |
|---|---|
lpp.pspplpatchID (Raw Patch ID) | Raw Patch ID |
lpp.pspplspplID (Raw Product ID) | Raw Product ID |
MD5 of (Raw Patch ID, Raw Product ID, Raw CVE ID) | Uid |
patchProductCve.cveId (Raw CVE ID) | CVE ID |
Product
| Source Field Name | SDM Attribute |
|---|---|
lssp.spplID (UID) | Uid |
product.endOfLife (End of Life) | End of life |
product.prodName (Name) | Name |
servicePacks.spName (Level) | Level |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Host
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: SQL query (Microsoft SQL Server / JDBC)
- Default filters: none (all managed machines); a
WHERE machine.lastUpdated >= <since>clause is added only when a sync token is supplied
Patch
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: SQL query (Microsoft SQL Server / JDBC)
- Default filters:
scanType = 1(Windows patch scans) andscanMachine.smachmmKey IS NOT NULL; apatch.patchBulletinDate > <since>clause is added when a sync token is supplied
Patch Scan
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: SQL query (Microsoft SQL Server / JDBC)
- Default filters:
scanType = 1(Windows patch scans) ORscanType = 9(Linux scans); ascan.ScanDate > <since>clause is added when a sync token is supplied
Cve record (CVE)
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: SQL query (Microsoft SQL Server / JDBC)
- Default filters: none; a
Cve.lastRevisedOn > <since>clause is added when a sync token is supplied
Detected patch state
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: SQL query (Microsoft SQL Server / JDBC)
- Default filters:
UNIONof two branches — the first returns rows wherescanItem.installState IS NOT NULL, the second derives install state for rows wherescanItem.installState IS NULL; ascanItem.installedOn > <since>clause is added to the second branch when a sync token is supplied
Assessed Machine
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: SQL query (Microsoft SQL Server / JDBC)
- Default filters: CTE restricted to
scanType = 1ORscanType = 9, andscanMachine.smachmmKey IS NOT NULL; apatchScan.AssessedOn > <since>clause is added when a sync token is supplied
Patch Applies To
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: SQL query (Microsoft SQL Server / JDBC)
- Default filters: none; a
lpp.lastRevisedOn > <since>clause is added when a sync token is supplied
Product
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: SQL query (Microsoft SQL Server / JDBC)
- Default filters: none (
DISTINCTover all products); when a sync token is supplied the bound parameter is a no-op (WHERE ? IS NOT NULL), so all products are returned on every run
Changelog
The Ivanti Security Controls connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.3 | Improvements - Added incremental synchronization support for the Product model, so that only products changed since the last run are retrieved on subsequent syncs. This reduces sync time and load on the Ivanti database. Bug Fixes - Corrected the database schema qualifier used in the CVE and Product queries so that data retrieval works reliably across Ivanti Security Controls database configurations. | N/A |
| 3.0.2 | Bug Fixes - Standardized the format of identifier values on detected patch state records so that machine, patch, and product references are stored consistently as text. Improvements - CVE references on detected patch state records are now stored with the standard CVE- prefix (for example, CVE-12345), aligning them with the canonical CVE identifier format and improving correlation with CVE records and other vulnerability data. | • Detected patch state: CVE identifier values are now stored with a CVE- prefix, which changes the stored values and how detected patch states link to CVE records. Re-sync the connector so existing records are updated to the new CVE identifier format. |
| 3.0.1 | Bug Fixes - Ensured that patch and product reference identifiers on patch-applicability records are stored consistently as text, preventing inconsistent value formatting. | N/A |
| 3.0.0 | Overview The Ivanti Security Controls connector integrates with Ivanti Security Controls to synchronize hosts, software products, patch definitions, and patch assessment results from the Ivanti database. Category: Patch Management Models | N/A |