NowSecure Workstation
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The NowSecure Workstation connector ingests NowSecure Workstation assessment reports. Workstation performs automated mobile application security testing (MAST) — combining static (SAST), dynamic (DAST), interactive (IAST), and API security testing on real physical devices — and exports its results as XML report files. The connector reads these report files from a configured reports folder and imports the assessed application, each failed control as a finding, and the reusable control definitions behind those findings.
This is a file-based integration: no network connection or authentication is required. Report files are picked up from the reports folder, processed, and optionally renamed after processing.
Each report produces three models: the assessed Application, a DynamicCodeFinding for every failed control on that app, and the reusable DynamicCodeFindingDefinition behind each finding.
Why DynamicCodeFinding (and not static, pentest, or a single flat finding):
- Workstation assessments run against apps executing on real physical devices — the analysis is fundamentally runtime/dynamic, even where it incorporates static and interactive techniques.
- Unlike the NowSecure Auto API (which carries an explicit
control.kindofstatic/dynamicand is therefore split into bothStaticCodeFindingandDynamicCodeFinding), the Workstation report has no per-finding static/dynamic indicator — only report sections (Network, Forensics, Code, Compliance). Splitting across static and dynamic would require inventing a classification the source does not provide, so a single, honestDynamicCodeFindingmapping is used. - It is automated MAST, not manual penetration testing, so the pentest-finding UDM does not fit.
Why the Finding/Definition split: each Workstation control (e.g. "Certificate Validation Test") is a reusable check whose description, remediation, severity, CVSS, and CWE detail repeat across every app that fails it. That detail lives on the DynamicCodeFindingDefinition (keyed by control title); the per-app occurrence — target app, status, evidence, device/OS context, last-found — lives on the DynamicCodeFinding instance.
Why the Application asset: Workstation reports do not otherwise create an asset, so without it every finding would be orphaned. The Application (keyed by the assessed app name) gives each finding a concrete target and lets Workstation results consolidate with the same app reported by other sources.
Data retrieved from NowSecure Workstation
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Application | Yes | Application |
| DynamicCodeFinding | Yes | Dynamic Code Finding |
| DynamicCodeFindingDefinition | Yes | Dynamic Code Finding Definition |
Model relationships
For detailed steps on how to view the data retrieved from NowSecure Workstation in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select NowSecure Workstation from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| dataDirectory | Yes | — | Fully qualified path to the NowSecure Workstation reports folder. Wildcards are allowed, e.g. /feeds/nowsecure/*.xml |
| dataDirectoryPaths | No | — | Path patterns used to include/exclude XML files |
| maxAgeInDays | Yes | — | Maximum number of days a file is retained; less than 0 means forever, 0 means the file is not kept |
| maxNumberOfFiles | Yes | — | Maximum number of files to retain; less than 0 means all, 0 means none |
| renameProcessed | No | true | Rename or move a report file after it is processed |
Authentication
This is a file-ingestion connector — it does not authenticate against a remote API and has no credentials, token, or API URL to configure. NowSecure Workstation exports its assessment results as XML report files; the connector reads those files from the reports folder configured on the connector host.
Access is governed entirely by the connector host's file system permissions:
| Requirement | Why |
|---|---|
| Read access to the reports folder | Report files are parsed in place during each sync |
| Write access to the reports folder | Required only when Post Process (renameProcessed) is enabled, so a file can be renamed once it has been processed |
Connectivity Test
There is no remote endpoint to reach, so there is no network connectivity test. Configuration validation requires that a reports folder (dataDirectory) is set; a blank value fails the connector with a configuration error before any sync work begins.
Sync Behavior
Each sync is incremental at the report-file level. The connector maintains a sync token holding the newest report file's last-modified timestamp, and each run processes only report files whose lastModified is newer than that token — files already ingested by an earlier run are skipped. Every enabled model reads the same filtered set of files, so all models share this behavior. Within a selected file, all records are emitted in full.
How to obtain NowSecure Workstation credentials
Obtain the required credentials (dataDirectory, maxAgeInDays, maxNumberOfFiles) from your NowSecure Workstation administrator or the NowSecure Workstation admin console, then enter them in the connection settings above.
When Post Process (renameProcessed) is enabled, each ingested file is renamed to <epoch-millis>_<name>.processed (or .failed if processing failed), so the same report is not ingested again on a later sync. The REPORT_NAME attribute strips that timestamp prefix, keeping the original report name on the finding.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Application
| Source Field Name | SDM Attribute |
|---|---|
assessment.application.name (fallback: project.name) | UID |
assessment.application.version | CURRENT_VERSION |
assessment.os (name + version) | PLATFORM |
| constant "active" | STATUS |
| constant ASSET_CATEGORY_APPLICATION | CATEGORIES |
| derived from the application name | NAME |
| sync timestamp | LAST_CAPTURED |
DynamicCodeFinding
| Source Field Name | SDM Attribute |
|---|---|
assessment.application.name (fallback: project.name) | TARGETS |
assessment.device.model | DEVICE_MODEL |
assessment.device.serial | DEVICE_SERIAL |
assessment.device.vendor | DEVICE_VENDOR |
assessment.name | ASSESSMENT |
assessment.os (name + version) | OS |
| constant active | SOURCE_STATUS |
MD5 of project.name + assessment.name + section.name + result.name | UID |
project.created | LAST_FOUND |
project.name | PROJECT |
| report file name | REPORT_NAME |
result.finding.details (fallback: result.details) | DETAILS |
result.name | TYPE |
| sync timestamp | LAST_CAPTURED |
DynamicCodeFindingDefinition
| Source Field Name | SDM Attribute |
|---|---|
| CWE: line of vulnerabilities | CWE_IDS |
| CWE: line of vulnerabilities | WEAKNESSES |
| derived from normalized severity | SEVERITY_SCORE |
| non-CWE lines of vulnerabilities | REFERENCES |
result.finding.cvss | CVSS_SCORE |
result.finding.description (fallback: result.description) | DESCRIPTION |
result.finding.recommendation (fallback: result.recommendation) | RECOMMENDATION |
result.name | UID |
result.name | NAME |
result.status (fallback: derived from CVSS score) | SOURCE_SEVERITY |
result.status normalized (fallback: derived from CVSS score) | SEVERITY |
section.name | CATEGORIES |
| sync timestamp | LAST_CAPTURED |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Application
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the SyncToken sync token, filtering on lastModified.
API
- Type: File ingestion — local NowSecure Workstation XML report files (no API) · Endpoint:
Report files matched from the configured reports folder (
DynamicCodeFinding
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the SyncToken sync token, filtering on lastModified.
API
- Type: File ingestion — local NowSecure Workstation XML report files (no API) · Endpoint:
Report files matched from the configured reports folder (
DynamicCodeFindingDefinition
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the SyncToken sync token, filtering on lastModified.
API
- Type: File ingestion — local NowSecure Workstation XML report files (no API) · Endpoint:
Report files matched from the configured reports folder (
Changelog
The NowSecure Workstation connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.7 | New Features NowSecure Workstation Integration Reintroduced the NowSecure Workstation integration for ingesting NowSecure Workstation assessment reports (XML) from a configured reports folder. Each report now produces: - Application — the assessed mobile app, so findings attach to a real asset instead of being orphaned. - Dynamic Code Finding — each failed control on an app, carrying its status, evidence, device, and operating-system context, and targeting the application. - Dynamic Code Finding Definition — the reusable control behind a finding (title, description, remediation, severity, CVSS score, CWEs, and regulatory references such as OWASP, HIPAA, GDPR, and PCI). This restores Workstation report ingestion for customers whose earlier connector version provided the file-based Workstation integration. Improvements Dependency Upgrades Upgraded the connector framework, model, storage, and CVSS libraries to their latest stable versions for security patches, reliability, and alignment with the rest of the connector platform. | N/A |
| 3.0.6 | No changes in this release. | N/A |
| 3.0.5 | No changes in this release. | N/A |
| 3.0.4 | No changes in this release. | N/A |
| 3.0.3 | Improvements - Retired the legacy NowSecure Workstation file-based integration, which is no longer supported. Only the NowSecure (Auto) integration remains. | N/A |
| 3.0.2 | Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.1 | Improvements - Removed the NowSecure Workstation integration from the connector, leaving the NowSecure (Auto) integration as the supported configuration. | N/A |
| 3.0.0 | No changes in this release. | N/A |