NowSecure Workstation
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The NowSecure Workstation connector ingests NowSecure Workstation assessment reports. Workstation performs automated mobile application security testing (MAST) — combining static (SAST), dynamic (DAST), interactive (IAST), and API security testing on real physical devices — and exports its results as XML report files. The connector reads these report files from a configured reports folder and imports the assessed application, each failed control as a finding, and the reusable control definitions behind those findings.
This is a file-based integration: no network connection or authentication is required. Report files are picked up from the reports folder, processed, and optionally renamed after processing.
Each report produces three models:
- Application — the assessed mobile app, with its name, version, and the test device's operating system.
- DynamicCodeFinding — one finding for every failed control on that app, carrying the target application, device and OS context, evidence details, and the time the control was last found.
- DynamicCodeFindingDefinition — the reusable control behind each finding (for example "Certificate Validation Test"), with its description, developer remediation, severity, CVSS score, CWEs, and regulatory-framework references.
Data retrieved from NowSecure Workstation
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Application | Yes | Application |
| DynamicCodeFinding | Yes | Dynamic Code Finding |
| DynamicCodeFindingDefinition | Yes | Dynamic Code Finding Definition |
Model relationships
For detailed steps on how to view the data retrieved from NowSecure Workstation in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select NowSecure Workstation from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Reports folder | Yes | — | Fully qualified path to the NowSecure Workstation reports folder. Wildcards are allowed, e.g. /feeds/nowsecure/*.xml |
| Path patterns | No | — | Path patterns used to include/exclude XML files |
| Max age | Yes | — | Maximum number of days a file is retained; less than 0 means forever, 0 means the file is not kept |
| Max files | Yes | — | Maximum number of files to retain; less than 0 means all, 0 means none |
| Post Process | No | true | Rename or move a report file after it is processed |
Authentication
This is a file-ingestion connector — it does not authenticate against a remote API and has no credentials, token, or API URL to configure. NowSecure Workstation exports its assessment results as XML report files; the connector reads those files from the reports folder configured on the connector host.
Access is governed entirely by the connector host's file system permissions:
| Requirement | Why |
|---|---|
| Read access to the reports folder | Report files are parsed in place during each sync |
| Write access to the reports folder | Required only when Post Process (renameProcessed) is enabled, so a file can be renamed once it has been processed |
Connectivity Test
There is no remote endpoint to reach, so there is no network connectivity test. Configuration validation requires that a reports folder (dataDirectory) is set; a blank value fails the connector with a configuration error before any sync work begins.
Sync Behavior
Each sync is incremental at the report-file level. The connector maintains a sync token holding the newest report file's last-modified timestamp, and each run processes only report files whose lastModified is newer than that token — files already ingested by an earlier run are skipped. Every enabled model reads the same filtered set of files, so all models share this behavior. Within a selected file, all records are emitted in full.
How to obtain NowSecure Workstation credentials
Obtain the required credentials (Reports folder, Max age, Max files) from your NowSecure Workstation administrator or the NowSecure Workstation admin console, then enter them in the connection settings above.
When Post Process (renameProcessed) is enabled, each ingested file is renamed to <epoch-millis>_<name>.processed (or .failed if processing failed), so the same report is not ingested again on a later sync. The REPORT_NAME attribute strips that timestamp prefix, keeping the original report name on the finding.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Application
| Source Field Name | SDM Attribute |
|---|---|
assessment.application.name (fallback: project.name) | UID |
assessment.application.version | CURRENT_VERSION |
assessment.os (name + version) | PLATFORM |
| constant "active" | STATUS |
| constant ASSET_CATEGORY_APPLICATION | CATEGORIES |
| derived from the application name | NAME |
| sync timestamp | LAST_CAPTURED |
DynamicCodeFinding
| Source Field Name | SDM Attribute |
|---|---|
assessment.application.name (fallback: project.name) | TARGETS |
assessment.device.model | DEVICE_MODEL |
assessment.device.serial | DEVICE_SERIAL |
assessment.device.vendor | DEVICE_VENDOR |
assessment.name | ASSESSMENT |
assessment.os (name + version) | OS |
| constant active | SOURCE_STATUS |
MD5 of project.name + assessment.name + section.name + result.name | UID |
project.created | LAST_FOUND |
project.name | PROJECT |
| report file name | REPORT_NAME |
result.finding.details (fallback: result.details) | DETAILS |
result.name | TYPE |
| sync timestamp | LAST_CAPTURED |
DynamicCodeFindingDefinition
| Source Field Name | SDM Attribute |
|---|---|
| CWE: line of vulnerabilities | CWE_IDS |
| CWE: line of vulnerabilities | WEAKNESSES |
| derived from normalized severity | SEVERITY_SCORE |
| non-CWE lines of vulnerabilities | REFERENCES |
result.finding.cvss | CVSS_SCORE |
result.finding.description (fallback: result.description) | DESCRIPTION |
result.finding.recommendation (fallback: result.recommendation) | RECOMMENDATION |
result.name | UID |
result.name | NAME |
result.status (fallback: derived from CVSS score) | SOURCE_SEVERITY |
result.status normalized (fallback: derived from CVSS score) | SEVERITY |
section.name | CATEGORIES |
| sync timestamp | LAST_CAPTURED |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Application
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the SyncToken sync token, filtering on lastModified.
API
- Type: File ingestion — local NowSecure Workstation XML report files (no API) · Endpoint: Report files matched from the configured reports folder (
dataDirectory, wildcards allowed)
DynamicCodeFinding
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the SyncToken sync token, filtering on lastModified.
API
- Type: File ingestion — local NowSecure Workstation XML report files (no API) · Endpoint: Report files matched from the configured reports folder (
dataDirectory, wildcards allowed)
DynamicCodeFindingDefinition
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the SyncToken sync token, filtering on lastModified.
API
- Type: File ingestion — local NowSecure Workstation XML report files (no API) · Endpoint: Report files matched from the configured reports folder (
dataDirectory, wildcards allowed)
Changelog
The NowSecure Workstation connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.7 | New Features NowSecure Workstation Integration Reintroduced the NowSecure Workstation integration for ingesting NowSecure Workstation assessment reports (XML) from a configured reports folder. Each report now produces: - Application — the assessed mobile app, so findings attach to a real asset instead of being orphaned. - Dynamic Code Finding — each failed control on an app, carrying its status, evidence, device, and operating-system context, and targeting the application. - Dynamic Code Finding Definition — the reusable control behind a finding (title, description, remediation, severity, CVSS score, CWEs, and regulatory references such as OWASP, HIPAA, GDPR, and PCI). This restores Workstation report ingestion for customers whose earlier connector version provided the file-based Workstation integration. Improvements Dependency Upgrades Upgraded the connector framework, model, storage, and CVSS libraries to their latest stable versions for security patches, reliability, and alignment with the rest of the connector platform. | N/A |
| 3.0.6 | No changes in this release. | N/A |
| 3.0.5 | No changes in this release. | N/A |
| 3.0.4 | No changes in this release. | N/A |
| 3.0.3 | Improvements - Retired the legacy NowSecure Workstation file-based integration, which is no longer supported. Only the NowSecure (Auto) integration remains. | N/A |
| 3.0.2 | Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.1 | Improvements - Removed the NowSecure Workstation integration from the connector, leaving the NowSecure (Auto) integration as the supported configuration. | N/A |
| 3.0.0 | No changes in this release. | N/A |