Obsidian Security

Identity Risk Management

Overview
Setup
Data & mappings
Operations & API
Changelog

The Obsidian Security Connector integrates with the Obsidian Security platform to fetch and synchronize security posture data, including tenants, user accounts, entities, compliance standards, rules, violations, and settings. It maps these external objects into the internal Unified Data Model (UDM) to enable comprehensive security analysis, reporting, and remediation tracking.

Data retrieved from Obsidian Security

Connector Object	Required	Maps to Data Model
Tenant	Yes	Cloud Resource
Account	Yes	Cloud Resource
User	Yes	Person
Entity	Yes	Entity
Compliance Standard	Yes	Compliance Standard
Compliance Control	Yes	Compliance Control
Rule	Yes	Violation Definition
Rule Violation	Yes	Violation
Setting	Yes	Violation Definition
Setting Violation	Yes	Violation

Model relationships

note

For detailed steps on how to view the data retrieved from Obsidian Security in the Brinqa Platform, see How to view your data.

Connection settings

When setting up a data integration, select Obsidian Security from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Server URL	Yes	`https://<obsidian-server>/`	Obsidian Security server URL
API token	Yes	—	Obsidian Security API token
Page size	No	`100`	Maximum number of records to get per API request
Maximum retries	No	`5`	The maximum number of retry attempts before giving up a request
Parallel requests	No	`min(4, CPU cores)`	Maximum number of parallel API requests

Authentication

The connector authenticates with the Obsidian Security API using Bearer Token authentication. The API token is supplied during configuration and is sent on every request as an Authorization: Bearer <apiToken> header. There is no separate token-exchange step — the configured token is used directly.

Connection Verification Endpoint

On connection setup the connector verifies credentials by listing tenants:

Method	URL
`GET`	`https://<obsidian-server>/v1/connection-management/tenants`

Request Headers

Header	Value
`Authorization`	`Bearer <apiToken>`
`Content-Type`	`application/json`

Request Body

GraphQL queries (v1/gql) and Posture list endpoints are issued as POST requests whose body is a JSON payload (for GraphQL: { "query": "...", "variables": { ... } }; for Posture list endpoints: a paging payload with limit, optional cursor, optional tenant_id/tenant_uuid, and a filter object). The connection-verification call above is a GET and carries no body.

Sample Response

Example response from the connection-verification (tenants) endpoint:

{
  "data": [
    {
      "id": "tenant-123",
      "name": "Acme Production",
      "platform": "OKTA",
      "platformId": "okta-abc",
      "production": true,
      "sensitivity": "HIGH",
      "obsidianProducts": ["EXTEND", "MONITOR"],
      "updatedBy": "system",
      "updatedTime": "2026-05-01T12:00:00Z"
    }
  ],
  "cursor": null,
  "hasMoreResults": false
}

Response Fields

Field	Type	Description
`data`	array	Array of resource objects returned for the request
`cursor`	string	Opaque pagination token for the next page (null if last)
`hasMoreResults`	boolean	Indicates whether additional pages are available

Usage

A successful response confirms the token is valid. Once configured, all subsequent API requests include the bearer token:

Authorization: Bearer <apiToken>

Sync Behavior

The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.

How to obtain Obsidian Security credentials

Obtain the required credentials (url, apiToken) from your Obsidian Security administrator or the Obsidian Security admin console, then enter them in the connection settings above.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Tenant

Source Field Name	SDM Attribute
sync time	LAST_CAPTURED
`TenantResource.id`	UID
`TenantResource.id`	TENANT_ID
`TenantResource.idpCapable`	IDP_CAPABLE
`TenantResource.isCustom`	IS_CUSTOM
`TenantResource.isIdp`	IS_IDP
`TenantResource.isMarketplace`	IS_MARKETPLACE
`TenantResource.isOnPrem`	IS_ON_PREM
`TenantResource.logoDescriptor`	LOGO_DESCRIPTOR
`TenantResource.name`	NAME
`TenantResource.obsidianProducts`	OBSIDIAN_PRODUCTS
`TenantResource.platform`	PLATFORM
`TenantResource.platformId`	PLATFORM_ID
`TenantResource.production`	PRODUCTION
`TenantResource.sensitivity`	SENSITIVITY
`TenantResource.tags`	TAGS
`TenantResource.updatedBy`	UPDATED_BY
`TenantResource.updatedTime`	UPDATED_TIME
`TenantResource.updatedTime`	SOURCE_LAST_MODIFIED
`TenantResource.value`	VALUE

Account

Source Field Name	SDM Attribute
`AccountResource.addresses[] (formatted)`	ADDRESSES
`AccountResource.aliases`	ALIASES
`AccountResource.alternativeEmails[].raw`	ALTERNATIVE_EMAILS
`AccountResource.alternativeNames`	ALTERNATIVE_NAMES
`AccountResource.alternativePhones[].raw`	ALTERNATIVE_PHONES
`AccountResource.automated`	IS_AUTOMATED
`AccountResource.email.raw`	EMAILS
`AccountResource.enabled`	ENABLED
`AccountResource.entitySubType`	ENTITY_SUB_TYPE
`AccountResource.firstName`	FIRST_NAME
`AccountResource.id`	ACCOUNT_ID
`AccountResource.isAdmin`	IS_ADMIN
`AccountResource.isDeleted`	IS_DELETED
`AccountResource.isLicensed`	IS_LICENSED
`AccountResource.isRestricted`	IS_RESTRICTED
`AccountResource.lastName`	LAST_NAME
`AccountResource.mfaEnabled`	IS_MFA_ENABLED
`AccountResource.name`	NAME
`AccountResource.name + tenantId (or nativeId + tenantId)`	UID
`AccountResource.nativeId`	NATIVE_ID
`AccountResource.obsidianStatus`	OBSIDIAN_STATUS
`AccountResource.phone.raw`	PHONE_NUMBERS
`AccountResource.phone.type`	PHONE_TYPE
`AccountResource.roles[].name`	ROLES
`AccountResource.services[].name`	SERVICES
`AccountResource.status`	PROVIDER_STATUS
`AccountResource.status (normalized)`	SOURCE_STATUS
`AccountResource.temporalProperties.created`	CREATED_TIME
`AccountResource.temporalProperties.created`	SOURCE_CREATED_DATE
`AccountResource.temporalProperties.deleted`	DELETED_TIME
`AccountResource.temporalProperties.firstActive`	FIRST_ACTIVE
`AccountResource.temporalProperties.firstObserved`	FIRST_OBSERVED
`AccountResource.temporalProperties.lastActive`	LAST_ACTIVE
`AccountResource.temporalProperties.lastModified`	LAST_MODIFIED
`AccountResource.temporalProperties.lastModified`	SOURCE_LAST_MODIFIED
`AccountResource.temporalProperties.lastObserved`	LAST_OBSERVED
`AccountResource.temporalProperties.terminated`	TERMINATION_DATE
`AccountResource.tenantId`	TENANT_ID
`AccountResource.user.id`	USER_ID
`AccountResource.userGroups`	USER_GROUPS
`AccountResource.username`	USERNAME
sync time	LAST_CAPTURED

User

Source Field Name	SDM Attribute
sync time	LAST_CAPTURED
`UserResource.accounts[].name`	ACCOUNTS
`UserResource.department`	DEPARTMENT
`UserResource.division`	DIVISION
`UserResource.email.raw`	EMAILS
`UserResource.email.raw (or id)`	UID
`UserResource.enabled`	ENABLED
`UserResource.entitySubType`	ENTITY_SUB_TYPE
`UserResource.firstName`	FIRST_NAME
`UserResource.id`	USER_ID
`UserResource.isDeleted`	IS_DELETED
`UserResource.isPrivileged`	IS_PRIVILEGED
`UserResource.isServiceAccount`	IS_SERVICE_ACCOUNT
`UserResource.isTerminated`	IS_TERMINATED
`UserResource.jobTitle`	JOB_TITLE
`UserResource.lastName`	LAST_NAME
`UserResource.name`	NAME
`UserResource.nativeId`	NATIVE_ID
`UserResource.phone.raw`	PHONE_NUMBERS
`UserResource.rawRefs`	RAW_REFS
`UserResource.services[].name`	SERVICES
`UserResource.temporalProperties.created`	CREATED_TIME
`UserResource.temporalProperties.created`	SOURCE_CREATED_DATE
`UserResource.temporalProperties.lastModified`	LAST_MODIFIED
`UserResource.temporalProperties.lastModified`	SOURCE_LAST_MODIFIED
`UserResource.tenantId`	TENANT_ID
`UserResource.timezone`	TIMEZONES
`UserResource.userGroups`	USER_GROUPS

Entity

Source Field Name	SDM Attribute
`EntityResource.entitySubType`	ENTITY_SUB_TYPE
`EntityResource.id`	ENTITY_ID
`EntityResource.isDeleted`	IS_DELETED
`EntityResource.name`	NAME
`EntityResource.nativeId`	NATIVE_ID
`EntityResource.rawRefs`	RAW_REFS
`EntityResource.services[].name`	SERVICES
`EntityResource.temporalProperties.created`	CREATED_TIME
`EntityResource.temporalProperties.created`	SOURCE_CREATED_DATE
`EntityResource.temporalProperties.lastModified`	LAST_MODIFIED
`EntityResource.temporalProperties.lastModified`	SOURCE_LAST_MODIFIED
`EntityResource.tenantId`	TENANT_ID
`EntityResource.userGroups`	USER_GROUPS
nativeId or name + tenantId	UID
sync time	LAST_CAPTURED

note

Pagination Limitation: The API is returning a null cursor(next page) before all records/pages have been retrieved, causing pagination to stop early. As a result, the connector may only fetch a partial set of records. This issue has been reported and the obsidian team is looking into it.

Compliance Standard

Source Field Name	SDM Attribute
`ComplianceStandardResource.description`	DESCRIPTION
`ComplianceStandardResource.id`	UID
`ComplianceStandardResource.id`	STANDARD_ID
`ComplianceStandardResource.isCustom`	IS_CUSTOM
`ComplianceStandardResource.isNormalized`	IS_NORMALIZED
`ComplianceStandardResource.link`	LINK
`ComplianceStandardResource.name`	NAME
`ComplianceStandardResource.orgId`	ORG_ID
`ComplianceStandardResource.publisher`	PUBLISHER
`ComplianceStandardResource.version`	VERSION
sync time	LAST_CAPTURED

Compliance Control

Source Field Name	SDM Attribute
`ComplianceControlResource.description`	DESCRIPTION
`ComplianceControlResource.id`	UID
`ComplianceControlResource.id`	CONTROL_ID
`ComplianceControlResource.identifier`	IDENTIFIER
`ComplianceControlResource.link`	LINK
`ComplianceControlResource.name`	NAME
`ComplianceControlResource.standardId`	STANDARD_ID
sync time	LAST_CAPTURED

Rule

Source Field Name	SDM Attribute
`RuleResource.analyticId`	ANALYTIC_ID
`RuleResource.benchmark`	BENCHMARK
`RuleResource.controlIds`	CONTROL_IDS
`RuleResource.createdAt`	CREATED
`RuleResource.createdAt`	SOURCE_CREATED_DATE
`RuleResource.description`	DESCRIPTION
`RuleResource.descriptionShort`	DESCRIPTION_SHORT
`RuleResource.id`	UID
`RuleResource.id`	RULE_ID
`RuleResource.name`	NAME
`RuleResource.obsidianRule`	OBSIDIAN_RULE
`RuleResource.remediationInstructions`	RECOMMENDATION
`RuleResource.remediationInstructions`	REMEDIATION_INSTRUCTIONS
`RuleResource.riskLevel`	RISK_LEVEL
`RuleResource.riskLevel`	SOURCE_SEVERITY
`RuleResource.riskLevel (normalized)`	SEVERITY
`RuleResource.riskLevel (scored)`	SEVERITY_SCORE
`RuleResource.standardIds`	STANDARD_IDS
`RuleResource.type`	RULE_TYPE
`RuleResource.updatedAt`	LAST_UPDATED
`RuleResource.updatedAt`	SOURCE_LAST_MODIFIED
`RuleResource.violations`	VIOLATIONS
sync time	LAST_CAPTURED

Rule Violation

Source Field Name	SDM Attribute
Normalized state/riskAccepted	SOURCE_STATUS
`RuleResource.exceptionsCount.active`	EXCEPTIONS_COUNT_ACTIVE
`RuleResource.exceptionsCount.inactive`	EXCEPTIONS_COUNT_INACTIVE
`RuleResource.id`	TYPE
`RuleResource.platformId`	PLATFORM_ID
`RuleResource.productIds`	PRODUCT_IDS
`RuleResource.releaseLabel`	RELEASE_LABEL
`RuleResource.riskAccepted`	RISK_ACCEPTED
`RuleResource.securityDomain`	SECURITY_DOMAIN
`RuleResource.state`	STATE
`RuleResource.state`	PROVIDER_STATUS
`RuleResource.tags`	TAGS
`RuleResource.tenantUuid`	TENANT_UUID
`RuleResource.tenantUuid`	TARGETS
`RuleResource.type`	CATEGORIES
`RuleViolationResource (raw JSON)`	RESULTS
`RuleViolationResource.accountId`	TARGETS
`RuleViolationResource.appName + tenantId`	TARGETS
`RuleViolationResource.clientId`	TARGETS
`RuleViolationResource.id + tenantId (Resource ID)`	TARGETS
`RuleViolationResource.name + tenantId`	TARGETS
`RuleViolationResource.obsecFirstSeen`	FIRST_SEEN
`RuleViolationResource.obsecFirstSeen`	OBSEC_FIRST_SEEN
`RuleViolationResource.obsecLastRemediated`	LAST_REMEDIATED
`RuleViolationResource.obsecLastRemediated`	OBSEC_LAST_REMEDIATED
`RuleViolationResource.obsecLastSeen`	LAST_SEEN
`RuleViolationResource.obsecLastSeen`	OBSEC_LAST_SEEN
`RuleViolationResource.orgName + tenantId`	TARGETS
`RuleViolationResource.policyName + tenantId`	TARGETS
`RuleViolationResource.repositoryName + tenantId`	TARGETS
`RuleViolationResource.tenantId`	TENANT_ID
`RuleViolationResource.tokenId`	TARGETS
`RuleViolationResource.userName + tenantId`	TARGETS
`RuleViolationResource.violationId`	UID
`RuleViolationResource.violationId`	NAME
sync time	LAST_CAPTURED

note

The Violation resource contains many context-specific attributes depending on the product being monitored (e.g., GitHub, Okta, Workday). These are captured in the RESULTS attribute as raw JSON.

Setting

Source Field Name	SDM Attribute
`SettingResource.controlIds`	CONTROL_IDS
`SettingResource.description`	DESCRIPTION
`SettingResource.description`	RECOMMENDATION
`SettingResource.id`	UID
`SettingResource.name`	NAME
`SettingResource.riskLevel`	RISK_LEVEL
`SettingResource.riskLevel`	SOURCE_SEVERITY
`SettingResource.riskLevel (normalized)`	SEVERITY
`SettingResource.riskLevel (scored)`	SEVERITY_SCORE
`SettingResource.standardIds`	STANDARD_IDS
sync time	LAST_CAPTURED

Setting Violation

Source Field Name	SDM Attribute
`Instant.now()`	LAST_CAPTURED
`normalizeFindingStatus(status)`	SOURCE_STATUS
`SettingResource.canSetValue`	CAN_SET_VALUE
`SettingResource.dataType`	DATA_TYPE
`SettingResource.id`	TYPE
`SettingResource.isActivityBased`	IS_ACTIVITY_BASED
`SettingResource.lastScanned`	LAST_SCANNED
`SettingResource.lastStateChange`	LAST_SEEN
`SettingResource.lastStateChange`	LAST_STATE_CHANGE
`SettingResource.location`	LOCATION
`SettingResource.operation`	OPERATION
`SettingResource.options`	OPTIONS
`SettingResource.orgId`	ORG_ID
`SettingResource.platformCategory`	PLATFORM_CATEGORY
`SettingResource.platformCategory`	CATEGORIES
`SettingResource.platformId`	PLATFORM_ID
`SettingResource.platformSettingId`	PLATFORM_SETTING_ID
`SettingResource.productIds`	PRODUCT_IDS
`SettingResource.releaseLabel`	RELEASE_LABEL
`SettingResource.riskAccepted`	RISK_ACCEPTED
`SettingResource.securityDomain`	SECURITY_DOMAIN
`SettingResource.state`	STATE
`SettingResource.state`	PROVIDER_STATUS
`SettingResource.tags`	TAGS
`SettingResource.target`	SETTING_TARGET
`SettingResource.tenantId`	TENANT_ID
`SettingResource.tenantUuid`	TENANT_UUID
`SettingResource.tenantUuid`	TARGETS
`SettingResource.uniqueId`	UID
`SettingResource.uniqueId`	NAME
`SettingResource.uniqueId`	UNIQUE_ID
`SettingResource.units`	UNITS
`SettingResource.value`	VALUE

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Tenant

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

Type: REST endpoint · Endpoint: GET v1/connection-management/tenants

Account

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

Type: GraphQL · Endpoint: POST v1/gql

query getAccounts($filter: AccountFilter, $limit: Limit, $orderBy: [AccountOrderBy!]!, $query: String, $token: ID) {
  getAccounts(filter: $filter, limit: $limit, orderBy: $orderBy, query: $query, token: $token) {
    results {
      id
      name
      nativeId
      username
      firstName
      status
      tenantId
      email { raw }
      enabled
      entitySubType
      userGroups
      aliases
      automated
      isAdmin
      isDeleted
      isLicensed
      isRestricted
      lastName
      mfaEnabled
      obsidianStatus
      rawRefs
      lastSeenLocation {
        location {
          city
          country
          postalCode
          subdivision
          geoLocation { latitude longitude }
          geoLocationSource
        }
      }
      temporalProperties {
        created
        deleted
        firstActive
        firstObserved
        lastActive
        lastModified
        lastObserved
        terminated
      }
      addresses { city country postalCode region street }
      alternativeNames
      alternativeEmails { raw }
      alternativePhones { raw type }
      phone { raw type }
      roles { name }
      user(idOnly: true) { id }
      services { serviceId name }
    }
    cursor
    hasMoreResults
  }
}

User

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

Type: GraphQL · Endpoint: POST v1/gql

query getUsers($filter: UserFilter, $limit: Limit, $orderBy: [UserOrderBy!]!, $query: String, $token: ID) {
  getUsers(filter: $filter, limit: $limit, orderBy: $orderBy, query: $query, token: $token) {
    results {
      email { raw }
      phone { raw }
      department
      division
      isDeleted
      isPrivileged
      isServiceAccount
      isTerminated
      id
      name
      firstName
      lastName
      jobTitle
      tenantId
      enabled
      entitySubType
      nativeId
      rawRefs
      timezone
      userGroups
      accounts { id name nativeId }
      services { name }
      temporalProperties {
        lastModified
        created
        firstActive
        firstObserved
        lastActive
        lastObserved
        terminated
      }
    }
    cursor
    hasMoreResults
  }
}

Entity

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

Type: GraphQL · Endpoint: POST v1/gql
Default filters: baseType NIN [ACCOUNT] (excludes account entities)

query getEntitiesTable($filter: EntityFilter, $limit: Limit, $bulk: Boolean, $query: String, $token: ID) {
  getEntities(filter: $filter, limit: $limit, bulk: $bulk, query: $query, token: $token) {
    results {
      id
      name
      nativeId
      isDeleted
      rawRefs
      entitySubType
      services { serviceId name }
      temporalProperties {
        lastModified
        created
        firstActive
        firstObserved
        lastActive
        lastObserved
        terminated
      }
      tenantId
      userGroups
    }
    cursor
    hasMoreResults
  }
}

Compliance Standard

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

Type: REST endpoint · Endpoint: GET posture/v3_0/compliance/list

Compliance Control

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

Type: REST endpoint · Endpoint: GET posture/v3_0/compliance/info/{standardId}

Rule

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

Type: REST endpoint · Endpoint: POST posture/v3_0/rules/list

Rule Violation

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

Type: REST endpoint · Endpoint: POST posture/v3_0/rules/info/{ruleId}/preview
Default filters: Scoped per rule by the rule's tenant_id in the request payload

Setting

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

Type: REST endpoint · Endpoint: POST posture/v3_0/settings/list

Setting Violation

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

Type: REST endpoint · Endpoint: POST posture/v3_0/settings/list

Changelog

The Obsidian Security connector has undergone the following changes:

Version	Description	Migration Steps
3.0.0	New Features - Initial release of the Obsidian Security connector with support for 10 data object types: - Account — SaaS user accounts with identity details, roles, services, MFA status, and temporal activity data - Compliance Standard — Compliance frameworks and standards tracked by Obsidian Security - Compliance Control — Individual compliance controls within standards, with pass/fail status - Entity — Non-account entities (applications, groups, resources) observed across SaaS services - Rule — Posture rules that define security policies, with severity, risk acceptance, and exception counts - Rule Violation — Individual violations of posture rules, with violation targets and remediation tracking - Setting — Security setting definitions for SaaS configuration posture - Setting Violation — Individual violations of security settings, with affected services and tenants - Tenant — SaaS tenant configurations with connection status and service details - User — Consolidated user identities across SaaS services, with account associations and activity data - Authentication — Bearer Token authentication via API key - Data Retrieval — GraphQL-based retrieval for Account, Entity, and User; REST API-based retrieval for all other object types - Sync Mode — Full sync only; all object types perform a complete data fetch on every sync (no delta/incremental sync) - Configuration — Configurable page size, retry logic, and parallelism level for data synchronization - Parallel Processing — Concurrent violation fetching across multiple rules for improved sync performance Known Issues - Entity pagination limitation — The Obsidian Security API may return a null cursor before all records/pages have been retrieved, causing pagination to stop early. As a result, the connector may only fetch a partial set of Entity records. This issue has been reported and the obsidian team is looking into it.	N/A
3.0.1	Bug Fixes - Rule Violation target resolution — Fixed target resolution for OAuth token violations to include tenant context, ensuring violations are correctly associated with their tenant - Rule Violation multi-value fields — Fixed handling of API fields (`ID`, `User email`, `App name`) that may return either a single value or an array, preventing deserialization errors during sync Improvements - Documentation — Enhanced README with endpoint details, usage examples, pagination limitation notes for Entity, and updated configuration table with required/optional indicators Known Issues - Entity pagination limitation — The Obsidian Security API may return a null cursor before all records/pages have been retrieved, causing pagination to stop early. As a result, the connector may only fetch a partial set of Entity records. This issue has been reported and the obsidian team is looking into it.	N/A

Data retrieved from Obsidian Security​

Model relationships​

Connection settings​

Authentication​

Connection Verification Endpoint​

Request Headers​

Request Body​

Sample Response​

Response Fields​

Usage​

Sync Behavior​

Attribute mappings​

Operations & API​

Changelog​

Data retrieved from Obsidian Security

Model relationships

Connection settings

Authentication

Connection Verification Endpoint

Request Headers

Request Body

Sample Response

Response Fields

Usage

Sync Behavior

Attribute mappings

Operations & API

Changelog