Onapsis

SAP Security

Overview

The Onapsis Connector integrates with the Onapsis SAP Security platform to synchronize SAP system assets, vulnerability occurrences, vulnerability definitions, and SAP note implementation statuses. It connects to the Onapsis GraphQL API to fetch security data related to SAP systems, enabling continuous visibility into SAP security posture within Brinqa.

---

Data retrieved from Onapsis

Connector Object	Required	Maps to Data Model
Asset	Yes	Host
Vulnerability	Yes	Vulnerability
Vulnerability Definition	Yes	Vulnerability Definition
Note	Yes	(none)

Model relationships

note

For detailed steps on how to view the data retrieved from Onapsis in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Onapsis from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Server URL	Yes	https://<server_name>	Onapsis platform URL
API Key	Yes	—	Onapsis platform user account API key
Page Size	No	100	Maximum number of records to get per API request
Max Retries	No	5	Maximum number of retry attempts for failed API requests
Parallel Requests	No	min(2, availableProcessors)	Maximum number of parallel API requests
SSL / TLS	No	false	Skip certificate verification

Authentication

The connector uses API key-based authentication to obtain a Bearer token from the Onapsis API.

Endpoint

Method	URL
POST	https://<server_name>/api/v1/token

Request Headers

Header	Value
Content-Type	application/json
Authorization	Basic <api_key>

Request Body

No request body is required. Authentication credentials are passed via the Authorization header.

Sample Response

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
  "token_type": "Bearer",
  "expires_in": 86399,
  "refresh_token": "86875c95-6bbb-48f1-bb64-f8d822c0638f"
}

Response Fields

Field	Type	Description
access_token	String	Bearer token for API requests
token_type	String	Token type (Bearer)
expires_in	Long	Token expiration time in seconds
refresh_token	String	Token for refreshing access

Usage

Once authenticated, all subsequent API requests include the bearer token:

Authorization: Bearer <access_token>

---

Sync Behavior

Each sync is a full sync. Every run enumerates all records; the connector accepts a sync token but does not apply it as an incremental filter.

---

How to obtain Onapsis credentials

Generate an Onapsis API key

For the Onapsis connector to use the Onapsis GraphQL API, you must provide an API key. Since Onapsis does not allow retrieval of an active key, you must generate a new one. To do so, follow these steps:

1. Log in to your organization's Onapsis portal.

2. Click Settings in the bottom-left corner of the page, and then click API Keys.

3. Give your new API key a name and click Generate Key.

   A new API key displays. You cannot view this API key again. Copy the API key and save it in a secure location.

4. Click Close and then Yes.

Note: Consult Onapsis documentation for accuracy. If you do not have the permissions to create an API key, contact your Onapsis administrator.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Asset

Source Field Name	SDM Attribute
asset_role_type	ASSET_ROLE_TYPE
business_value	BUSINESS_VALUE
components[].ip	HOSTNAMES
components[].ip	INSTANCES
description	DESCRIPTION
detection_status	DETECTION_STATUS
discovered_on	FIRST_SEEN
id	UID
is_being_deleted	IS_BEING_DELETED
last_alarm_triggered_on	LAST_ALARM_TRIGGERED_ON
last_scanned	LAST_ASSESSED
last_updated	SOURCE_LAST_MODIFIED
name	NAME
owner_id	OWNER_ID
sid	SID
snc.protection_mode	SNC_PROTECTION_MODE
snc.status	SNC_STATUS
stack	STACK
stack	CATEGORIES
status	SOURCE_STATUS
status	STATUS
status_updated_on	STATUS_UPDATED_ON
sync timestamp	LAST_CAPTURED
tags[].name	TAGS
type	ASSET_TYPE

Vulnerability

Source Field Name	SDM Attribute
acceptance.accepted_by.name	ACCEPTED_BY
acceptance.due_date.date	ACCEPTANCE_DUE_DATE
acceptance.from	ACCEPTANCE_START_FROM
asset.components[].ip	HOSTNAMES
asset.id	TARGETS
assignee.name	ASSIGNEE
days_unresolved	DAYS_UNRESOLVED
due_date.date	DUE_DATE
first_occurrence_date	FIRST_FOUND
id	UID
issue.name	NAME
last_detected_date	LAST_FOUND
last_module_output	LAST_MODULE_OUTPUT
last_module_output	RESULTS
last_module_output_id	LAST_MODULE_OUTPUT_ID
last_scan_date	LAST_SCAN_DATE
last_transition.date	LAST_TRANSITION_DATE
last_transition.expired_acceptance	LAST_TRANSITION_EXPIRED_ACCEPTANCE
okb_id / issue.okb_id	TYPE
parent_path	PARENT_PATH
reason	REASON
scope	SCOPE
scope_type	SCOPE_TYPE
state	PROVIDER_STATUS
state	SOURCE_STATUS
sync timestamp	LAST_CAPTURED
transitioned_by	TRANSITIONED_BY
unresolved_since	UNRESOLVED_SINCE

Vulnerability Definition

Source Field Name	SDM Attribute
business_impact	BUSINESS_IMPACT
category	CATEGORIES
cve	CVE_IDS
cve	CVE_RECORDS
description	DESCRIPTION
name	NAME
okb_id	UID
onapsis_research_lab	ONAPSIS_RESEARCH_LAB
public_exploit	PUBLIC_EXPLOIT
references	REFERENCES
references[].CVE_AND_CVSS	CVSS_V3_VECTOR
references[].CVE_AND_CVSS	CVSS_V3_BASE_SCORE
references[].CVE_AND_CVSS	CVSS_V3_TEMPORAL_SCORE
references[].CVE_AND_CVSS	CVSS_V3_AV
references[].CVE_AND_CVSS	CVSS_V3_AC
references[].CVE_AND_CVSS	CVSS_V3_PR
references[].CVE_AND_CVSS	CVSS_V3_UI
references[].CVE_AND_CVSS	CVSS_V3_CI
references[].CVE_AND_CVSS	CVSS_V3_II
references[].CVE_AND_CVSS	CVSS_V3_AI
references[].CVE_AND_CVSS	CVSS_V3_SEVERITY
references[].CVE_AND_CVSS	CVSS_V3_E
references[].CVE_AND_CVSS	CVSS_V3_RL
references[].CVE_AND_CVSS	CVSS_V3_RC
risk	RISK
risk	SOURCE_SEVERITY
risk	SEVERITY
risk	SEVERITY_SCORE
sap_notes_links	SAP_NOTE_LINKS
solution	RECOMMENDATION
sync timestamp	LAST_CAPTURED

Note

Source Field Name	SDM Attribute
asset.id	TARGETS
asset.id	ASSET_ID
asset.sid	ASSET_SID
implementation_status	SOURCE_STATUS
last_updated	SOURCE_LAST_MODIFIED
note.cvss_score	CVSS_SCORE
note.id	UID
note.latest_release_date	LATEST_RELEASE_DATE
note.name	NAME
note.note_url	NOTE_URL
note.priority	PRIORITY
related_vulnerability.id	RELATED_VULNERABILITY
sync timestamp	LAST_CAPTURED

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Asset

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Asset on every run and applies no incremental date filter.

API

• Type: GraphQL query · Endpoint: POST /graphql

query getAssets($first: Int, $after: Int) {
  nodes: assets(first: $first, after: $after, order_by: {by: last_scanned, order: asc}) {
    id
    name
    sid
    type
    stack
    asset_role_type
    snc { status protection_mode }
    components { id name friendly_name ip instance instance_number }
    description
    business_value
    status
    is_being_deleted
    last_updated
    discovered_on
    owner_id
    detection_status
    status_updated_on
    last_alarm_triggered_on
    last_scanned
    tags { name }
  }
}

Vulnerability

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Vulnerability on every run and applies no incremental date filter.

API

• Type: GraphQL query · Endpoint: POST /graphql

query getOccurrences($first: Int, $after: Int) {
  nodes: vulnerabilities(first: $first, after: $after, order_by: {by: last_detected_date, order: asc}) {
    id
    okb_id
    last_detected_date
    first_occurrence_date
    last_scan_date
    assignee { id name }
    scope_type
    parent_path
    scope
    days_unresolved
    unresolved_since
    reason
    acceptance {
      from
      due_date { date type }
      reason
      accepted_by { name }
    }
    due_date { date type }
    state
    last_transition { date expired_acceptance }
    last_module_output_id
    transitioned_by
    last_module_output { headers rows table_title }
    issue { okb_id name }
    asset {
      id
      name
      components { id ip }
    }
  }
}

Vulnerability Definition

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Vulnerability Definition on every run and applies no incremental date filter.

API

• Type: GraphQL query · Endpoint: POST /graphql

query getIssues($first: Int, $after: Int) {
  nodes: issues(first: $first, after: $after, order_by: {by: okb_id_numeric, order: asc}) {
    okb_id
    name
    risk
    description
    solution
    business_impact
    cve
    cvss
    sap_notes_links
    category
    source { onapsis_research_lab, public_exploit }
    references { type value }
  }
}

Note

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Note on every run and applies no incremental date filter.

API

• Type: GraphQL query · Endpoint: POST /graphql

query getSapNoteStatus($first: Int, $after: Int) {
  nodes: sap_notes_status(first: $first, after: $after) {
    note {
      id
      name
      latest_release_date
      note_url
      priority
      cvss_score
    }
    asset { id sid }
    implementation_status
    last_updated
    related_vulnerability { id okb_id }
  }
}

Changelog

Changelog

The Onapsis connector has undergone the following changes:

Version	Description	Migration Steps
3.0.10	Improvements - The Asset model's "Instances" attribute now participates in cross-connector consolidation with the correct priority (registered via the shared attribute helper), so connector-sourced values are consolidated consistently rather than treated as independent. Bug Fixes - Corrected the Vulnerability "Acceptance start date" attribute to be stored as a proper timestamp. The API returns the acceptance "from" value as a date string, which was being written into a timestamp attribute and aborting the Vulnerability sync; the string is now parsed to a timestamp (and omitted when absent or unparseable).	• Vulnerability: re-sync the Onapsis connector to populate "Acceptance start date" with the corrected timestamp value.
3.0.9	Improvements - Improved formatting and JSON serialization of the vulnerability module output to enhance readability - Streamlined the handling of CVSS metrics - Replaced the TYPE attribute with a more descriptive ASSET_TYPE attribute on Asset records - Improved data quality by strengthening validation of empty and blank values across all models - Standardized retry configuration to align with platform defaults - Fixed a typo in configuration validation error messagesz	• Asset: The TYPE attribute has been replaced with ASSET_TYPE — Action: re-sync Asset data
3.0.8	New Features - Vulnerability Module Output: Added support for collecting detailed module output data from Onapsis. This information is now available in the LAST_MODULE_OUTPUT and RESULTS attributes on vulnerability records as a structured JSON string, providing deeper context for identified issues.	N/A
3.0.7	New Features - SAP Security Notes: Added a new Note model that synchronizes SAP Security Notes from Onapsis, including each note's priority, CVSS score, latest release date, reference URL, and the affected asset. This gives you visibility into the SAP Notes relevant to your monitored systems alongside their assets and vulnerabilities.	N/A
3.0.6	Improvements - Increased the resilience of vulnerability definition processing: when an individual CVSS vector cannot be parsed, the issue is now skipped and logged instead of interrupting the overall sync. Bug Fixes - Restored the Vulnerability "Targets" association to use the asset identifier, correcting the link between vulnerabilities and their assets after a prior change had keyed it on the asset SID.	• Vulnerability: the "Targets" association now uses the asset identifier again and the "Business impact" attribute is stored as text rather than a number — Action: re-sync the Onapsis connector so vulnerabilities re-link to their assets and "Business impact" values are rewritten.
3.0.5	New Features - Additional Asset Context: Added "Asset role type", "SNC status", and "SNC protection mode" attributes to Asset records. - SAP Note Links: Added a "Sap note links" attribute to Vulnerability Definition records, capturing associated SAP Note references. Improvements - Asset and Vulnerability records now populate "Hostnames" from the underlying system components (their IP addresses), improving host correlation across connectors. - Refined CVSS vector parsing for vulnerability definitions to correctly extract the vector from the combined CVE and CVSS reference value.	• Asset: the host identifier used for correlation moved from "Hostname" to "Hostnames" — Action: purge and re-sync the Onapsis Asset data so assets re-key on the new identifier. • Vulnerability: the "Targets" association now keys on the asset SID and "Hostnames" is sourced from component IP addresses — Action: re-sync the Onapsis connector so vulnerabilities re-associate with their assets.
3.0.4	New Features - Asset Instances: Added an "Instances" attribute to Asset records, listing the IP addresses of the system's components. - Threat Intelligence Flags: Added "Onapsis research lab" and "Public exploit" indicators to Vulnerability Definition records. Improvements - Vulnerability Definition severity and severity score are now derived from the issue risk, improving severity accuracy.	N/A
3.0.3	Improvements - Asset "Type" and "Stack" are now surfaced as dedicated attributes instead of being folded into the asset categories, and the generic "Host" category is no longer added automatically — giving cleaner, more accurate asset categorization.	N/A
3.0.2	Improvements - Removed the redundant "Status category" attribute from Asset records. Bug Fixes - Corrected the "Status category" value on Vulnerability records so it is derived properly from the normalized finding status.	N/A
3.0.1	New Features - Source Values Preserved: Added "Source status" attributes to Asset and Vulnerability records and "Source severity" to Vulnerability Definition records, so the original values reported by Onapsis are retained alongside the normalized values. Improvements - Asset and Vulnerability records now populate "Hostnames" in addition to the existing host attributes.	N/A
3.0.0	Overview The Onapsis connector integrates with the Onapsis platform to synchronize SAP system assets, vulnerability findings, and vulnerability definitions for SAP security posture management. Category: SAP Security Models	N/A