
Pentera
Penetration Testing- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Pentera connector integrates with Pentera, an automated security validation platform that continuously attacks an organization's own environment — on-premises hosts, cloud workloads, identities, and external attack surface — to prove which exposures are genuinely exploitable. Pentera maintains a unified asset inventory built from its own reconnaissance plus connected security integrations, and records every validated exposure as a finding scored by real attack impact rather than by CVSS alone.
The connector synchronizes the Pentera asset inventory — hosts, domains, cloud instances, storage buckets, and cloud identities — together with validated findings and their derived definitions. It authenticates by exchanging a Pentera API key for a short-lived bearer token, pages through the Pentera REST API, and normalizes each record into the Brinqa Unified Data Model.
Data retrieved from Pentera
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Host | Yes | Host |
| Domain | Yes | Site |
| Cloud Instance | Yes | Host |
| Storage Bucket | Yes | Cloud Resource |
| Identity | Yes | Cloud Resource |
| Vulnerability | Yes | Vulnerability |
| Vulnerability Definition | Yes | Vulnerability Definition |
Model relationships
For detailed steps on how to view the data retrieved from Pentera in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Pentera from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| API URL | Yes | — | Pentera REST API URL |
| API key | Yes | — | Pentera API key |
| Page size | No | 1000 | Maximum number of records to get per API request (max 1000) |
| Max retries | No | 5 | Maximum number of retry attempts before giving up a request |
Authentication
The connector authenticates with an API key exchanged for a bearer token. The API key is generated in the Pentera console and supplied in the connector configuration. On the first request the connector posts the key to the token endpoint, reads the returned JWT, and caches it until it expires — the expiry is taken from the token's own exp claim, refreshing automatically as needed.
Endpoint
| Method | URL |
|---|---|
POST | https://api.<tenant>.pentera.io/api-keys/token |
Request Headers
| Header | Value |
|---|---|
Content-Type | application/json |
Accept | application/json |
Request Body
{
"api_key": "2cf72852-5a5d-4d89-9715-58f7fd6bf2e2"
}
Sample Response
{
"token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImoyMTdpa3JtYTA3dzJfa285eEN0UyJ9.eyJpc3MiOiJodHRwczovL2F1dGguZGV2b2NlYW4uc2VjdXJpdHkvIiwiaWF0IjoxNzg3ODEwNTE2LCJleHAiOjE3ODc4OTY5MTZ9.qSmIQR-v8aR9eL_wzhJIYQApONVrholuSOAy9Bng843"
}
Response Fields
| Field | Type | Description |
|---|---|---|
token | String | Signed JWT used as the bearer token; the connector reads its exp claim to decide when to re-authenticate |
Usage
Once authenticated, all subsequent API requests include the bearer token:
Authorization: Bearer <token>
Accept: application/json
Content-Type: application/json
Sync Behavior
Every model supports incremental (delta) sync. On a delta run the connector converts the stored sync token into a Pentera time-range filter and sends it with the request, so only records seen since the previous run are fetched: the asset models filter on last_seen_at and the finding models on finding_last_seen_at. A run with no sync token (the first sync, or a full re-sync) sends no time filter and re-fetches the complete record set.
How to obtain Pentera credentials
Obtain the required credentials (url, apiKey) from your Pentera administrator or the Pentera admin console, then enter them in the connection settings above.
The connector reads the token lifetime from the JWT's exp claim and refreshes 30 seconds before expiry. If the claim cannot be parsed (a malformed or non-JWT token), it assumes a one-hour lifetime and logs a warning. A 401 from any endpoint discards the cached token so the next request re-authenticates.
A Pentera time filter takes a single comma-separated from,to pair, formatted yyyy-MM-dd'T'HH:mm:ss in UTC with no offset — matching how Pentera renders its own timestamps. The bounds must be in ascending order; Pentera answers a reversed range with a 500.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Host
| Source Field Name | SDM Attribute |
|---|---|
*(constant)* | STATUS |
*(derived)* | CATEGORIES |
*(sync time)* | LAST_CAPTURED |
AssetResource.account | ACCOUNT |
AssetResource.account_name | CLOUD_ACCOUNT_NAME |
AssetResource.application_ids | APPLICATION_IDS |
AssetResource.asset_type | ASSET_TYPE |
AssetResource.cloud_account | DOMAIN |
AssetResource.cloud_account | CLOUD_ACCOUNT_ID |
AssetResource.critical_findings_count | CRITICAL_FINDINGS_COUNT |
AssetResource.display_name | NAME |
AssetResource.first_seen | FIRST_SEEN |
AssetResource.high_findings_count | HIGH_FINDINGS_COUNT |
AssetResource.hostname | HOSTNAMES |
AssetResource.insights | INSIGHTS |
AssetResource.last_seen | LAST_SEEN |
AssetResource.low_findings_count | LOW_FINDINGS_COUNT |
AssetResource.manually_created | MANUALLY_CREATED |
AssetResource.medium_findings_count | MEDIUM_FINDINGS_COUNT |
AssetResource.operating_system | OPERATING_SYSTEM |
AssetResource.operating_system.os_category | OS_CATEGORY |
AssetResource.operating_system.os_name | OS_NAME |
AssetResource.operating_system.os_version | OS_VERSION |
AssetResource.organization_uid | ORGANIZATION_UID |
AssetResource.owners | OWNERS |
AssetResource.platform | PLATFORM |
AssetResource.platform | CLOUD_PROVIDER |
AssetResource.platform_service | PLATFORM_SERVICE |
AssetResource.platform_uid | PLATFORM_UID |
AssetResource.private_dns | PRIVATE_DNS_NAMES |
AssetResource.private_ip | PRIVATE_IP_ADDRESSES |
AssetResource.public_dns | PUBLIC_DNS_NAMES |
AssetResource.public_dns / private_dns / hostname | DNS_NAMES |
AssetResource.public_ip | PUBLIC_IP_ADDRESSES |
AssetResource.public_ip / private_ip / hostname | IP_ADDRESSES |
AssetResource.region | REGION |
AssetResource.resource_type | RESOURCE_TYPE |
AssetResource.risk_score | RISK_SCORE |
AssetResource.risk_score_details.alerts_avg_severity.data.critical | RISK_ALERTS_CRITICAL_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.high | RISK_ALERTS_HIGH_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.low | RISK_ALERTS_LOW_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.medium | RISK_ALERTS_MEDIUM_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.total_weight | RISK_ALERTS_SEVERITY_TOTAL_WEIGHT |
AssetResource.risk_score_details.alerts_avg_severity.weight | RISK_ALERTS_SEVERITY_WEIGHT |
AssetResource.risk_score_details.application_criticality.data.application_criticality | APPLICATION_CRITICALITY |
AssetResource.risk_score_details.application_criticality.total_weight | RISK_APPLICATION_CRITICALITY_TOTAL_WEIGHT |
AssetResource.risk_score_details.application_criticality.weight | RISK_APPLICATION_CRITICALITY_WEIGHT |
AssetResource.risk_score_details.application_env.data.application_env | APPLICATION_ENVIRONMENT |
AssetResource.risk_score_details.application_env.total_weight | RISK_APPLICATION_ENV_TOTAL_WEIGHT |
AssetResource.risk_score_details.application_env.weight | RISK_APPLICATION_ENV_WEIGHT |
AssetResource.risk_score_details.insights.data.insights | RISK_INSIGHTS |
AssetResource.risk_score_details.insights.total_weight | RISK_INSIGHTS_TOTAL_WEIGHT |
AssetResource.risk_score_details.insights.weight | RISK_INSIGHTS_WEIGHT |
AssetResource.risk_score_details.last_seen_at.data.last_seen_at | RISK_LAST_SEEN_AT |
AssetResource.risk_score_details.last_seen_at.total_weight | RISK_LAST_SEEN_TOTAL_WEIGHT |
AssetResource.risk_score_details.last_seen_at.weight | RISK_LAST_SEEN_WEIGHT |
AssetResource.risk_score_details.max_alert_score.data.score | RISK_MAX_ALERT_SCORE |
AssetResource.risk_score_details.max_alert_score.data.severity | RISK_MAX_ALERT_SEVERITY |
AssetResource.risk_score_details.max_alert_score.total_weight | RISK_MAX_ALERT_TOTAL_WEIGHT |
AssetResource.risk_score_details.max_alert_score.weight | RISK_MAX_ALERT_WEIGHT |
AssetResource.root_asset | ROOT_ASSET |
AssetResource.security_event_count | SECURITY_EVENT_COUNT |
AssetResource.security_integration_source | SECURITY_INTEGRATION_SOURCES |
AssetResource.uid | UID |
AssetResource.vendor_types | VENDOR_TYPES |
Domain
| Source Field Name | SDM Attribute |
|---|---|
*(constant)* | STATUS |
*(derived)* | CATEGORIES |
*(sync time)* | LAST_CAPTURED |
AssetResource.account | ACCOUNT |
AssetResource.account_name | CLOUD_ACCOUNT_NAME |
AssetResource.application_ids | APPLICATION_IDS |
AssetResource.asset_type | ASSET_TYPE |
AssetResource.cloud_account | ROOT_DOMAIN |
AssetResource.cloud_account | CLOUD_ACCOUNT_ID |
AssetResource.critical_findings_count | CRITICAL_FINDINGS_COUNT |
AssetResource.display_name | NAME |
AssetResource.first_seen | FIRST_SEEN |
AssetResource.high_findings_count | HIGH_FINDINGS_COUNT |
AssetResource.insights | INSIGHTS |
AssetResource.last_seen | LAST_SEEN |
AssetResource.low_findings_count | LOW_FINDINGS_COUNT |
AssetResource.manually_created | MANUALLY_CREATED |
AssetResource.medium_findings_count | MEDIUM_FINDINGS_COUNT |
AssetResource.organization_uid | ORGANIZATION_UID |
AssetResource.owners | OWNERS |
AssetResource.platform | PLATFORM |
AssetResource.platform | CLOUD_PROVIDER |
AssetResource.platform_service | PLATFORM_SERVICE |
AssetResource.platform_uid | PLATFORM_UID |
AssetResource.private_dns | PRIVATE_DNS_NAMES |
AssetResource.private_ip | PRIVATE_IP_ADDRESSES |
AssetResource.public_dns | PUBLIC_DNS_NAMES |
AssetResource.public_dns / private_dns / hostname | DNS_NAMES |
AssetResource.public_ip | PUBLIC_IP_ADDRESSES |
AssetResource.public_ip / private_ip / hostname | IP_ADDRESSES |
AssetResource.region | REGION |
AssetResource.resource_type | RESOURCE_TYPE |
AssetResource.risk_score | RISK_SCORE |
AssetResource.risk_score_details.alerts_avg_severity.data.critical | RISK_ALERTS_CRITICAL_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.high | RISK_ALERTS_HIGH_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.low | RISK_ALERTS_LOW_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.medium | RISK_ALERTS_MEDIUM_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.total_weight | RISK_ALERTS_SEVERITY_TOTAL_WEIGHT |
AssetResource.risk_score_details.alerts_avg_severity.weight | RISK_ALERTS_SEVERITY_WEIGHT |
AssetResource.risk_score_details.application_criticality.data.application_criticality | APPLICATION_CRITICALITY |
AssetResource.risk_score_details.application_criticality.total_weight | RISK_APPLICATION_CRITICALITY_TOTAL_WEIGHT |
AssetResource.risk_score_details.application_criticality.weight | RISK_APPLICATION_CRITICALITY_WEIGHT |
AssetResource.risk_score_details.application_env.data.application_env | APPLICATION_ENVIRONMENT |
AssetResource.risk_score_details.application_env.total_weight | RISK_APPLICATION_ENV_TOTAL_WEIGHT |
AssetResource.risk_score_details.application_env.weight | RISK_APPLICATION_ENV_WEIGHT |
AssetResource.risk_score_details.insights.data.insights | RISK_INSIGHTS |
AssetResource.risk_score_details.insights.total_weight | RISK_INSIGHTS_TOTAL_WEIGHT |
AssetResource.risk_score_details.insights.weight | RISK_INSIGHTS_WEIGHT |
AssetResource.risk_score_details.last_seen_at.data.last_seen_at | RISK_LAST_SEEN_AT |
AssetResource.risk_score_details.last_seen_at.total_weight | RISK_LAST_SEEN_TOTAL_WEIGHT |
AssetResource.risk_score_details.last_seen_at.weight | RISK_LAST_SEEN_WEIGHT |
AssetResource.risk_score_details.max_alert_score.data.score | RISK_MAX_ALERT_SCORE |
AssetResource.risk_score_details.max_alert_score.data.severity | RISK_MAX_ALERT_SEVERITY |
AssetResource.risk_score_details.max_alert_score.total_weight | RISK_MAX_ALERT_TOTAL_WEIGHT |
AssetResource.risk_score_details.max_alert_score.weight | RISK_MAX_ALERT_WEIGHT |
AssetResource.root_asset | ROOT_ASSET |
AssetResource.security_event_count | SECURITY_EVENT_COUNT |
AssetResource.security_integration_source | SECURITY_INTEGRATION_SOURCES |
AssetResource.uid | UID |
AssetResource.vendor_types | VENDOR_TYPES |
Cloud Instance
| Source Field Name | SDM Attribute |
|---|---|
*(constant)* | STATUS |
*(derived)* | CATEGORIES |
*(sync time)* | LAST_CAPTURED |
AssetResource.account | ACCOUNT |
AssetResource.account_name | CLOUD_ACCOUNT_NAME |
AssetResource.application_ids | APPLICATION_IDS |
AssetResource.asset_type | ASSET_TYPE |
AssetResource.cloud_account | CLOUD_ACCOUNT_ID |
AssetResource.critical_findings_count | CRITICAL_FINDINGS_COUNT |
AssetResource.display_name | NAME |
AssetResource.first_seen | FIRST_SEEN |
AssetResource.high_findings_count | HIGH_FINDINGS_COUNT |
AssetResource.hostname | HOSTNAMES |
AssetResource.insights | INSIGHTS |
AssetResource.last_seen | LAST_SEEN |
AssetResource.low_findings_count | LOW_FINDINGS_COUNT |
AssetResource.manually_created | MANUALLY_CREATED |
AssetResource.medium_findings_count | MEDIUM_FINDINGS_COUNT |
AssetResource.operating_system | OPERATING_SYSTEM |
AssetResource.operating_system.os_category | OS_CATEGORY |
AssetResource.operating_system.os_name | OS_NAME |
AssetResource.operating_system.os_version | OS_VERSION |
AssetResource.organization_uid | ORGANIZATION_UID |
AssetResource.owners | OWNERS |
AssetResource.platform | PLATFORM |
AssetResource.platform | CLOUD_PROVIDER |
AssetResource.platform_service | PLATFORM_SERVICE |
AssetResource.platform_uid | INSTANCE_ID |
AssetResource.platform_uid | PLATFORM_UID |
AssetResource.private_dns | PRIVATE_DNS_NAMES |
AssetResource.private_ip | PRIVATE_IP_ADDRESSES |
AssetResource.public_dns | PUBLIC_DNS_NAMES |
AssetResource.public_dns / private_dns / hostname | DNS_NAMES |
AssetResource.public_ip | PUBLIC_IP_ADDRESSES |
AssetResource.public_ip / private_ip / hostname | IP_ADDRESSES |
AssetResource.region | REGION |
AssetResource.resource_type | RESOURCE_TYPE |
AssetResource.risk_score | RISK_SCORE |
AssetResource.risk_score_details.alerts_avg_severity.data.critical | RISK_ALERTS_CRITICAL_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.high | RISK_ALERTS_HIGH_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.low | RISK_ALERTS_LOW_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.medium | RISK_ALERTS_MEDIUM_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.total_weight | RISK_ALERTS_SEVERITY_TOTAL_WEIGHT |
AssetResource.risk_score_details.alerts_avg_severity.weight | RISK_ALERTS_SEVERITY_WEIGHT |
AssetResource.risk_score_details.application_criticality.data.application_criticality | APPLICATION_CRITICALITY |
AssetResource.risk_score_details.application_criticality.total_weight | RISK_APPLICATION_CRITICALITY_TOTAL_WEIGHT |
AssetResource.risk_score_details.application_criticality.weight | RISK_APPLICATION_CRITICALITY_WEIGHT |
AssetResource.risk_score_details.application_env.data.application_env | APPLICATION_ENVIRONMENT |
AssetResource.risk_score_details.application_env.total_weight | RISK_APPLICATION_ENV_TOTAL_WEIGHT |
AssetResource.risk_score_details.application_env.weight | RISK_APPLICATION_ENV_WEIGHT |
AssetResource.risk_score_details.insights.data.insights | RISK_INSIGHTS |
AssetResource.risk_score_details.insights.total_weight | RISK_INSIGHTS_TOTAL_WEIGHT |
AssetResource.risk_score_details.insights.weight | RISK_INSIGHTS_WEIGHT |
AssetResource.risk_score_details.last_seen_at.data.last_seen_at | RISK_LAST_SEEN_AT |
AssetResource.risk_score_details.last_seen_at.total_weight | RISK_LAST_SEEN_TOTAL_WEIGHT |
AssetResource.risk_score_details.last_seen_at.weight | RISK_LAST_SEEN_WEIGHT |
AssetResource.risk_score_details.max_alert_score.data.score | RISK_MAX_ALERT_SCORE |
AssetResource.risk_score_details.max_alert_score.data.severity | RISK_MAX_ALERT_SEVERITY |
AssetResource.risk_score_details.max_alert_score.total_weight | RISK_MAX_ALERT_TOTAL_WEIGHT |
AssetResource.risk_score_details.max_alert_score.weight | RISK_MAX_ALERT_WEIGHT |
AssetResource.root_asset | ROOT_ASSET |
AssetResource.security_event_count | SECURITY_EVENT_COUNT |
AssetResource.security_integration_source | SECURITY_INTEGRATION_SOURCES |
AssetResource.uid | UID |
AssetResource.vendor_types | VENDOR_TYPES |
Storage Bucket
| Source Field Name | SDM Attribute |
|---|---|
*(constant)* | STATUS |
*(derived)* | CATEGORIES |
*(sync time)* | LAST_CAPTURED |
AssetResource.account | ACCOUNT |
AssetResource.account_name | CLOUD_ACCOUNT_NAME |
AssetResource.application_ids | APPLICATION_IDS |
AssetResource.asset_type | ASSET_TYPE |
AssetResource.cloud_account | CLOUD_ACCOUNT_ID |
AssetResource.critical_findings_count | CRITICAL_FINDINGS_COUNT |
AssetResource.display_name | NAME |
AssetResource.first_seen | FIRST_SEEN |
AssetResource.high_findings_count | HIGH_FINDINGS_COUNT |
AssetResource.insights | INSIGHTS |
AssetResource.last_seen | LAST_SEEN |
AssetResource.low_findings_count | LOW_FINDINGS_COUNT |
AssetResource.manually_created | MANUALLY_CREATED |
AssetResource.medium_findings_count | MEDIUM_FINDINGS_COUNT |
AssetResource.organization_uid | ORGANIZATION_UID |
AssetResource.owners | OWNERS |
AssetResource.platform | PLATFORM |
AssetResource.platform | CLOUD_PROVIDER |
AssetResource.platform_service | PLATFORM_SERVICE |
AssetResource.platform_uid | PLATFORM_UID |
AssetResource.region | REGION |
AssetResource.resource_type | RESOURCE_TYPE |
AssetResource.risk_score | RISK_SCORE |
AssetResource.risk_score_details.alerts_avg_severity.data.critical | RISK_ALERTS_CRITICAL_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.high | RISK_ALERTS_HIGH_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.low | RISK_ALERTS_LOW_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.medium | RISK_ALERTS_MEDIUM_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.total_weight | RISK_ALERTS_SEVERITY_TOTAL_WEIGHT |
AssetResource.risk_score_details.alerts_avg_severity.weight | RISK_ALERTS_SEVERITY_WEIGHT |
AssetResource.risk_score_details.application_criticality.data.application_criticality | APPLICATION_CRITICALITY |
AssetResource.risk_score_details.application_criticality.total_weight | RISK_APPLICATION_CRITICALITY_TOTAL_WEIGHT |
AssetResource.risk_score_details.application_criticality.weight | RISK_APPLICATION_CRITICALITY_WEIGHT |
AssetResource.risk_score_details.application_env.data.application_env | APPLICATION_ENVIRONMENT |
AssetResource.risk_score_details.application_env.total_weight | RISK_APPLICATION_ENV_TOTAL_WEIGHT |
AssetResource.risk_score_details.application_env.weight | RISK_APPLICATION_ENV_WEIGHT |
AssetResource.risk_score_details.insights.data.insights | RISK_INSIGHTS |
AssetResource.risk_score_details.insights.total_weight | RISK_INSIGHTS_TOTAL_WEIGHT |
AssetResource.risk_score_details.insights.weight | RISK_INSIGHTS_WEIGHT |
AssetResource.risk_score_details.last_seen_at.data.last_seen_at | RISK_LAST_SEEN_AT |
AssetResource.risk_score_details.last_seen_at.total_weight | RISK_LAST_SEEN_TOTAL_WEIGHT |
AssetResource.risk_score_details.last_seen_at.weight | RISK_LAST_SEEN_WEIGHT |
AssetResource.risk_score_details.max_alert_score.data.score | RISK_MAX_ALERT_SCORE |
AssetResource.risk_score_details.max_alert_score.data.severity | RISK_MAX_ALERT_SEVERITY |
AssetResource.risk_score_details.max_alert_score.total_weight | RISK_MAX_ALERT_TOTAL_WEIGHT |
AssetResource.risk_score_details.max_alert_score.weight | RISK_MAX_ALERT_WEIGHT |
AssetResource.root_asset | ROOT_ASSET |
AssetResource.security_event_count | SECURITY_EVENT_COUNT |
AssetResource.security_integration_source | SECURITY_INTEGRATION_SOURCES |
AssetResource.uid | UID |
AssetResource.vendor_types | VENDOR_TYPES |
Identity
| Source Field Name | SDM Attribute |
|---|---|
*(constant)* | STATUS |
*(derived)* | CATEGORIES |
*(sync time)* | LAST_CAPTURED |
AssetResource.account | ACCOUNT |
AssetResource.account_name | CLOUD_ACCOUNT_NAME |
AssetResource.application_ids | APPLICATION_IDS |
AssetResource.asset_type | ASSET_TYPE |
AssetResource.cloud_account | DOMAIN |
AssetResource.cloud_account | CLOUD_ACCOUNT_ID |
AssetResource.critical_findings_count | CRITICAL_FINDINGS_COUNT |
AssetResource.display_name | NAME |
AssetResource.display_name | USERNAME |
AssetResource.first_seen | FIRST_SEEN |
AssetResource.high_findings_count | HIGH_FINDINGS_COUNT |
AssetResource.insights | INSIGHTS |
AssetResource.last_seen | LAST_SEEN |
AssetResource.low_findings_count | LOW_FINDINGS_COUNT |
AssetResource.manually_created | MANUALLY_CREATED |
AssetResource.medium_findings_count | MEDIUM_FINDINGS_COUNT |
AssetResource.organization_uid | ORGANIZATION_UID |
AssetResource.owners | OWNERS |
AssetResource.platform | PLATFORM |
AssetResource.platform | CLOUD_PROVIDER |
AssetResource.platform_service | PLATFORM_SERVICE |
AssetResource.platform_uid | PLATFORM_UID |
AssetResource.region | REGION |
AssetResource.resource_type | RESOURCE_TYPE |
AssetResource.risk_score | RISK_SCORE |
AssetResource.risk_score_details.alerts_avg_severity.data.critical | RISK_ALERTS_CRITICAL_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.high | RISK_ALERTS_HIGH_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.low | RISK_ALERTS_LOW_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.data.medium | RISK_ALERTS_MEDIUM_COUNT |
AssetResource.risk_score_details.alerts_avg_severity.total_weight | RISK_ALERTS_SEVERITY_TOTAL_WEIGHT |
AssetResource.risk_score_details.alerts_avg_severity.weight | RISK_ALERTS_SEVERITY_WEIGHT |
AssetResource.risk_score_details.application_criticality.data.application_criticality | APPLICATION_CRITICALITY |
AssetResource.risk_score_details.application_criticality.total_weight | RISK_APPLICATION_CRITICALITY_TOTAL_WEIGHT |
AssetResource.risk_score_details.application_criticality.weight | RISK_APPLICATION_CRITICALITY_WEIGHT |
AssetResource.risk_score_details.application_env.data.application_env | APPLICATION_ENVIRONMENT |
AssetResource.risk_score_details.application_env.total_weight | RISK_APPLICATION_ENV_TOTAL_WEIGHT |
AssetResource.risk_score_details.application_env.weight | RISK_APPLICATION_ENV_WEIGHT |
AssetResource.risk_score_details.insights.data.insights | RISK_INSIGHTS |
AssetResource.risk_score_details.insights.total_weight | RISK_INSIGHTS_TOTAL_WEIGHT |
AssetResource.risk_score_details.insights.weight | RISK_INSIGHTS_WEIGHT |
AssetResource.risk_score_details.last_seen_at.data.last_seen_at | RISK_LAST_SEEN_AT |
AssetResource.risk_score_details.last_seen_at.total_weight | RISK_LAST_SEEN_TOTAL_WEIGHT |
AssetResource.risk_score_details.last_seen_at.weight | RISK_LAST_SEEN_WEIGHT |
AssetResource.risk_score_details.max_alert_score.data.score | RISK_MAX_ALERT_SCORE |
AssetResource.risk_score_details.max_alert_score.data.severity | RISK_MAX_ALERT_SEVERITY |
AssetResource.risk_score_details.max_alert_score.total_weight | RISK_MAX_ALERT_TOTAL_WEIGHT |
AssetResource.risk_score_details.max_alert_score.weight | RISK_MAX_ALERT_WEIGHT |
AssetResource.root_asset | ROOT_ASSET |
AssetResource.security_event_count | SECURITY_EVENT_COUNT |
AssetResource.security_integration_source | SECURITY_INTEGRATION_SOURCES |
AssetResource.uid | UID |
AssetResource.vendor_types | VENDOR_TYPES |
Vulnerability
| Source Field Name | SDM Attribute |
|---|---|
*(sync time)* | LAST_CAPTURED |
FindingResource.application_display_names | APPLICATION_DISPLAY_NAMES |
FindingResource.application_ids | APPLICATION_IDS |
FindingResource.asset_cluster_id | ASSET_CLUSTER_ID |
FindingResource.asset_cluster_name | ASSET_CLUSTER_NAME |
FindingResource.asset_drn | TARGETS |
FindingResource.asset_drn | ASSET_DRN |
FindingResource.asset_image_id | ASSET_IMAGE_ID |
FindingResource.asset_image_name | IMAGE |
FindingResource.asset_image_registry | REGISTRY |
FindingResource.asset_scaling_group | ASSET_SCALING_GROUP |
FindingResource.asset_type | ASSET_TYPE |
FindingResource.cloud_account | CLOUD_ACCOUNT_ID |
FindingResource.cloud_account_name | CLOUD_ACCOUNT_NAME |
FindingResource.created_at | SOURCE_CREATED_DATE |
FindingResource.dismiss_request_at | DISMISS_REQUEST_AT |
FindingResource.dismiss_request_by | DISMISS_REQUEST_BY |
FindingResource.dismiss_request_comment | DISMISS_REQUEST_COMMENT |
FindingResource.dismiss_request_reason | DISMISS_REQUEST_REASON |
FindingResource.event_name | NAME |
FindingResource.event_name | TYPE |
FindingResource.first_seen | FIRST_SEEN |
FindingResource.id | UID |
FindingResource.insights.affects_runtime | AFFECTS_RUNTIME |
FindingResource.insights.application_business_criticality | APPLICATION_BUSINESS_CRITICALITY |
FindingResource.insights.application_business_environment | APPLICATION_BUSINESS_ENVIRONMENT |
FindingResource.insights.asset_state | ASSET_STATE |
FindingResource.insights.privileges | PRIVILEGES |
FindingResource.insights.public | PUBLIC_EXPOSURE |
FindingResource.insights.sla | SLA_INSIGHTS |
FindingResource.insights.unused | UNUSED |
FindingResource.is_score_edited | SCORE_EDITED |
FindingResource.last_seen | LAST_SEEN |
FindingResource.manually_created | MANUALLY_CREATED |
FindingResource.operational_status | OPERATIONAL_STATUS |
FindingResource.original_score | ORIGINAL_SCORE |
FindingResource.owners | OWNERS |
FindingResource.platform | PLATFORM |
FindingResource.platform_service | PLATFORM_SERVICE |
FindingResource.region | REGION |
FindingResource.resource_display_name | RESOURCE_DISPLAY_NAME |
FindingResource.resource_type | RESOURCE_TYPE |
FindingResource.root_asset | ROOT_ASSET |
FindingResource.score | SCORE |
FindingResource.score_comment | SCORE_COMMENT |
FindingResource.score_comment_by | SCORE_COMMENT_BY |
FindingResource.score_updated_by_policy_category | SCORE_POLICY_CATEGORY |
FindingResource.score_updated_by_policy_id | SCORE_POLICY_ID |
FindingResource.score_updated_by_policy_name | SCORE_POLICY_NAME |
FindingResource.sla_expired_at | SLA_EXPIRED_AT |
FindingResource.sla_hours | SLA_HOURS |
FindingResource.sla_updated_by_policy_id | SLA_POLICY_ID |
FindingResource.sla_updated_by_policy_name | SLA_POLICY_NAME |
FindingResource.sla_violated | SLA_VIOLATED |
FindingResource.status | PROVIDER_STATUS |
FindingResource.status | SOURCE_STATUS |
FindingResource.status_changed_at | STATUS_CHANGED_AT |
FindingResource.status_dismiss_reason | STATUS_DISMISS_REASON |
Vulnerability Definition
| Source Field Name | SDM Attribute |
|---|---|
*(sync time)* | LAST_CAPTURED |
FindingResource.cve_id + cves | CVE_IDS |
FindingResource.cve_id + cves | CVE_RECORDS |
FindingResource.cvss_score | PROVIDER_CVSS_SCORE |
FindingResource.cvss_vector | (CVSS metrics) |
FindingResource.epss_score | EPSS_SCORE |
FindingResource.epss_score | SOURCE_EPSS_SCORE |
FindingResource.event_name | UID |
FindingResource.event_name | NAME |
FindingResource.finding_type | FINDING_TYPE |
FindingResource.finding_type / source / layer | TAGS |
FindingResource.insights.attack_vector | ATTACK_VECTOR |
FindingResource.insights.cvss_score | PROVIDER_CVSS_SEVERITY |
FindingResource.insights.epss_score | EPSS_SEVERITY |
FindingResource.insights.exploit_maturity | EXPLOIT_MATURITY |
FindingResource.insights.exploit_maturity | CISA_EXPLOITED |
FindingResource.insights.exploit_maturity | OBSERVED_IN_THE_WILD |
FindingResource.is_cvss_score_edited | CVSS_SCORE_EDITED |
FindingResource.is_cvss_vector_edited | CVSS_VECTOR_EDITED |
FindingResource.layer | LAYER |
FindingResource.original_cvss_score | ORIGINAL_CVSS_SCORE |
FindingResource.original_cvss_vector | ORIGINAL_CVSS_VECTOR |
FindingResource.score | SEVERITY |
FindingResource.score | SEVERITY_SCORE |
FindingResource.score | SOURCE_SEVERITY |
FindingResource.score | SOURCE_SEVERITY_SCORE |
FindingResource.security_category | CATEGORIES |
FindingResource.security_category | SECURITY_CATEGORY |
FindingResource.source | VENDOR_SOURCE |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Host
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
pageSize | Integer | Connector pageSize (1000) | Records per API request for this operation; rounded to a size /assets accepts |
maxRetries | Integer | Connector maxRetries (5) | Retries for a failed API request in this operation |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_seen_at.
API
- Type: REST · Endpoint:
GET /assets - Default filters:
vendor_types: pentera,asset_type: host.ip, host.server, host.service, host.domain,include_count: true
Domain
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
pageSize | Integer | Connector pageSize (1000) | Records per API request for this operation; rounded to a size /assets accepts |
maxRetries | Integer | Connector maxRetries (5) | Retries for a failed API request in this operation |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_seen_at.
API
- Type: REST · Endpoint:
GET /assets - Default filters:
vendor_types: pentera,asset_type: host.subdomain, domain.domain,include_count: true
Cloud Instance
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
pageSize | Integer | Connector pageSize (1000) | Records per API request for this operation; rounded to a size /assets accepts |
maxRetries | Integer | Connector maxRetries (5) | Retries for a failed API request in this operation |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_seen_at.
API
- Type: REST · Endpoint:
GET /assets - Default filters:
vendor_types: pentera,asset_type: ec2.instance,include_count: true
Storage Bucket
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
pageSize | Integer | Connector pageSize (1000) | Records per API request for this operation; rounded to a size /assets accepts |
maxRetries | Integer | Connector maxRetries (5) | Retries for a failed API request in this operation |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_seen_at.
API
- Type: REST · Endpoint:
GET /assets - Default filters:
vendor_types: pentera,asset_type: s3.bucket,include_count: true
Storage buckets carry no network or operating-system detail, so this model emits only the common asset attributes.
Identity
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
pageSize | Integer | Connector pageSize (1000) | Records per API request for this operation; rounded to a size /assets accepts |
maxRetries | Integer | Connector maxRetries (5) | Retries for a failed API request in this operation |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on last_seen_at.
API
- Type: REST · Endpoint:
GET /assets - Default filters:
vendor_types: pentera,asset_type: iam.user, iam.role, iam.group,include_count: true
Vulnerability
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
pageSize | Integer | Connector pageSize (1000) | Records per API request for this operation |
maxRetries | Integer | Connector maxRetries (5) | Retries for a failed API request in this operation |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on finding_last_seen_at.
API
- Type: REST · Endpoint:
GET /findings - Default filters:
finding_vendor_type: pentera,include_count: true
- Findings are written to a local key-value store keyed by the sync transaction ID as they are fetched. Vulnerability and Vulnerability Definition both read from that store, so the
findingsendpoint is paged once per transaction and a re-run of the same transaction replays the stored records instead of re-fetching them. TYPEis the MD5 ofevent_name, and is the same value used as the Vulnerability DefinitionUID— that is what joins a finding to its definition.
Vulnerability Definition
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
pageSize | Integer | Connector pageSize (1000) | Records per API request for this operation |
maxRetries | Integer | Connector maxRetries (5) | Retries for a failed API request in this operation |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on finding_last_seen_at.
API
- Type: REST · Endpoint:
GET /findings - Default filters:
finding_vendor_type: pentera,include_count: true
- Definitions are derived from the same
findingsstream as Vulnerability and de-duplicated within a sync by a local key-value store keyed onMD5(event_name); each definition is emitted once no matter how many findings share it. - A finding with a blank
event_nameyields no definition — without an event name there is no stable key to derive. - The singular
cve_idand thecveslist are merged, upper-cased, and filtered againstCVE-\d{4}-\d{4,}; anything malformed is dropped, since the API reports an empty string for a finding with no CVE. - Pentera reports EPSS on a 0–100 scale.
EPSS_SCOREis divided by 100 to give the probability the platform expects;SOURCE_EPSS_SCOREkeeps the raw value. SEVERITYis banded from Pentera's own impact score, not from CVSS: a score at or above the Brinqa critical/high/medium thresholds maps to that band, a positive score below them maps to low, and a null or non-positive score maps to none.
Changelog
The Pentera connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.0 | Overview The Pentera connector integrates with Pentera to synchronize the asset inventory — hosts, domains, cloud instances, storage buckets, and cloud identities — along with validated security findings and their definitions. Category: Penetration Testing Models | N/A |