ProjectDiscovery

Threat Intelligence

Overview

The ProjectDiscovery connector integrates Brinqa with nuclei-templates, ProjectDiscovery's community library of detection templates for the Nuclei scanner. Each template describes how to detect a vulnerability, misconfiguration, exposed panel or technology at scale, and many are mapped to a CVE.

The connector synchronizes every detection template of the latest repository release (about 13,500 templates across the http, cloud, code, dast, dns, file, headless, javascript, network and ssl protocols) as Threat Intelligence records. Templates that carry a CVE ID correlate to the matching CVE record, giving an open signal that the CVE can be scanned for, and therefore exploited, at scale.

The data is read from the repository's GitHub releases:

1. GET {url}/releases/latest returns the latest release tag and its publish date.
2. GET {url}/zipball/{tag} downloads the source archive of that release (about 19 MB). GitHub redirects the download to codeload.github.com.
3. The connector reads the id and info blocks of each template in the archive. The request blocks that follow (http, tcp, code, ...) describe how a scan runs and are not synchronized.

Folders that hold no detection templates (workflows, profiles, helpers, dot folders and repository-root configuration files) are skipped. A template that cannot be read is logged and skipped without failing the sync.

---

Data retrieved from ProjectDiscovery

Connector Object	Required	Maps to Data Model
Nuclei Template	Yes	Threat Intel

Model relationships

note

For detailed steps on how to view the data retrieved from ProjectDiscovery in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select ProjectDiscovery from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	Yes	https://api.github.com/repos/projectdiscovery/nuclei-templates	GitHub API URL of the Nuclei templates repository (projectdiscovery/nuclei-templates). The connector reads its latest release and downloads the templates archive for that release.
GitHub token	No	—	Optional GitHub personal access token. The repository is public, so no token is required. Supply one to raise the GitHub API rate limit from 60 to 5,000 requests per hour when many syncs share an outbound IP address. The token needs no scopes.
Maximum retries	No	3	Maximum number of times a failed request is retried before the sync fails. Default is 3
Request timeout (secs)	No	300	The maximum seconds allotted before a request will time out. Maximum allowed value 1800. Default is 300

Authentication

Method: None required. The repository is public.

An optional GitHub personal access token can be configured to raise the GitHub API rate limit from 60 to 5,000 requests per hour per outbound IP address. Each sync makes two GitHub API requests, so a token is only needed when many syncs share an outbound IP address. The token needs no scopes.

Endpoint

Method	URL
GET	https://api.github.com/repos/projectdiscovery/nuclei-templates/releases/latest

Request Headers

Header	Value
Accept	application/vnd.github+json
X-GitHub-Api-Version	2022-11-28
Authorization	Bearer <token> — only when a token is configured

Sample Response

{
  "id": 250000001,
  "tag_name": "v10.4.9",
  "name": "v10.4.9",
  "html_url": "https://github.com/projectdiscovery/nuclei-templates/releases/tag/v10.4.9",
  "zipball_url": "https://api.github.com/repos/projectdiscovery/nuclei-templates/zipball/v10.4.9",
  "tarball_url": "https://api.github.com/repos/projectdiscovery/nuclei-templates/tarball/v10.4.9",
  "draft": false,
  "prerelease": false,
  "created_at": "2026-09-16T14:40:12Z",
  "published_at": "2026-09-16T14:58:45Z"
}

Response Fields

Field	Type	Description
tag_name	String	Release tag; the archive of this tag is downloaded
html_url	String	Release page; used to build each template's GitHub URL
published_at	Timestamp	Release publish date; compared with the last sync time
zipball_url / tarball_url	String	Source archive links
draft / prerelease	Boolean	Release flags

Usage

When a token is configured, it is sent as Authorization: Bearer <token> to the configured API host only. It is not forwarded when the archive download redirects to codeload.github.com.

---

Sync Behavior

Syncs are incremental at the release level. The nuclei-templates repository publishes no per-template timestamps, so the repository release is the unit of change: the connector compares the latest release's published_at with the since sync token it maintains between runs. When no new release has been published since the last sync, the connector emits no records and does not download the archive. When a new release is available (or on the first sync), every template of that release is emitted.

---

How to obtain ProjectDiscovery credentials

Obtain the required credentials (url) from your ProjectDiscovery administrator or the ProjectDiscovery admin console, then enter them in the connection settings above.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Nuclei Template

Source Field Name	SDM Attribute
id	UID
info.author	AUTHORS
info.classification.cpe	CPE_RECORDS
info.classification.cve-id	CVE_IDS
info.classification.cve-id	CVE_RECORDS
info.classification.cvss-metrics	CVSS_V2_* / CVSS_V3_* / CVSS_V4_*
info.classification.cvss-score	CVSS_SCORE
info.classification.cwe-id	CWE_IDS
info.classification.cwe-id	WEAKNESSES
info.classification.epss-percentile	EPSS_PERCENTILE
info.classification.epss-score	EPSS_SCORE
info.description	DESCRIPTION
info.impact	IMPACT
info.metadata.censys-query	CENSYS_QUERIES
info.metadata.fofa-query	FOFA_QUERIES
info.metadata.framework	FRAMEWORK
info.metadata.google-query	GOOGLE_QUERIES
info.metadata.hunter-query	HUNTER_QUERIES
info.metadata.max-request	MAX_REQUESTS
info.metadata.product	PRODUCT
info.metadata.publicwww-query	PUBLICWWW_QUERIES
info.metadata.shodan-query	SHODAN_QUERIES
info.metadata.vendor	VENDOR
info.metadata.verified	VERIFIED
info.metadata.zoomeye-query	ZOOMEYE_QUERIES
info.name	NAME
info.reference	REFERENCES
info.remediation	RECOMMENDATION
info.severity	SOURCE_SEVERITY
info.severity	SEVERITY
info.severity	SEVERITY_SCORE
info.tags	TAGS
release html_url + path	SOURCE_URL
release tag_name	RELEASE_TAG
template path	PROTOCOL
template path	CATEGORIES
template path	PATH
—	LAST_CAPTURED

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Nuclei Template

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on published_at.

API

• Type: REST
• Default filters: none; every detection template of the latest release is read

Changelog

Changelog

The ProjectDiscovery connector has undergone the following changes:

Version	Description	Migration Steps
3.0.0	New Features - Nuclei detection templates as threat intelligence. Every detection template in ProjectDiscovery's nuclei-templates library (about 13,500 across the HTTP, cloud, code, DAST, DNS, file, headless, JavaScript, network and SSL protocols) is synced as a ThreatIntel record, with name, description, authors, severity, tags, impact, remediation and references. - CVE, CWE and CPE correlation. Templates carry CVE_RECORDS, WEAKNESSES and CPE_RECORDS, linking them to the matching CVE, weakness and CPE records. A CVE with a Nuclei template can be scanned for, and therefore exploited, at scale, which is a strong weaponization signal for prioritization. - Vulnerability scoring. CVSS v2, v3.x and v4 vectors are parsed into the standard CVSS attributes (vector, base score, severity and each metric), alongside EPSS score and percentile. - Scan-target context. Vendor, product and framework, whether the template was verified against a live target, and the Shodan, FOFA, Google, PublicWWW, ZoomEye, Censys and Hunter queries that find exposed targets. - Release-based incremental sync. Templates are read from the latest repository release. When no new release has been published since the last sync, the connector skips the download and emits no records. - Optional GitHub token. No credentials are required. An optional GitHub token raises the GitHub API rate limit when many syncs share an outbound IP address.	No migration steps required — this is the initial release.