Skip to main content

Security Reporter

Penetration Testing

Security Reporter is a pentest reporting and collaboration platform published by DongIT. Security teams use it to run offensive-security engagements — assessments against a client's targets — and to record, review, and report the findings those engagements produce. The connector supports customers who use Security Reporter for their offensive-security / pen-testing services.

The connector reads from the tenant's Security Reporter REST API and synchronizes clients, targets, assessments, pentest findings, finding definitions, and users into Brinqa. Targets are split across nine asset models according to the vendor's target_type, so each one lands on the UDM model that fits it.

Data retrieved from Security Reporter​

Connector ObjectRequiredMaps to Data Model
ClientYesTeam
HostYesHost
SiteYesSite
Api EndpointYesApi Endpoint
ApplicationYesApplication
DeviceYesDevice
NetworkYesNetwork
Cloud ResourceYesCloud Resource
Code RepositoryYesCode Repository
Other TargetYesHost
AssessmentYesAssessment
Pentest FindingYesPentest Finding
Pentest Finding DefinitionYesPentest Finding Definition
UserYesPerson

Model relationships​

note

For detailed steps on how to view the data retrieved from Security Reporter in the Brinqa Platform, see How to view your data.

note

Security Reporter's Client is the customer an engagement was performed for — the pentest provider's client, not a technical concept. The Client model, and the Pentest Finding → Assessment → Client chain on RELATES_TO, are what make it possible to scope a view to one customer.

warning

Every target model narrows the endpoint server-side, so a target_type the API introduces in future is claimed by no model and will not sync until it is added to TargetType. This is a deliberate trade-off: the alternative is an unfiltered full scan of the targets table on every sync. New enum values are rare and adding one is a one-line change. An integration test pins the behaviour so it cannot change silently.

note

Every edge above is emitted by the connector today. Pentest Finding → Assessment → Client is the chain that makes a client-scoped view possible; the Assessment → Assessment self-edge is DUPLICATED_FROM, the engagement a retest was copied from. Findings link to their targets through TARGETS, to their definition through TYPE, and to the reviewing user through REVIEWED_BY.

Last updated on