SecurityBridge

SAP Security

Overview

The SecurityBridge connector integrates with SecurityBridge for SAP, an SAP-certified cybersecurity platform that runs natively inside the SAP system. It synchronizes the Patch-Management Notes per System data set — the matrix of SAP Security Notes evaluated against each SAP system — and normalizes it into Brinqa Assets (SAP systems), Vulnerability Definitions (SAP Security Notes), and Vulnerabilities (a note's implementation status on a system). A security-relevant SAP Security Note that is not yet implemented on a system is an open vulnerability (a missing patch) on that asset.

The connector reads SecurityBridge's SAP NetWeaver Gateway OData v2 service over HTTP and consumes the Atom (XML) response format.

Data retrieved from SecurityBridge

Connector Object	Required	Maps to Data Model
Asset	Yes	Host
Vulnerability Definition	Yes	Vulnerability Definition
Vulnerability	Yes	Vulnerability

Model relationships

note

For detailed steps on how to view the data retrieved from SecurityBridge in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select SecurityBridge from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	Yes	—	SecurityBridge API URL
Username	Yes	—	SecurityBridge username
Password	Yes	—	SecurityBridge password
Page size	No	100	Maximum number of records to get per API request
Maximum retries	No	5	Maximum number of retry attempts before giving up a request

Authentication

The connector authenticates with the SAP host using HTTP Basic authentication against a dedicated SAP technical user. On every request the connector sets the Authorization header from the configured username and password.

Method

Element	Value
Method	HTTP Basic authentication

Request Headers

Header	Value
Authorization	Basic <base64(username:password)>
Accept	application/xml

Usage

Every OData request includes the Basic authorization header:

Authorization: Basic <base64 encoded 'username:password'>

Sync Behavior

Each sync is a full sync. The connector does not maintain a sync token and does not apply an incremental since filter, so every run re-fetches the complete set of records for each enabled model.

How to obtain SecurityBridge credentials

SecurityBridge Connector — Setup

This guide describes the SAP-side prerequisites required before the SecurityBridge connector can pull data. These steps are performed by the customer's SAP Basis / security team, not by Brinqa. The connector itself only needs a URL, a username, and a password see Configuration.

SecurityBridge exposes its data through an SAP NetWeaver Gateway OData v2 service. Access is protected by two independent security layers — both must pass or the request fails:

1. HTTP authentication — proves who the user is (Basic credentials).
2. SAP authorization — a separate SAP check that decides what the user may do (PFCG role).

---

1. Create a dedicated technical user

Create a dedicated, read-only technical / communication user in the target SAP system for the connector to authenticate as. Do not reuse a named person's dialog account.

• Recommended user type: Communication (Type C) or System (Type B), per your organization's policy.
• Assign a strong password and record the username and password — these become the connector's username and password configuration values.

2. Assign the required SAP authorizations (PFCG role)

Authenticating only proves identity. SAP then performs a separate authorization check using authorization objects bundled into a PFCG role assigned to the technical user. The role must contain three authorizations. A valid login that is missing any of these returns 403 (or an empty response with an authorization error) rather than data.

2.1 SecurityBridge API permission — object /SECBR/API

The application-level gate that allows the user to call the Patch-Management API.

Field	Value	Meaning
/SECBR/VND	SB	Vendor = SecurityBridge
/SECBR/API	PMNotesPerSystem	The specific API the user may call

2.2 & 2.3 SAP Gateway service permission — object S_SERVICE

SAP's standard object for executing an OData/external service. SAP Gateway's two-part architecture requires the service to be authorized on both the frontend (hub) and backend sides — two entries for the same service:

Entry	Object (type TADIR Service)	Object Name	SRV_TYPE
IWSG — Gateway Service Group metadata (hub/frontend)	IWSG	/SECBR/API_SRV_0001	HT
IWSV — Gateway Business Suite Enablement (backend)	IWSV	/SECBR/API_SRV_0001	HT

SRV_TYPE = HT denotes an HTTP (OData) service.

note

SecurityBridge enforces two independent security layers — both must pass or the request fails:

1. HTTP authentication — the Basic credentials prove who the user is (a 401 indicates bad credentials).
2. SAP authorization — a separate SAP check decides what the user may do. The API user must be assigned a PFCG role granting the SecurityBridge API authorization (/SECBR/API) and the SAP Gateway service authorization (S_SERVICE, both the IWSG frontend and IWSV backend entries). A valid login that is missing these authorizations returns 403 or an empty/authorization-error response.

See SETUP for the full list of required SAP authorizations and the technical-user prerequisites the customer's SAP Basis team must configure.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Asset

Source Field Name	SDM Attribute
_(constant)_	STATUS
_(runtime)_	LAST_CAPTURED
PMNotesPerSystem.AffectSysType	CATEGORIES
PMNotesPerSystem.AssignedTags	TAGS
PMNotesPerSystem.backupContactAOR	BACKUP_CONTACT_AOR
PMNotesPerSystem.Dbsys	DBSYS
PMNotesPerSystem.Landscape	LANDSCAPE
PMNotesPerSystem.mainContactAOR	OWNER
PMNotesPerSystem.System	UID
PMNotesPerSystem.System	NAME
PMNotesPerSystem.System	SYSTEM

Vulnerability Definition

Source Field Name	SDM Attribute
_(runtime)_	LAST_CAPTURED
PMNotesPerSystem.Category	CATEGORIES
PMNotesPerSystem.CVE	CVE_IDS
PMNotesPerSystem.CVE	CVE_RECORDS
PMNotesPerSystem.CVSS	CVSS_BASE_SCORE
PMNotesPerSystem.Description	DESCRIPTION
PMNotesPerSystem.KernelRelevant	KERNEL_RELEVANT
PMNotesPerSystem.ManualActivity	MANUAL_ACTIVITY
PMNotesPerSystem.Note	UID
PMNotesPerSystem.Note	NAME
PMNotesPerSystem.Patchday	PATCH_DAY
PMNotesPerSystem.ReleasedOn	PUBLISHED_DATE
PMNotesPerSystem.Severity	SOURCE_SEVERITY
PMNotesPerSystem.Severity	SEVERITY
PMNotesPerSystem.Severity	SEVERITY_SCORE
PMNotesPerSystem.Version	REVISION

Vulnerability

Source Field Name	SDM Attribute
_(runtime)_	LAST_CAPTURED
PMNotesPerSystem.Age	AGE
PMNotesPerSystem.Comment	COMMENT
PMNotesPerSystem.ImpactAssessmentText	IMPACT_ASSESSMENT
PMNotesPerSystem.ImplementedBy	IMPLEMENTED_BY
PMNotesPerSystem.ImplementedTimestamp	LAST_FIXED
PMNotesPerSystem.ImplementedTransport	IMPLEMENTED_TRANSPORT
PMNotesPerSystem.ImplState	SOURCE_STATUS
PMNotesPerSystem.ImplStateText	IMPL_STATE
PMNotesPerSystem.ImplStateText	PROVIDER_STATUS
PMNotesPerSystem.Note	TYPE
PMNotesPerSystem.ProcStatusText	PROC_STATUS
PMNotesPerSystem.SLA	SLA
PMNotesPerSystem.SolmanProcStatus	SOLMAN_PROC_STATUS
PMNotesPerSystem.System	TARGETS
PMNotesPerSystem.System + PMNotesPerSystem.Note	UID
PMNotesPerSystem.System + PMNotesPerSystem.Note	NAME

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Asset

Operation options

Option	Type	Default	Description
released_on_from	Instant	—	Filter notes by release date, lower bound (ReleasedOnFrom, YYYYMMDD)
released_on_to	Instant	—	Filter notes by release date, upper bound (ReleasedOnTo, YYYYMMDD)
severities	String	—	Comma-separated note severities (Low, Medium, High, Hot News)
impl_states	String	—	Comma-separated implementation-state codes (E, N, U, V, O, M, -)
processing_statuses	String	—	Comma-separated processing-status codes (A, I, N, R, D, E, V)
affected_system_types	String	—	Comma-separated affected system types (e.g. ABAP, JAVA)
all_notes	Boolean	—	false = pending notes only; true = all existing notes
page_size	Integer	100	Records per page ($top)
max_retries	Integer	5	Maximum retry attempts per request

Delta sync

Not supported. The connector performs a full sync of Asset on every run and applies no incremental date filter.

API

• Type: REST endpoint (OData v2, Atom/XML) · Endpoint: GET /sap/opu/odata/SECBR/API_SRV/PMNotesPerSystemSet

note

• Asset coverage is note-driven. Only systems that have at least one note in the query window appear as Assets. Fully-patched systems with zero applicable notes are not returned by this endpoint and therefore do not sync as Assets.

---

Vulnerability Definition

Operation options

Option	Type	Default	Description
released_on_from	Instant	—	Filter notes by release date, lower bound (ReleasedOnFrom, YYYYMMDD)
released_on_to	Instant	—	Filter notes by release date, upper bound (ReleasedOnTo, YYYYMMDD)
severities	String	—	Comma-separated note severities (Low, Medium, High, Hot News)
impl_states	String	—	Comma-separated implementation-state codes (E, N, U, V, O, M, -)
processing_statuses	String	—	Comma-separated processing-status codes (A, I, N, R, D, E, V)
affected_system_types	String	—	Comma-separated affected system types (e.g. ABAP, JAVA)
all_notes	Boolean	—	false = pending notes only; true = all existing notes
page_size	Integer	100	Records per page ($top)
max_retries	Integer	5	Maximum retry attempts per request

Delta sync

Not supported. The connector performs a full sync of Vulnerability Definition on every run and applies no incremental date filter.

API

• Type: REST endpoint (OData v2, Atom/XML) · Endpoint: GET /sap/opu/odata/SECBR/API_SRV/PMNotesPerSystemSet

Vulnerability

Operation options

Option	Type	Default	Description
released_on_from	Instant	—	Filter notes by release date, lower bound (ReleasedOnFrom, YYYYMMDD)
released_on_to	Instant	—	Filter notes by release date, upper bound (ReleasedOnTo, YYYYMMDD)
severities	String	—	Comma-separated note severities (Low, Medium, High, Hot News)
impl_states	String	—	Comma-separated implementation-state codes (E, N, U, V, O, M, -)
processing_statuses	String	—	Comma-separated processing-status codes (A, I, N, R, D, E, V)
affected_system_types	String	—	Comma-separated affected system types (e.g. ABAP, JAVA)
all_notes	Boolean	—	false = pending notes only; true = all existing notes
page_size	Integer	100	Records per page ($top)
max_retries	Integer	5	Maximum retry attempts per request

Delta sync

Not supported. The connector performs a full sync of Vulnerability on every run and applies no incremental date filter.

API

• Type: REST endpoint (OData v2, Atom/XML) · Endpoint: GET /sap/opu/odata/SECBR/API_SRV/PMNotesPerSystemSet

note

• The finding lifecycle is driven by the SAP ImplState code (N can be implemented, U incompletely implemented, M manual check required, or blank) map to active; notes that are implemented or no longer applicable (E completely implemented, V obsolete version implemented, O obsolete, - cannot be implemented) map to fixed.

Changelog

Changelog

The SecurityBridge connector has undergone the following changes:

Version	Description	Migration Steps
3.0.0	Overview The SecurityBridge connector integrates with SecurityBridge for SAP to synchronize SAP Patch-Management data — SAP systems, SAP Security Notes, and each note's implementation status per system — as assets, vulnerability definitions, and vulnerability findings. Category: SAP Security Models	N/A