Sonatype Nexus IQ

Application Security

Overview

The Sonatype Nexus IQ Connector integrates with Sonatype Lifecycle (Nexus IQ Server) to synchronize software composition analysis (SCA) data. It connects to the Nexus IQ Server REST API and ingests applications, their scanned open-source components, the security vulnerabilities and policy violations found in those components, the remediation guidance available for them, and the underlying definitions that describe each vulnerability and policy.

The connector syncs seven object types:

• Application — applications registered in Nexus IQ.
• Component — open-source components (packages) discovered in application scans.
• Remediation — recommended version changes that resolve issues in a component.
• Policy Violation — individual policy violations raised against an application/component.
• Policy Violation Definition — the policies that violations are evaluated against.
• Security Issue — security vulnerabilities (findings) detected in components.
• Security Issue Definition — definitions (severity, threat category, reference) for each detected vulnerability.

Data retrieved from Sonatype Nexus IQ

Connector Object	Required	Maps to Data Model
Application	Yes	Application
Component	Yes	Package
Remediation	Yes	Solution
Policy Violation	Yes	Violation
Policy Violation Definition	Yes	Violation Definition
Security Issue	Yes	Vulnerability
Security Issue Definition	Yes	Vulnerability Definition

Model relationships

note

For detailed steps on how to view the data retrieved from Sonatype Nexus IQ in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Sonatype Nexus IQ from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Nexus server	No	—	Nexus server base URL
Username	No	—	Nexus username
Password	No	—	Nexus password
SSL / TLS	No	—	Skip certificate verification
Skip missing scan reports	No	—	If enabled, missing or purged scan reports will be skipped

Authentication

The connector authenticates to the Nexus IQ Server using HTTP Basic Authentication. The configured username and password (or user token) are Base64-encoded and sent in the Authorization header on every API request.

The connector verifies connectivity by calling the applications listing endpoint.

Endpoint

Method	URL
GET	{Nexus server}/api/v2/applications

Request Headers

Header	Value
Authorization	Basic {base64(username:password)}
Accept	application/json

Sample Request

GET /api/v2/applications HTTP/1.1
Host: nexus-iq.example.com
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
Accept: application/json

Sample Response

{
  "applications": [
    {
      "id": "4f0d16eae2de4c8aa9803ed5d571f5d1",
      "publicId": "NIQ",
      "name": "BRQ-NexusIQ",
      "organizationId": "94b38685ed2d40368f516377cc0247e5",
      "contactUserName": null,
      "applicationTags": []
    }
  ]
}

Response Fields

Field	Description
id	Internal application identifier used in subsequent API calls.
publicId	Human-readable public identifier of the application.
name	Display name of the application.
organizationId	Identifier of the owning organization.
contactUserName	Contact user assigned to the application.

A successful response (HTTP 200) confirms the credentials are valid. The same Basic Authorization header is reused on all subsequent requests (reports, policies, policy violations, remediation, and vulnerability detail endpoints).

Sync Behavior

• Full synchronization: The connector performs a full download on every sync. It does not persist an incremental sync token, so each run re-reads the current state from the Nexus IQ Server rather than fetching only what changed since the last run.
• Report selection: Application scan reports are de-duplicated per application, keeping the most recent report by evaluation date. Report retrieval can be narrowed with the applicationId and reportId operation options.
• Transaction-scoped staging: Policy, component, and security-issue data are staged in local storage during a sync and keyed by the TRANSACTION_ID operation option, keeping results consistent across paged handler calls. Staging directories left over from other transactions are cleaned up automatically.
• Missing reports: When Skip missing scan reports is enabled, reports that have been purged or are otherwise unavailable are skipped instead of failing the sync.
• Optional vulnerability enrichment: For Policy Violations, enabling the get_vulnerability_details option fetches the description and recommendation for each referenced security vulnerability.
• Retries: API requests are retried on failure (up to five attempts), with exponential backoff applied to remediation POST calls.

How to obtain Sonatype Nexus IQ credentials

Note: The Sonatype Nexus IQ user must have the View IQ Elements permission to access and retrieve data from the Sonatype Nexus IQ API. For additional information, see Sonatype documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Application

Source Field Name	SDM Attribute
Applikation.contactUserName	CONTACT
Applikation.id	UID
Applikation.name	NAME
Applikation.organizationId	ORGANIZATION_ID
Applikation.publicId	PUBLIC_ID
Constant (active)	STATUS
Constant (Application)	CATEGORIES
Constant (unknown)	SOURCE_STATUS

Component

Source Field Name	SDM Attribute
Aggregated application IDs	APPLICATIONS
Constant (active)	STATUS
Constant (Package)	CATEGORIES
Constant (unknown)	SOURCE_STATUS
Komponent.artifactId	ARTIFACT_ID
Komponent.classifier	CLASSIFIER
Komponent.componentIdentifier.coordinatesAsString	COORDINATES
Komponent.extension	EXTENSION
Komponent.fileName	FILE_NAME
Komponent.format	FORMAT
Komponent.groupId	GROUP_ID
Komponent.id	UID
Komponent.licenseData.declaredLicenses[].licenseName	DECLARED_LICENSES
Komponent.licenseData.observedLicenses[].licenseName	OBSERVED_LICENSES
Komponent.name	NAME
Komponent.pathnames	FILE_PATHS
Komponent.securityData.securityIssues[].reference	SECURITY_ISSUES
Komponent.version	CURRENT_VERSION

Remediation

Source Field Name	SDM Attribute
Komponent.id	UID
Komponent.id	COMPONENT_ID
remediation.versionChanges[]	VERSION_CHANGES

Policy Violation

Source Field Name	SDM Attribute
Application ID + component ID	TARGETS
Applikation.id	APP_ID
Applikation.name	APPLICATION_NAME
Constant (active)	STATUS
Constant (active)	SOURCE_STATUS
ConstraintViolation.constraintName	CONSTRAINT
ConstraintViolation.reasons[].reason	REASONS
Policy.name	NAME
PolizyViolation.component.name	COMPONENT_NAME
PolizyViolation.policyId	TYPE
PolizyViolation.policyViolationId	UID
PolizyViolation.reportUrl	REPORT_URL
PolizyViolation.stageId	STAGE
Reason.reference.value (security vulnerability)	REFERENCE_ID
VulnerabilityDetail.description	DESCRIPTION
VulnerabilityDetail.recommendation	RECOMMENDATION

Policy Violation Definition

Source Field Name	SDM Attribute
Policy.id	UID
Policy.id	POLICY_ID
Policy.name	NAME
Policy.policyType	CATEGORIES
Policy.threatLevel	THREAT_LEVEL

Security Issue

Source Field Name	SDM Attribute
Application ID + component ID	TARGETS
Derived from normalized status	STATUS_CATEGORY
Issue.reference	TYPE
Issue.source	SOURCE
Issue.status	PROVIDER_STATUS
Issue.status (normalized)	STATUS
Issue.status (normalized)	SOURCE_STATUS
Komponent.id	COMPONENT_ID
Komponent.name	COMPONENT_NAME
MD5 of application ID + component ID + issue reference	UID
Report.applicationId	APP_ID
Report.stage	STAGE

Security Issue Definition

Source Field Name	SDM Attribute
Derived from normalized severity	SEVERITY_SCORE
Issue.reference	UID
Issue.reference	NAME
Issue.reference	REFERENCES
Issue.severity	SEVERITY_VALUE
Issue.threatCategory	SOURCE_SEVERITY
Issue.threatCategory	THREAT_CATEGORY
Issue.threatCategory (normalized)	SEVERITY
Issue.url	URL

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Application

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Application on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/v2/applications

Component

Operation options

Option	Type	Default	Description
applicationId	Restrict report retrieval to a single application.	—
reportId	Restrict to a specific report.	—

Delta sync

Not supported. The connector performs a full sync of Component on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/v2/reports/applications/{applicationId}

Remediation

Operation options

Option	Type	Default	Description
applicationId	Restrict report retrieval to a single application.	—
reportId	Restrict to a specific report.	—

Delta sync

Not supported. The connector performs a full sync of Remediation on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: POST /api/v2/components/remediation/application/{applicationInternalId}
• Default filters: stageId=release

Policy Violation

Operation options

Option	Type	Default	Description
get_vulnerability_details	When true, fetch vulnerability description and recommendation for security-vulnerability references.	—
TRANSACTION_ID	Transaction identifier used to scope local storage across paged sync calls.	—

Delta sync

Not supported. The connector performs a full sync of Policy Violation on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/v2/policyViolations?p={policyId}
• Default filters: p={policyId} (per policy)

Policy Violation Definition

Operation options

Option	Type	Default	Description
TRANSACTION_ID	Transaction identifier used to scope local storage across paged sync calls.	—

Delta sync

Not supported. The connector performs a full sync of Policy Violation Definition on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/v2/policies

Security Issue

Operation options

Option	Type	Default	Description
applicationId	Restrict report retrieval to a single application.	—
reportId	Restrict to a specific report.	—
TRANSACTION_ID	Transaction identifier used to scope local storage across paged sync calls.	—

Delta sync

Not supported. The connector performs a full sync of Security Issue on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/v2/reports/applications/...

Security Issue Definition

Operation options

Option	Type	Default	Description
applicationId	Restrict report retrieval to a single application.	—
reportId	Restrict to a specific report.	—
TRANSACTION_ID	Transaction identifier used to scope local storage across paged sync calls.	—

Delta sync

Not supported. The connector performs a full sync of Security Issue Definition on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /api/v2/reports/applications/...

Changelog

Changelog

The Sonatype Nexus IQ connector has undergone the following changes:

Version	Description	Migration Steps
3.0.6	Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so Sonatype Nexus data is no longer overridden by lower-priority sources. Bug Fixes - Corrected the Security Issue Definition model's "Severity value" attribute to be stored as a number (was text), matching the value returned by the Sonatype Nexus API.	• Security Issue Definition: the "Severity value" attribute changed from text to a number. Re-sync the Sonatype Nexus connector to repopulate security issue definitions with the corrected type.
3.0.5	Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.4	Improvements - Policy Violations are now published with an explicit status, so open violations surface as active findings in the platform. - Security Issue status handling was refined: the normalized status is now stored consistently, and the original status reported by Sonatype Nexus is preserved separately so both views are available.	• Security Issue: the stored value of the source status attribute changed from the raw Sonatype Nexus value to the normalized status. Re-sync the Sonatype Nexus connector to repopulate security issues with the corrected status values.
3.0.3	Improvements - Policy Violations are now identified by the unique violation ID reported by Sonatype Nexus, giving each violation a stable identity across syncs and preventing distinct violations from collapsing together.	• Policy Violation: the identifier used for each policy violation changed. Purge existing Sonatype Nexus policy violations and re-sync the connector so violations are re-created under their new identifiers.
3.0.2	New Features - Policy Violations can now be enriched with detailed vulnerability information (description and remediation guidance) pulled directly from the Sonatype Nexus vulnerability catalog, and each violation now records the associated vulnerability reference identifier.	N/A
3.0.1	New Features - Added a "Skip missing scan reports" option. When enabled, scan reports that have been purged or are otherwise unavailable in Sonatype Nexus are skipped instead of failing the sync. - Policy Violations now include constraint description and recommendation details when provided by Sonatype Nexus. Improvements - Remediation lookups now validate component coordinates before querying Sonatype Nexus, avoiding unnecessary or malformed requests for components that cannot be remediated.	N/A
3.0.0	Overview The Sonatype Nexus connector integrates with Sonatype Nexus IQ to synchronize application assets, their software components and remediations, and the policy violations and security issues identified during scans. Category: Application Security Models	N/A