SysReptor

Penetration Testing

Overview

The SysReptor connector integrates with SysReptor, an open-source penetration test reporting and collaboration platform. It synchronizes assessments (one per pentest project, carrying the project's report fields), pentest findings, and a deduplicated library of pentest finding definitions derived from those findings.

SysReptor stores findings and report sections under pentest projects, and the shape of each finding's and report section's data object is defined by the project's design (its project type). The connector enumerates projects, walks each project's findings and report sections, and reads the project type's finding_fields and report_sections so that any organization-specific custom fields are surfaced automatically as connector attributes.

Data retrieved from SysReptor

Connector Object	Required	Maps to Data Model
Assessment	Yes	Assessment
Pentest Finding	Yes	Pentest Finding
Pentest Finding Definition	Yes	Pentest Finding Definition

Model relationships

note

For detailed steps on how to view the data retrieved from SysReptor in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select SysReptor from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	Yes	—	SysReptor base URL (e.g. https://sysreptor.example.com)
API token	Yes	—	SysReptor API token used as a Bearer token for authentication
Max retries	No	5	Maximum number of retries for failed API requests

Authentication

SysReptor authenticates with a personal API token supplied as a Bearer token.

Endpoint

Method	URL
GET	{url}/api/v1/pentestprojects

Request Headers

Header	Value
Authorization	Bearer <apiToken>
Accept	application/json

Usage

Every API request includes the bearer token:

Authorization: Bearer <apiToken>

The connection test issues a GET /api/v1/pentestprojects request and treats any non-2xx response as an authentication/connectivity failure.

Sync Behavior

Each sync is incremental. The connector maintains a sync token between runs and applies an incremental since filter, so each run emits only the records that changed since the previous sync. The filter is applied by the connector rather than the API: every run still reads all projects, findings, and report sections, and skips the records that have not changed. The first run (no token) emits everything.

• Pentest Finding and Pentest Finding Definition: findings whose updated timestamp is at or after the token; definitions are derived from those findings before deduplication.
• Assessment: projects where the newest updated timestamp of the project and its report sections is at or after the token.

How to obtain SysReptor credentials

Obtain the required credentials (url, apiToken) from your SysReptor administrator or the SysReptor admin console, then enter them in the connection settings above.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Assessment

Source Field Name	SDM Attribute
newest of Project.updated and Section.updated	SOURCE_LAST_MODIFIED
Project.created	SOURCE_CREATED_DATE
Project.id	UID
Project.name	NAME
Project.readonly	READONLY
Project.tags	TAGS
Section.data.*	custom
sync time	LAST_CAPTURED

Pentest Finding

Source Field Name	SDM Attribute
Finding.assignee.name (fallback username)	ASSIGNEE
Finding.created	FIRST_FOUND
Finding.data.*	custom
Finding.data.affected_components	TARGETS
Finding.data.recommendation	RECOMMENDATION
Finding.data.retest_status (fallback Finding.status)	PROVIDER_STATUS
Finding.data.title	NAME
Finding.id	UID
Finding.project	ASSESSMENT
Finding.status	WORKFLOW_STATUS
Finding.updated	LAST_FOUND
hash of the definition fields	TYPE
normalized PROVIDER_STATUS	SOURCE_STATUS
sync time	LAST_CAPTURED

Pentest Finding Definition

Source Field Name	SDM Attribute
derived from SEVERITY	SEVERITY_SCORE
Finding.data.cvss	CVSS_V3_VECTOR, CVSS_V3_BASE_SCORE, CVSS_V3_SEVERITY, …
Finding.data.description	DESCRIPTION
Finding.data.references	REFERENCES
Finding.data.root_cause	CATEGORIES
Finding.data.root_cause	TAGS
Finding.data.summary	SUMMARY
Finding.data.title	NAME
hash of the definition fields	UID
normalized SOURCE_SEVERITY	SEVERITY
severity from data.cvss	SOURCE_SEVERITY
sync time	LAST_CAPTURED

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Assessment

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updated.

API

• Type: REST endpoint · Endpoint: GET /api/v1/pentestprojects/{id}/sections/

Pentest Finding

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updated.

API

• Type: REST endpoint · Endpoint: GET /api/v1/pentestprojects/{id}/findings/

Pentest Finding Definition

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updated.

API

• Type: REST endpoint · Endpoint: GET /api/v1/pentestprojects/{id}/findings/

Changelog

Changelog

The SysReptor connector has undergone the following changes:

Version	Description	Migration Steps
3.1.0	New Features - New Assessment model: one record per SysReptor pentest project, carrying the project's name, tags, read-only state, and timestamps, plus every report field defined by the project design (for example the report title, dates, and any organization-specific metadata fields). Report fields are discovered from the design, so fields an organization adds to its design arrive as attributes without a connector change. - Pentest Findings now link to their Assessment through the ASSESSMENT attribute. Improvements - Custom enum fields on Pentest Findings and Assessments now report the label defined in the project design (for example Insecure Design) instead of the stored value (insecure_design). Enums nested inside objects or lists of objects are resolved too. A value that matches none of the design's choices is reported as stored. - Custom date fields are now Instants (midnight UTC) rather than text, so they can be filtered and compared as dates. - Pentest Finding Definition categories and tags report the root cause by its label. Definition identity still uses the stored root cause value. - Syncs make fewer API requests. Each project's design is now downloaded once per sync run and shared by the Assessment, Pentest Finding, and Pentest Finding Definition syncs, where previously each of them downloaded it again, and the Pentest Finding sync lists the projects once instead of twice. Bug Fixes - Fixed an issue where Pentest Findings and Pentest Finding Definitions could be imported incomplete after an interrupted sync, or outdated from an earlier sync. Each sync now imports the complete, current set of findings from SysReptor. - Fixed an issue where a custom field named or labeled Model, Version, or Type, which the platform reserves, could prevent the connector's models from being created. Such a field is now synchronized with a source_ prefix, for example source_version, titled Source Version. If the design already has a field by that name, the design's own field is kept and the reserved field is skipped. - Fixed an issue where a custom Pentest Finding field that different projects' copies of the design declare with different types could be reported with a type that did not match its attribute. Custom field values are now always converted to the attribute's type; a value that cannot be converted, such as the text yes for a Boolean attribute or a date that does not parse, is dropped and logged rather than stored as something else.	• Pentest Finding: The PROJECT attribute was removed and replaced by ASSESSMENT, which holds the same project ID. Custom enum attributes now hold labels and custom date attributes are now Instants. — Action: Purge the Pentest Finding data and run a full sync. Syncs are incremental, so without the purge and full sync, findings that are not updated in SysReptor keep their previous values and never receive an ASSESSMENT link. • Pentest Finding Definition: Categories and tags now hold the root cause label rather than its stored value. — Action: Purge the Pentest Finding Definition data and run a full sync.
3.0.2	Improvements - Pentest Finding targets that are URLs are now reduced to their host, so https://user:pass@App.Example.com:8443/login?next=/ is reported as app.example.com. The scheme, credentials, port, path, query string, and fragment are dropped, and domain names are lowercased, which lets findings reported against different pages of the same application share one target. URLs entered without a scheme, such as app.example.com/login, are recognized too. Other entries are kept exactly as entered, including bare domains, host names, IP addresses, CIDR ranges, accounts such as admin@example.com:22, file references such as config.yaml:12, and descriptive component names. Since syncs are incremental, findings synchronized by an earlier version keep their full-URL targets until they are next updated in SysReptor.	N/A
3.0.1	Bug Fixes - Finding definitions are now deduplicated by the content they describe rather than by finding title. SysReptor titles are free-form and are reused across engagements, so definitions keyed on the title kept only the first same-titled finding's description and left every other finding sharing that title reporting a severity derived from a different finding's CVSS score. - Re-test statuses are now mapped explicitly: resolved reports as fixed, accepted as risk accepted, and open, partial, and changed as reopened. Previously partial and changed were not recognized at all and were stored verbatim, leaving those findings with a status that matched none of the platform's statuses, while open reported as active. - A finding whose re-test status is empty rather than absent is no longer left with no status at all. An empty value used to suppress the documented fallback to the finding's workflow status. - A workflow status that does not describe remediation is no longer reported as the finding's status. finished was stored verbatim and ready-for-review became ready for review, neither of which the platform recognizes. Since a workflow status reflects how far the report write-up has got, such values now report as active, and the raw value remains available as the provider status.	• Pentest Finding Definition: The identifier used for finding definitions changed from the finding title to a hash of the definition's content, and the linkage between Pentest Findings and their definitions was updated accordingly. — Action: Purge the Pentest Finding Definition data and re-sync the connector so definitions are re-created under their new identifiers. Definitions synchronized by an earlier version will not match the new identifiers and are not removed automatically, so skipping the purge leaves the earlier definitions in place.
3.0.0	Overview The SysReptor connector integrates with SysReptor to synchronize penetration test findings and a deduplicated library of finding definitions (including severity ratings and CVSS metrics). Category: Penetration Testing Models	N/A