Upwind

Cloud Security

Overview

The Upwind connector integrates with Upwind Security, a cloud-native application protection platform (CNAPP) that combines cloud security posture management (CSPM), workload protection, cloud identity, application and API security, and runtime threat detection. Upwind builds a live inventory of cloud resources and correlates findings using runtime context to prioritize the risks that matter.

The connector synchronizes cloud resources (hosts and API endpoints), vulnerability, configuration/CSPM, and runtime threat findings along with their corresponding definitions, and cloud identities (members and groups). It authenticates using OAuth 2.0 client credentials against Upwind's regional API and normalizes each record into the Brinqa Unified Data Model.

Data retrieved from Upwind

Connector Object	Required	Maps to Data Model
Host	Yes	Host
Vulnerability	Yes	Vulnerability
Vulnerability Definition	Yes	Vulnerability Definition
Violation	Yes	Violation
Violation Definition	Yes	Violation Definition
Alert	Yes	Alert
Alert Definition	Yes	Alert Definition
Story	Yes	Incident
Api Endpoint	Yes	Api Endpoint
Person	Yes	Person
Team	Yes	Team

Model relationships

note

For detailed steps on how to view the data retrieved from Upwind in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Upwind from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	Yes	https://api.upwind.io	Upwind regional API base URL (e.g. https://api.upwind.io, https://api.eu.upwind.io, https://api.me.upwind.io)
Organization ID	Yes	—	Upwind organization identifier used in all API paths
Client ID	Yes	—	OAuth 2.0 client ID generated from the Upwind Credentials page
Client secret	Yes	—	OAuth 2.0 client secret generated from the Upwind Credentials page
Auth URL	No	https://auth.upwind.io/oauth/token	OAuth 2.0 token endpoint (default https://auth.upwind.io/oauth/token)
Audience	No	https://api.upwind.io	OAuth 2.0 audience; must match the regional API URL (default https://api.upwind.io)
Page size	No	100	Maximum number of records to get per API request (max 200)
Max retries	No	5	Maximum number of retries for a failed API request

Authentication

The connector authenticates using the OAuth 2.0 client-credentials grant. Credentials (client ID and client secret) are generated from the Upwind Credentials page. The connector requests a short-lived bearer token from the Upwind authorization server and caches it until it expires, refreshing automatically as needed.

Endpoint

Method	URL
POST	https://auth.upwind.io/oauth/token

Request Headers

Header	Value
Content-Type	application/x-www-form-urlencoded
User-Agent	brinqa-upwind-connector

Request Body

The token request is sent as URL-encoded form parameters:

{
  "client_id": "your-client-id",
  "client_secret": "your-client-secret",
  "audience": "https://api.upwind.io",
  "grant_type": "client_credentials"
}

Sample Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6...",
  "token_type": "Bearer",
  "expires_in": 86400
}

Response Fields

Field	Type	Description
access_token	String	Bearer token used to authorize subsequent API requests
token_type	String	Token type (Bearer)
expires_in	Integer	Token lifetime in seconds; the connector refreshes the token before it expires

Usage

Once authenticated, all subsequent API requests include the bearer token and a required User-Agent header (Upwind's WAF rejects requests with no User-Agent, returning an HTML 403 before the request reaches the API):

Authorization: Bearer <access_token>
User-Agent: brinqa-upwind-connector

Sync Behavior

Sync behavior varies by model. Most models — Host, Api Endpoint, Vulnerability, Vulnerability Definition, Alert Definition, Story, Person, and Team — are full syncs: the underlying endpoints expose no server-side time filter, so every run re-fetches the complete record set. Violation and Violation Definition apply an incremental since filter on evaluation_time, and Alert applies one on min-last-seen-time; on a delta run these fetch only the records that changed since the previous sync token. See each model's #### Sync Duration Parameter for the specific mechanism.

How to obtain Upwind credentials

Obtain the required credentials (url, organizationId, clientId, clientSecret) from your Upwind administrator or the Upwind admin console, then enter them in the connection settings above.

note

Upwind is region-specific. Point the connector at the API base URL for your region and set the audience to match:

• US: https://api.upwind.io
• EU: https://api.eu.upwind.io
• ME: https://api.me.upwind.io

The OAuth audience must match the regional API URL.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Host

Source Field Name	SDM Attribute
*(sync time)*	LAST_CAPTURED
ApiCatalogAssetResource.category	CATEGORIES
ApiCatalogAssetResource.cloud_account_id	CLOUD_ACCOUNT_ID
ApiCatalogAssetResource.cloud_provider	CLOUD_PROVIDER
ApiCatalogAssetResource.cloud_resource_id	CLOUD_RESOURCE_ID
ApiCatalogAssetResource.custom_tags	CUSTOM_TAGS
ApiCatalogAssetResource.detection_risk.critical_count	CRITICAL_DETECTION_COUNT
ApiCatalogAssetResource.detection_risk.high_count	HIGH_DETECTION_COUNT
ApiCatalogAssetResource.detection_risk.low_count	LOW_DETECTION_COUNT
ApiCatalogAssetResource.detection_risk.medium_count	MEDIUM_DETECTION_COUNT
ApiCatalogAssetResource.detection_risk.total_count	TOTAL_DETECTION_COUNT
ApiCatalogAssetResource.high_privilege_risk.has_elevated_privilege	HAS_ELEVATED_PRIVILEGE
ApiCatalogAssetResource.id	UID
ApiCatalogAssetResource.name	NAME
ApiCatalogAssetResource.network_risk.internet_exposure_type	INTERNET_EXPOSURE_TYPE
ApiCatalogAssetResource.network_risk.last_access_from_internet_in_ssh_or_rdp_time	LAST_INTERNET_SSH_RDP_ACCESS
ApiCatalogAssetResource.network_risk.last_access_from_internet_time	LAST_INTERNET_ACCESS
ApiCatalogAssetResource.network_risk.last_application_layer_internet_ingress_time	LAST_APP_LAYER_INTERNET_INGRESS
ApiCatalogAssetResource.network_risk.last_communication_with_database_time	LAST_DATABASE_COMMUNICATION
ApiCatalogAssetResource.network_risk.last_communication_with_internet_time	LAST_INTERNET_COMMUNICATION
ApiCatalogAssetResource.network_risk.last_imds_v1_access_time	LAST_IMDS_V1_ACCESS
ApiCatalogAssetResource.network_risk.last_imds_v2_access_time	LAST_IMDS_V2_ACCESS
ApiCatalogAssetResource.private_ip_addresses	PRIVATE_IP_ADDRESSES
ApiCatalogAssetResource.protected_by	PROTECTED_BY
ApiCatalogAssetResource.public_ip_addresses	PUBLIC_IP_ADDRESSES
ApiCatalogAssetResource.region	REGION
ApiCatalogAssetResource.resource_type	RESOURCE_TYPE
ApiCatalogAssetResource.sensitive_data_at_rest / sensitive_data_in_transit	HAS_SENSITIVE_DATA
ApiCatalogAssetResource.sensitive_data_at_rest.has_pci	HAS_PCI_AT_REST
ApiCatalogAssetResource.sensitive_data_at_rest.has_phi	HAS_PHI_AT_REST
ApiCatalogAssetResource.sensitive_data_at_rest.has_pii	HAS_PII_AT_REST
ApiCatalogAssetResource.sensitive_data_in_transit.has_pci	HAS_PCI_IN_TRANSIT
ApiCatalogAssetResource.sensitive_data_in_transit.has_phi	HAS_PHI_IN_TRANSIT
ApiCatalogAssetResource.sensitive_data_in_transit.has_pii	HAS_PII_IN_TRANSIT
ApiCatalogAssetResource.status	STATUS
ApiCatalogAssetResource.status	ASSET_STATUS
ApiCatalogAssetResource.sub_category	SUB_CATEGORY
ApiCatalogAssetResource.tags	TAGS
ApiCatalogAssetResource.technologies[].category	TECHNOLOGY_CATEGORIES
ApiCatalogAssetResource.technologies[].name	TECHNOLOGIES
ApiCatalogAssetResource.technologies[].sub_category	TECHNOLOGY_SUB_CATEGORIES
ApiCatalogAssetResource.technologies[].version	TECHNOLOGY_VERSIONS
ApiCatalogAssetResource.vulnerability_risk.critical_count	CRITICAL_VULNERABILITY_COUNT
ApiCatalogAssetResource.vulnerability_risk.high_count	HIGH_VULNERABILITY_COUNT
ApiCatalogAssetResource.vulnerability_risk.low_count	LOW_VULNERABILITY_COUNT
ApiCatalogAssetResource.vulnerability_risk.medium_count	MEDIUM_VULNERABILITY_COUNT
ApiCatalogAssetResource.vulnerability_risk.total_count	TOTAL_VULNERABILITY_COUNT
ApiCatalogAssetResource.vulnerability_risk.unclassified_count	UNCLASSIFIED_VULNERABILITY_COUNT

Vulnerability

Source Field Name	SDM Attribute
*(sync time)*	LAST_CAPTURED
VulnerabilityFindingResource.first_seen_time	FIRST_SEEN
VulnerabilityFindingResource.id	UID
VulnerabilityFindingResource.image.digest	DIGEST
VulnerabilityFindingResource.image.name	IMAGE_NAME
VulnerabilityFindingResource.image.os_name	OPERATING_SYSTEM
VulnerabilityFindingResource.image.os_version	OS_VERSION
VulnerabilityFindingResource.image.tag	IMAGE_TAG
VulnerabilityFindingResource.image.uri	IMAGE
VulnerabilityFindingResource.last_scan_time	LAST_SCANNED
VulnerabilityFindingResource.package.framework	PACKAGE_FRAMEWORK
VulnerabilityFindingResource.package.in_use	IN_USE
VulnerabilityFindingResource.package.introduced_by_layers[].layer_index	LAYER_INDEXES
VulnerabilityFindingResource.package.introduced_by_layers[].layer_sha	INTRODUCED_BY_LAYERS
VulnerabilityFindingResource.package.introduced_by_layers[].layer_sha	CONTAINER_LAYERS
VulnerabilityFindingResource.package.name	PACKAGE_NAME
VulnerabilityFindingResource.package.type	PACKAGE_TYPE
VulnerabilityFindingResource.package.version	PACKAGE_VERSION
VulnerabilityFindingResource.remediation[].data.fixed_in_version	FIXED_VERSION
VulnerabilityFindingResource.resource.cloud_account_id	CLOUD_ACCOUNT_ID
VulnerabilityFindingResource.resource.cloud_account_name	CLOUD_ACCOUNT_NAME
VulnerabilityFindingResource.resource.cloud_provider	CLOUD_PROVIDER
VulnerabilityFindingResource.resource.cluster_id	CLUSTER_ID
VulnerabilityFindingResource.resource.cluster_name	CLUSTER_NAME
VulnerabilityFindingResource.resource.external_id	EXTERNAL_ID
VulnerabilityFindingResource.resource.id	RESOURCE_ID
VulnerabilityFindingResource.resource.internet_exposure.ingress.active_communication	INTERNET_EXPOSED
VulnerabilityFindingResource.resource.namespace	NAMESPACE
VulnerabilityFindingResource.resource.region	REGION
VulnerabilityFindingResource.resource.risk_categories + cloud_account_tags	TAGS
VulnerabilityFindingResource.resource.type	RESOURCE_TYPE
VulnerabilityFindingResource.resource.upwind_asset_id	TARGETS
VulnerabilityFindingResource.source	SOURCE
VulnerabilityFindingResource.status	PROVIDER_STATUS
VulnerabilityFindingResource.status	SOURCE_STATUS
VulnerabilityFindingResource.vulnerability (definition key)	TYPE
VulnerabilityFindingResource.vulnerability.nvd_cve_id / .name + resource.name	NAME

Vulnerability Definition

Source Field Name	SDM Attribute
*(constant)*	CATEGORIES
*(sync time)*	LAST_CAPTURED
CVE key (nvd_cve_id / name)	UID
CveResource.cve_first_seen_time	FIRST_SEEN
CveResource.description / CveResource.nvd_description	DESCRIPTION
CveResource.epss_score	EPSS_SCORE
CveResource.epss_severity	EPSS_SEVERITY
CveResource.exploitable	EXPLOITABLE
CveResource.exploitable_functions_in_use[].container_id	CONTAINER_IDS
CveResource.exploitable_functions_in_use[].container_name	CONTAINER_NAMES
CveResource.exploitable_functions_in_use[].file_path	EXPLOITABLE_FUNCTION_FILES
CveResource.exploitable_functions_in_use[].function_name	EXPLOITABLE_FUNCTIONS
CveResource.exploitable_functions_in_use[].last_detection_time (max)	EXPLOITABLE_FUNCTION_LAST_DETECTED
CveResource.exploitable_functions_in_use[].origin_library_id	ORIGIN_LIBRARY_IDS
CveResource.exploitable_functions_in_use[].process_id	PROCESS_IDS
CveResource.exploitable_functions_in_use[].process_name	EXPLOITABLE_FUNCTION_PROCESSES
CveResource.nvd_cve_id	CVE_IDS
CveResource.nvd_cve_id	CVE_RECORDS
CveResource.nvd_cve_id / CveResource.name	NAME
CveResource.nvd_cvss_v2_score	CVSS_V2_BASE_SCORE
CveResource.nvd_cvss_v2_severity	CVSS_V2_SEVERITY
CveResource.nvd_cvss_v3_score	CVSS_V3_BASE_SCORE
CveResource.nvd_cvss_v3_severity	CVSS_V3_SEVERITY
CveResource.nvd_cvss_v3_severity / v4 / v2 / epss_severity	SOURCE_SEVERITY
CveResource.nvd_cvss_v4_score	CVSS_V4_BASE_SCORE
CveResource.nvd_cvss_v4_severity	CVSS_V4_SEVERITY
CveResource.nvd_publish_time	PUBLISHED_DATE
CveResource.sbom_artifact_locations	SBOM_LOCATIONS
derived from CVSS v3 / EPSS severity	TAGS
derived from CVSS/EPSS severity	SEVERITY
derived from normalized severity	SEVERITY_SCORE

Violation

Source Field Name	SDM Attribute
*(sync time)*	LAST_CAPTURED
ApiConfigurationFindingResource.evaluation_time	LAST_SEEN
ApiConfigurationFindingResource.first_seen_time	FIRST_SEEN
ApiConfigurationFindingResource.id	UID
ApiConfigurationFindingResource.resource.upwind_asset_id	TARGETS
ApiConfigurationFindingResource.risk_categories + ApiConfigurationResourceResource.cloud_account_tags	TAGS
ApiConfigurationFindingResource.rule (definition key)	TYPE
ApiConfigurationFindingResource.rule.description	DESCRIPTION
ApiConfigurationFindingResource.status	PROVIDER_STATUS
ApiConfigurationFindingResource.status	SOURCE_STATUS
ApiConfigurationFindingResource.title	NAME
ApiConfigurationResourceResource.arn	ARN
ApiConfigurationResourceResource.cloud_account_id	CLOUD_ACCOUNT_ID
ApiConfigurationResourceResource.cloud_account_name	CLOUD_ACCOUNT_NAME
ApiConfigurationResourceResource.cloud_provider_name	CLOUD_PROVIDER
ApiConfigurationResourceResource.cluster_id	CLUSTER_ID
ApiConfigurationResourceResource.id	RESOURCE_ID
ApiConfigurationResourceResource.name	RESOURCE_NAME
ApiConfigurationResourceResource.namespace	NAMESPACE
ApiConfigurationResourceResource.region	REGION
ApiConfigurationResourceResource.sync_time	LAST_SCANNED
ApiConfigurationResourceResource.type	RESOURCE_TYPE

Violation Definition

Source Field Name	SDM Attribute
*(constant)*	CATEGORIES
*(sync time)*	LAST_CAPTURED
ApiConfigurationFindingResource.framework.title	TAGS
ApiConfigurationFindingResource.rule.description	DESCRIPTION
ApiConfigurationFindingResource.rule.remediation	RECOMMENDATION
ApiConfigurationFindingResource.rule.title	NAME
ApiConfigurationFindingResource.severity	SOURCE_SEVERITY
ApiConfigurationFindingResource.severity (normalized)	SEVERITY
ApiConfigurationFrameworkResource.cloud_provider_name	CLOUD_PROVIDER
ApiConfigurationFrameworkResource.description	FRAMEWORK_DESCRIPTION
ApiConfigurationFrameworkResource.id	FRAMEWORK_ID
ApiConfigurationFrameworkResource.revision	REVISION
ApiConfigurationFrameworkResource.status	FRAMEWORK_STATUS
ApiConfigurationFrameworkResource.version	FRAMEWORK_VERSION
derived from normalized severity	SEVERITY_SCORE
derived from rule key (rule.id / rule.title)	UID
DetailedFrameworkResource.create_time	FRAMEWORK_CREATE_TIME
DetailedFrameworkResource.framework_rollout_state	FRAMEWORK_ROLLOUT_STATE
DetailedFrameworkResource.framework_type	FRAMEWORK_TYPE
DetailedFrameworkResource.is_enabled	FRAMEWORK_ENABLED
DetailedFrameworkResource.last_evaluation_time	FRAMEWORK_LAST_EVALUATION
DetailedFrameworkResource.platforms	FRAMEWORK_PLATFORMS
DetailedFrameworkResource.score	FRAMEWORK_COMPLIANCE_SCORE
DetailedFrameworkResource.state	FRAMEWORK_STATE
DetailedFrameworkResource.update_time	FRAMEWORK_UPDATE_TIME

Alert

Source Field Name	SDM Attribute
*(sync time)*	LAST_CAPTURED
category	CATEGORIES
derived from normalized severity	SEVERITY_SCORE
description	DESCRIPTION
first_seen_time (events fall back to event_time)	FIRST_SEEN
last_seen_time (events fall back to event_time)	LAST_SEEN
mitre_attacks[].tactic_name/technique_name/tactic_id/technique_id (detections); resource.risk_categories + cloud_account_tags (both)	TAGS
resource.cloud_account_id	CLOUD_ACCOUNT_ID
resource.cloud_account_name	CLOUD_ACCOUNT_NAME
resource.cloud_provider	CLOUD_PROVIDER
resource.cluster_id	CLUSTER_ID
resource.cluster_name	CLUSTER_NAME
resource.external_id	EXTERNAL_ID
resource.id	RESOURCE_ID
resource.internet_exposure.ingress.active_communication	INTERNET_EXPOSED
resource.namespace	NAMESPACE
resource.region	REGION
resource.type	RESOURCE_TYPE
resource.upwind_asset_id	TARGETS
severity	SOURCE_SEVERITY
severity (normalized)	SEVERITY
status	PROVIDER_STATUS
status	SOURCE_STATUS
ThreatDetectionResource.id / ThreatEventResource.id	UID
ThreatDetectionResource.occurrence_count	OCCURRENCE_COUNT
ThreatDetectionResource.title / ThreatEventResource.title	NAME
ThreatDetectionResource.triggers[0].policy_id	TYPE
ThreatDetectionResource.triggers[0].policy_name	POLICY_NAME
ThreatEventResource.event_type	EVENT_TYPE
type	THREAT_TYPE

Alert Definition

Source Field Name	SDM Attribute
*(sync time)*	LAST_CAPTURED
derived from normalized severity	SEVERITY_SCORE
ThreatPolicyResource.category	CATEGORIES
ThreatPolicyResource.display_name	NAME
ThreatPolicyResource.enabled	ENABLED
ThreatPolicyResource.id	UID
ThreatPolicyResource.managed_by	MANAGED_BY
ThreatPolicyResource.open_issues	OPEN_ISSUES
ThreatPolicyResource.scope	SCOPE
ThreatPolicyResource.severity	SOURCE_SEVERITY
ThreatPolicyResource.severity (normalized)	SEVERITY

Story

Source Field Name	SDM Attribute
*(sync time)*	LAST_CAPTURED
derived from normalized severity	SEVERITY_SCORE
StoryResource.create_time	SOURCE_CREATED_DATE
StoryResource.description	DESCRIPTION
StoryResource.detection_ids	RELATES_TO
StoryResource.id	UID
StoryResource.severity	SOURCE_SEVERITY
StoryResource.severity (normalized)	SEVERITY
StoryResource.status	PROVIDER_STATUS
StoryResource.status	SOURCE_STATUS
StoryResource.title	NAME
StoryResource.update_time	SOURCE_LAST_MODIFIED

Api Endpoint

Source Field Name	SDM Attribute
*(constant)*	STATUS
*(constant)*	CATEGORIES
*(sync time)*	LAST_CAPTURED
ApiEndpointResource.domains	DOMAINS
ApiEndpointResource.first_seen_time	FIRST_SEEN
ApiEndpointResource.id	UID
ApiEndpointResource.last_seen_time	LAST_SEEN
ApiEndpointResource.method	HTTP_METHOD
ApiEndpointResource.resource_id	RESOURCE_ID
ApiEndpointResource.risk_overview.authentication.state	REQUIRES_AUTH
ApiEndpointResource.risk_overview.internet_exposure.ingress.last_seen_time	INTERNET_INGRESS_LAST_SEEN
ApiEndpointResource.risk_overview.sensitive_data_findings[].category	SENSITIVE_DATA_CATEGORIES
ApiEndpointResource.risk_overview.sensitive_data_findings[].type	SENSITIVE_DATA_TYPES
ApiEndpointResource.status_codes	STATUS_CODES
ApiEndpointResource.uri	NAME
ApiEndpointResource.uri	PATH

Person

Source Field Name	SDM Attribute
*(constant)*	CATEGORIES
*(sync time)*	LAST_CAPTURED
ApiMemberResource.create_time	FIRST_SEEN
ApiMemberResource.email	EMAIL
ApiMemberResource.id	UID
ApiMemberResource.identity_provider_name	IDENTITY_PROVIDER
ApiMemberResource.member_name	NAME
ApiMemberResource.permissions[].group_id	PERMISSION_GROUPS
ApiMemberResource.permissions[].role_ids	ROLES
ApiMemberResource.permissions[].scope_id	SCOPE_IDS
ApiMemberResource.permissions[].scope_name	SCOPES
ApiMemberResource.permissions[].source	PERMISSION_SOURCES

Team

Source Field Name	SDM Attribute
*(sync time)*	LAST_CAPTURED
ApiGroupResource.create_time	FIRST_SEEN
ApiGroupResource.id	UID
ApiGroupResource.identity_provider_name	IDENTITY_PROVIDER
ApiGroupResource.name	NAME
ApiGroupResource.permissions[].role_ids	ROLES
ApiGroupResource.permissions[].scope_id	SCOPE_IDS
ApiGroupResource.permissions[].scope_name	SCOPES
ApiGroupResource.update_time	LAST_SEEN
ApiGroupResource.user_count	USER_COUNT

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Host

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Host on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /v2/organizations/{orgId}/inventory/catalog/assets/search
• Default filters: Match-all search body (id exists)

Vulnerability

Operation options

Option	Type	Default	Description
severity	String	—	Filter by severity
cve-id	String	—	Filter by CVE ID
cloud-account-id	String	—	Filter by cloud account
exploitable	Boolean	—	Filter by exploitability
fix-available	Boolean	—	Filter by fix availability

Delta sync

Not supported. The connector performs a full sync of Vulnerability on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: GET /v1/organizations/{orgId}/vulnerability-findings
• Default filters: None (optional severity, cve-id, cloud-account-id, exploitable, fix-available operation options)

Vulnerability Definition

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Vulnerability Definition on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: GET /v1/organizations/{orgId}/vulnerability-findings
• Default filters: None — definitions are derived from the findings feed and deduplicated by CVE key

Violation

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Violation on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /v2/organizations/{orgId}/configurations/findings/search
• Default filters: Match-all (status in [pass, fail])

Violation Definition

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Violation Definition on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /v2/organizations/{orgId}/configurations/findings/search
• Default filters: Match-all (status in [pass, fail]); definitions are deduplicated by rule key

Alert

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Alert on every run and applies no incremental date filter.

API

• Type: REST
• Default filters: None

note

• Alerts merge threat-detections and threat-events by UID (disjoint id spaces; the newer detection record wins on any overlap). The list endpoint omits triggers, so each detection's detail is fetched per id to obtain triggers[].policy_id for the Alert → Alert Definition link.
• Detection-sourced alerts link to an Alert Definition via TYPE = triggers[].policy_id. Event-sourced alerts carry no policy and are not linked (no TYPE).

---

Alert Definition

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Alert Definition on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: GET /v1/organizations/{orgId}/threat-policies
• Default filters: None

note

• The threat-policies API (ThreatPolicyResource) exposes neither a description nor a tags/framework field, so DESCRIPTION and TAGS are intentionally omitted from this definition.

---

Story

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Story on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: GET /v2/organizations/{orgId}/threats/stories
• Default filters: None

note

• A Story links to its member Alerts via RELATES_TO = detection_ids (the detection UIDs, which are the Alert UIDs). Stories carry no policy/definition and no direct asset on the record, so — unlike classic findings — they set neither TYPE (no Incident Definition) nor TARGETS. DESCRIPTION is populated only from the story detail endpoint (the list response omits it). Stories are full-pulled (the endpoint accepts no time filter).

---

Api Endpoint

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Api Endpoint on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: GET /v1/organizations/{orgId}/apisecurity-endpoints
• Default filters: None

Person

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Person on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /v2/organizations/{orgId}/access-management/members/search
• Default filters: Match-all (create_time gt 1970-01-01T00:00:00Z) — the members search only allows eq/in/gt/lt (no exists)

Team

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Team on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /v2/organizations/{orgId}/access-management/groups/search
• Default filters: Match-all (create_time gt 1970-01-01T00:00:00Z) — the groups search only allows eq/in/gt/lt (no exists)

Changelog

Changelog

The Upwind connector has undergone the following changes:

Version	Description	Migration Steps
3.0.0	Overview The Upwind connector integrates with Upwind Security to synchronize cloud resources, vulnerability, configuration, and runtime threat findings along with their definitions, API endpoints, and cloud identities. Category: Cloud Security Models	N/A