WhiteHat Sentinel
WhiteHat Sentinel by Synopsys is an application security tool that identifies vulnerabilities across your web applications. You can bring attack vector, dynamic code, and site data from WhiteHat Sentinel into Brinqa to centralize your applications attack surface, thus strengthening your cybersecurity posture.
This document details the information you must provide for the connector to authenticate with WhiteHat Sentinel and how to obtain that information from WhiteHat Sentinel. See create a data integration for step-by-step instructions on setting up the integration.
Required connection settings
When setting up a data integration, select WhiteHat Sentinel from the Connector drop-down list. You must provide the following information to authenticate WhiteHat Sentinel with Brinqa:
-
Service URL: The WhiteHat Sentinel service URL. The default URL is
https://sentinel.whitehatsec.com. -
API Key: The access key associated with the WhiteHat Sentinel account, which must have permissions to log in to the API server and return data.
Generate a WhiteHat Sentinel API key
For the WhiteHat Sentinel connector to access the WhiteHat Sentinel API, you must provide an API key. You can access an existing API key or generate a new one. To obtain an API key, follow these steps:
-
Log in to your organization's WhiteHat Sentinel account.
-
Click My Profile and then the API Key tab.
-
Type your password in the Verify password field and click Authenticate.
The API key displays. If this is your first time requesting an API key, a new key is generated. Click Regenerate API key if you want to replace your existing key.
If you do not have the permissions to create an API key, contact your WhiteHat Sentinel administrator. For additional information, see WhiteHat Sentinel documentation.
Additional settings
The WhiteHat Sentinel connector contains additional options for specific configuration:
-
Page size: The maximum number of records to get per API request. The default setting is 100. It is not recommended to go over 100.
-
Parallel requests: The maximum number of parallel API requests. The default setting is 4.
Types of data to retrieve
The WhiteHat Sentinel connector can retrieve the following types of data from the WhiteHat Sentinel API:
Table 1: Data retrieved from WhiteHat Sentinel
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Attack Vector | No | Not mapped |
| Dynamic Code Finding | Yes | Dynamic Code Finding |
| Dynamic Code Finding Definition | Yes | Dynamic Code Finding Definition |
| Site | Yes | Site |
For detailed steps on how to view the data retrieved from WhiteHat Sentinel in the Brinqa Platform, see How to view your data.
Attribute mappings
Click the tabs below to view the mappings between the source and the Brinqa data model attributes.
- Dynamic Code Finding
- Dynamic Code Finding Definition
- Site
Table 2: Dynamic Code Finding attribute mappings
| Source Field Name | Maps to Attribute |
|---|---|
| accepted | Local variable |
| category | categories |
| cvssBaseScore | Use CVSS calculator |
| cvssBaseVector | Use CVSS calculator |
| cvssEnvScore | Use CVSS calculator |
| cvssEnvVector | Use CVSS calculator |
| customRisk | Local variable |
| definitionID | type |
| directRemediationAvailable | patchAvailable |
| firstFound | firstFound |
| impact | Local variable |
| isAccessible | Local variable |
| lastClosed | lastFixed |
| lastFound | lastFound |
| lastModified | sourceLastModified |
| lastRetested | Local variable |
| likelihood | Local variable |
| manual | Local variable |
| outOfScoreReasons | Local variable |
| request | request |
| reason | Local variable |
| response | response |
| retestStatus | status |
| risk | Local variable |
| severity | severity, severityScore |
| siteID | targets, Local variable |
| siteName | Local variable |
| status | status, statusCategory |
| subID | Local variable |
| tags | tags |
| threat | Local variable |
| unreachable | Local variable |
| url | url |
| verificationStatus | status |
| sysID | uid |
Table 3: Dynamic Code Finding Definition attribute mappings
| Source Field Name | Maps to Attribute |
|---|---|
| cvssV3Score | cvssV3BaseScore |
| cvssV3Vector | cvssV3Vector |
| description | description |
| name | name |
| retired | Local variable |
| risk | Local variable |
| solution | recommendation |
| sysID | uid |
| title | Local variable |
Table 4: Site attribute mappings
| Source Field Name | Maps to Attribute |
|---|---|
| applianceID | Local variable |
| associatedHostname | Local variable |
| categories | categories |
| clientID | Local variable |
| hostname | hostname |
| industry | Local variable |
| name | name |
| notes | Local variable |
| organization | Local variable |
| speed | Local variable |
| status | status |
| sysID | uid |
| usesSatellite | Local variable |
| weight | Local variable |
Local variable indicates that the field is processed within a specific context, such as a particular workflow or calculation. Unlike other attributes, local variables aren't mapped to the unified data models (UDM). They only exist on the source data model (SDM).
Use CVSS calculator indicates that the CVSS (Common Vulnerability Scoring System) vectors and scores aren't directly mapped to a specific attribute on the UDM. Instead, a specialized library calculates the CVSS scores from the provided CVSS vector strings.
Operation options
The WhiteHat Sentinel connector supports the following operation options. See connector operation options for information about how to apply them.
Table 5: WhiteHat Sentinel connector operation options
| Connector Object | Option | All Possible Values | Description | Example |
|---|---|---|---|---|
| Attack Vector | status | accepted, certified, closed, open | Retrieve attack vector information based on the specific status as determined by WhiteHat Sentinel. | Key: status Value: accepted. This key and value combination only retrieves attack vector information with a status of accepted. |
| Dynamic Code Finding | status | accepted, closed, invalid, mitigated, out_of_scope | Retrieve findings based on the specified status as determined by WhiteHat Sentinel. | Key: status Value: mitigated This key and value combination only retrieves findings with a status of mitigated. |
The option keys and values are case-sensitive as they are shown in this documentation.
APIs
The WhiteHat Sentinel connector uses the WhiteHat Sentinel API v2. Specifically, it uses the following endpoints:
Table 6: WhiteHat Sentinel API Endpoints
| Connector Object | API Endpoint |
|---|---|
| Attack Vector | GET https://sentinel.whitehatsec.com/api/findings |
GET https://sentinel.whitehatsec.com/api/vuln/{findingId}/attack_vector | |
| Dynamic Code Finding | GET https://sentinel.whitehatsec.com/api/findings |
GET https://sentinel.whitehatsec.com/api/vuln/{findingId}/attack_vector | |
| Dynamic Code Finding Definition | GET https://sentinel.whitehatsec.com/api/vulnerabilityClasses |
| Site | GET https://sentinel.whitehatsec.com/api/v2/sites |
Changelog
The WhiteHat Sentinel connector has undergone the following changes:
3.0.0
- Initial Integration+ release.