Invicti Connector

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

Invicti (formerly Netsparker) is a web application security platform that performs Dynamic Application Security Testing (DAST) on websites, web applications, and APIs.

The following steps allow you to configure this connector for use with Tenable Exposure Management from start to finish.

Tip: For more information on how third-party integrations work, see Connectors.

Connector Details

Tenable Exposure Management ingests Invicti web application assets and vulnerability findings through the Invicti Platform Inventory API.

Details Description

Supported products

Invicti Application Security Platform (Enterprise)

Available in the US, EU, and CA cloud regions, and on-premises through a custom platform URL.

Category

Dynamic Application Security Testing (DAST)
Ingested data Assets and Findings

Ingested Asset Classes

Web Application

Integration type

UNI directional (data is transferred from the connector to Tenable Exposure Management in one direction)

Supported version and type

Invicti Application Security Platform (cloud), with US, EU, and CA regions, plus custom on-premises instances

Prerequisites and User Permissions

Before you begin configuring the connector, make sure to:

  1. Confirm that you have an Invicti Platform user account.

  2. Generate an Invicti API key.

Generate an Invicti API key

Generate an API key for a user account that has read access to the Inventory (assets) and Vulnerabilities endpoints for the targets you want to sync.

  1. Log in to the Invicti Platform.

  2. Go to your user Profile > API Settings.

  3. Generate the API key.

  4. Copy the key value to a safe location. You need it to configure the connector.

Add a Connector

To add a new connector:

  1. In the left navigation menu, click Connectors.

    The Connectors page appears.

  2. In the upper-right corner, click Add new connector.

    The Connector Library page appears.

  3. In the search box, type the name of the connector.

  4. On the tile for the connector, click Connect.

    The connector configuration options appear.

Configure the Connector

To configure the connector:

  1. (Optional) In the Connector's Name text box, type a descriptive name for the connector.

  2. (Optional) To use a preconfigured on-prem connector to connect to this connector, from the Gateway drop-down, select the on-prem connector you want to use for the connector. Otherwise, select Don't use gateway.

    Note: For information about configuring a gateway, see Tenable On-Prem Connector.

  3. In the API Token text box, type the Invicti API key that you generated.

  4. From the Platform Region drop-down, select the region of your Invicti instance: US, EU, CA, or Custom / On-prem.

  5. If you select Custom / On-prem, in the Custom Platform URL text box, type the base URL of your Invicti instance, for example, https://invicti.example.com.

  6. Data pulling configuration: This configuration has dynamic settings tailored to the specific connector and integration type. Below are the configurations relevant to this connector.

    • Select the Fetch Vulnerabilities checkbox to ingest findings. Clear the checkbox to sync assets only.

    • In the Asset Retention text box, type the number of days after which you want assets to be removed from Tenable Exposure Management. If an asset has not been detected or updated within the specified number of days, it is automatically removed from the application, ensuring your asset inventory is current and relevant.

      Tip: For more information, see Asset Retention.

  7. In the Test connectivity section, click the Test Connectivity button to verify that Tenable Exposure Management can connect to your connector instance.

    • A successful connectivity test confirms that the platform can connect to the connector instance. It does not, however, guarantee that the synchronization process will succeed, as additional syncing or processing issues may arise.

    • If the connectivity test fails, an error message with details about the issue appears. Click Show tests for more information about the exact error.

  8. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

    Tip: For more information, see Connector Scheduling.

  9. Click Create. Tenable Exposure Management begins syncing the connector. The sync can take some time to complete.

  10. To confirm the sync is complete, do the following:

Invicti in Tenable Exposure Management

Locate Connector Assets in Tenable Exposure Management

As the connector discovers assets, Tenable Exposure Management ingests those devices for reporting.

To view assets by connector:

  1. In Tenable Exposure Management, navigate to the Assets page.

  2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view assets.

    The asset list updates to show only assets from the selected connector.

  3. Click on any asset to view Asset Details.

Locate Connector Findings in Tenable Exposure Management

As the connector discovers individual findings, Tenable Exposure Management ingests those findings for reporting.

To view findings by connector:

  1. In Tenable Exposure Management, navigate to the Findings page.

  2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view findings.

    The findings list updates to show only assets from the selected connector.

  3. Click on any asset to view Finding Details.

Data Mapping

Tenable Exposure Management integrates with the connector via API to retrieve relevant weakness and asset data, which is then mapped into the Tenable Exposure Management system. The following tables outline how fields and their values are mapped from the connector to Tenable Exposure Management.

Web Application Mapping

Tenable Exposure Management UI Field

Invicti Field
Asset Id id
Asset Name

name

assetDetail.url
External Tags

tags

Business Impact: {businessImpact}

Target Type: {assetDetail.targetType}
First Seen createdAt
Last Seen lastScanDate
Asset Custom Attributes

assetType

environmentId

isDemo

Finding Mapping

Tenable Exposure Management UI Field

Invicti Field
Finding Name name
Description name
CVEs classification.cve
CVSS Score

score.cvss3.score

score.cvss2.score
State status
First Seen firstSeen
Last Seen lastSeen

Finding Status Mapping

Tenable Exposure Management Status

Invicti Status

Fixed

closed

Active

Any other value (for example, open or present)

Finding Severity Mapping

Tenable Exposure Management Severity

Invicti Score

Critical

CVSS: 9.0 - 10.0

High

CVSS: 7.0 - 8.9

Medium

CVSS: 4.0 - 6.9

Low

CVSS: 0.1 - 3.9

None

CVSS: 0.0

Note: Tenable derives the finding severity from the CVSS score. The connector uses the score.cvss3.score field first, falls back to score.cvss2.score, and uses 0 when neither is present.

Status Update Mechanisms

Every day, Tenable Exposure Management syncs with the vendor's platform to receive updates on existing findings and assets and to retrieve new ones (if any were added).

The table below describes how the status update mechanism works in the connector for findings and assets ingested into Tenable Exposure Management.

Update Type in Tenable Exposure Management

Mechanism (When?)

Archiving Assets

  • Asset that appears in Tenable Exposure Management and isn't returned on the next connector's sync (for example, when a target is deleted or deactivated in Invicti).

  • Asset not seen for X days according to "Last Seen". See Asset Retention

Change a Finding status from "Active" to "Fixed"

  • The vulnerability status changes to closed on the vendor's side.
Note: Updates on the vendor side are reflected in Tenable Exposure Management only when the next scheduled connector sync time is complete (once a day).

Uniqueness Criteria

Tenable Exposure Management uses defined uniqueness criteria to determine whether an ingested asset or finding should be recognized as a distinct record. These criteria help define how assets and findings are identified and counted from each connector.

Tip: To learn more about data deduplication and uniqueness criteria, See Third-Party Data Deduplication in Tenable Exposure Management.

The uniqueness criteria for this connector are as follows:

Data

Uniqueness Criteria

Asset

id (the Invicti asset id)

Vulnerability

id (the Invicti vulnerability id)

Finding

The vulnerability id related to its asset through assetId

API Endpoints in Use

API version: Invicti Platform Inventory API v1.

API

Use in Tenable Exposure Management

Permissions required

GET /api/inventory/v1/assets

Fetches the web application inventory as assets.

API key with Inventory read access

GET /api/inventory/v1/vulnerabilities

Fetches vulnerabilities as findings related to assets (when Fetch Vulnerabilities is enabled).

API key with Vulnerabilities read access

Data Validation

This section shows how to validate and compare data between Tenable Exposure Management and Invicti.

Asset Data Validation

Objective: Ensure the number of assets in the Invicti inventory aligns with the number of web application assets displayed in Tenable Exposure Management.

In Invicti:

  1. Review the asset inventory returned by the GET /api/inventory/v1/assets endpoint.

    Note the number of assets.

In Tenable Exposure Management:

  1. Locate your connector assets, filtered by Source = Invicti.

  2. Compare the total number of assets between Invicti and Tenable Exposure Management.

Expected outcome: The total numbers returned in Invicti and Tenable Exposure Management should match.

If an asset is not visible in Tenable Exposure Management, check the following conditions:

  • The API key has Inventory read access to the asset.

  • The asset is returned by the assets endpoint.

  • The asset was archived because it did not return in the connector's last sync.

    Tip: To learn more on how assets are archived and findings change status, see Status Update Mechanisms.

Finding Data Validation

Objective: Ensure the number of vulnerabilities in Invicti aligns with the number of findings in Tenable Exposure Management.

In Invicti:

  1. Review the vulnerabilities returned by the GET /api/inventory/v1/vulnerabilities endpoint.

    Note the number of vulnerabilities.

In Tenable Exposure Management:

  1. Locate your connector findings, filtered by Source = Invicti and State = Active.

  2. Compare the total number of findings between Invicti and Tenable Exposure Management.

Expected outcome: The total numbers returned in Invicti and Tenable Exposure Management should match. Only findings that are not in the closed state map to the Active state.

If a finding is missing from Tenable Exposure Management or no longer active, check the following conditions:

  • The Fetch Vulnerabilities checkbox is selected.

  • The vulnerability's assetId resolves to a synced asset.

  • The Vulnerabilities sync step did not fail (for example, an empty result or exhausted retries).

  • The finding is marked as Fixed and appears under the Fixed state on the Findings screen.

    Tip: To learn more on how assets are archived and findings change status, see Status Update Mechanisms.