BitSight Connector
BitSight is a comprehensive security ratings platform that provides organizations with data-driven insights into cybersecurity performance. By continuously monitoring and analyzing vast amounts of external security data, BitSight generates objective, quantifiable ratings that help businesses evaluate their own security posture and assess third-party risk across their supply chain. This visibility enables more informed security decisions, facilitates vendor risk management, and strengthens cyber resilience through benchmarking against industry peers and competitors.
What is the BitSight API Connector?
The BitSight API Connector creates a secure bridge between your BitSight platform and Qualys ETM. The API-based connector facilitates regular data retrieval, enabling quicker, data-driven remediation. When configured, it automatically transfers asset inventory and findings of patching cadence through scheduled API calls. Qualys ETM then processes this data by:
- Deduplicating redundant entries
- Normalizing data formats
- Enriching findings with additional context
- Calculating risk scores using TruRisk
| Category | Supported Asset Type | Supported Finding Type |
|---|---|---|
| API Connector | Host Asset | Vulnerability |
Prerequisites
These are the required configurations to successfully create a BitSight connection for Qualys ETM.
User Roles and Permissions
The BitSight user authenticating themselves for the connection must have Reader permissions.
You need the following BitSight API Access information to configure the connection:
- API URL
- BitSight API Token
API URL
You require an API URL to authenticate yourself while creating the connector. Use the following default API URL - https://api.bitsighttech.com/
BitSight API Token
You must generate a Bitsight token to authenticate yourself. To create a user token, perform the following.
-
Log in to your organization's BitSight portal as an administrator.
-
Navigate to Settings > Account > User API Token and click Generate New Token.
-
Copy the generated token and securely store it for later use.
Create a New BitSight Connector
- Provide the Connector's Name and Description.
- Select the type of findings you want to import or export - currently, we support Vulnerability.
- Select the Asset Type - currently we support Host Asset.
The following screenshot displays the Basic Details fields.
-
Next, provide the API authentication details of the BitSight environment. You need to provide the following.
User Token: Enter the BitSight user token created by following the steps in the Prerequisites section for authentication. - Click Test Connection and once succesful, click Next to proceed.
The BitSight API Connector offers an out-of-box data model mapping for you to map with Qualys ETM schema. You can view the schema to understand the attributes in the data model.
Map the fields from the CSV file to the corresponding fields in your target system. Transform Maps ensure the data is transformed correctly during the import or export process.
The BitSight Connector offers an out-of-box transform map for you to proceed without further configuration. View the map to understand the data transformation or clone the map to edit its configurations.
Click Create New for a new Transform Map.
Perform the following steps to configure a Transform Model:
- Transform Map Name: Enter a unique name for the Transform Map. This name helps identify the specific transformation configuration within this connector.
- Source Data Model: Select the data model that serves as the input for the transformation. This is the model from which data will be extracted.
- Target Data Model: Choose the data model that receives the transformed data. This model defines how the data will be structured after the transformation.
Refer the following Transform Map screenshot:
Create a profile for your connector. A profile decides the connector status, execution schedule and transform map to choose. The connector follows the configurations of this profile for all future executions.
Click the "+" to create a new profile.
In the Add Profile screen, provide the necessary inputs for your new profile.
Provide a Name and Description.
Select the required Transform Map for the data mapping.
The Filter field let's you add snippets of code to further determine what data should be parsed.
The Status field determines whether the connector should be in Active or Inactive state after creation.
Lastly, the Schedule section lets you either create a Single Occurrence schedule or a Recurring schedule. Provide the exact date and time for the Single Occurence execution and provide the Start and End date/time for the Recurring schedule
The Scoring screen lets you map non-CVE vulnerability scores from your vendors to Qualys Detection Score (QDS) system.
You have two columns with 5 input fields in each of them. These fields correspond to a specific severity starting from the least severe (1), to the most severe (5).
Fill out all 5 rows to create a comprehensive score mapping. This allows for translation between various vendor scoring systems and Qualys' Detection Score.
The specifics of the mapping is explained below.
Expected Source Values - Enter the vendor's original score or rating for non-CVE vulnerabilities.
This can be alphanumeric values. (e.g., "High", "Critical", "A", "3", etc.).
Severity - This column is pre-populated with severity levels from 1-5. These represent the severity levels in Qualys. The Source Value must be mapped such that it utilizes these 5 severity levels.
QDS - Enter the corresponding Qualys Detection Score. Use values from 0-100, where higher numbers indicate higher severity.
Default Severity
Below the scoring map, find the 'Default Severity' dropdown menu.
Select a default severity level from 1-5, this is applied when a vendor's score for a non-CVE vulnerability doesn't match any 'Expected Source Value' in your mapping table.
Select Identification RulesSelect Identification Rules
The Identification Rules are a set of out-of-the-box precedence rules set by Qualys CSAM. The connector discovers findings based on the order set by the selected Identification Rules.
You can proceed to the next step without making any changes to this screen.
If you don't want to choose a specific rule, turn off the toggle next to it. But, ensure that at least one rule is selected.
To learn more about the different rules and options present in this screen, refer to the CSAM Online Help.
How Does a Connection Work?
The BitSight connector functions through configured profiles that determine what data gets synchronized and when.
A Connection usually involves creating a profile that defines which vulnerabilities to import based on detection data types and asset types. The connector then automatically executes according to the schedule (or on-demand), pulling vulnerability data from BitSight into Qualys ETM where it can be viewed alongside other security findings.
With the BitSight API Connector successfully configured, you are almost ready to view all the assets and findings from BitSight.
In the Connector screen, you can find your newly configured connector listed and marked in the Processed state.
Connector States
A successfully configured connector goes through 4 states.
- Registered - The connector is successfully created and registered to fetch data from the vendor.
- Scheduled - The connector is scheduled to execute a connection with the vendor.
- Processing - A connection is executed and the connector is fetching the asset and findings data.
- Processed - The connector has successfully fetched the assets, it may still be under process of fetching the findings. Wait for some more time for the connector to fetch the findings completely.
The Processed state indicates that the Connector is successfully configured but it is under the process of importing all your assets and findings. This process (specifically for findings) may take some time.
This entire process may take up to 2 hours for completion. Once, it is done. You can find the imported data in Enterprise TruRisk Management (ETM).
View Assets and Findings in ETM
Navigate to Enterprise TruRisk Management to get started with analyzing your Connector's vulnerability findings.
You can view the assets imported from the BitSight connection by navigating to Inventory tab of ETM.
Go to Assets > Host to find all of your imported assets.
Use the token, tags.name: "BitSight" to view all the imported Bitsight assets.
Here, you can learn about the criticality of your assets and their Risk Scores. Click any of the asset to find more details about them.
Next, you can navigate to the Risk Management tab to view your vulnerability findings.
Go to Findings > Vulnerability to view all the discovered vulnerabilities.
Use the token, finding.vendorProductName: `Bitsight` to view all the discovered Bitsight vulnerabilities.
To know more about how the BitSight API Connector leverages the findings, refer to the Qualys ETM Documentation.
Additional Resources
Additional Information related to BitSight Connector.
API Reference
Here are the APIs executed for the BitSight connection.
|
Name |
Filters |
Endpoint |
|---|---|---|
|
Auth API |
N/A | https://auth.app.wiz.io/oauth/token |
|
Fetch Portfolio |
Finding Type: patching cadence |
https://api.bitsighttech.com/ratings/v2/portfolio/ |
| Fetch Companies |
https://api.bitsighttech.com/ratings/v1/companies/ |
The BitSight connector currently only fetch the finding type patching_cadence from the BitSight platform.
Data Model Map
This section explains the attribute mappings of the values from BitSight and Qualys ETM.
Bitsight Vulnerability Transformation Map
| Source Attribute Key | Target Attribute Label |
|---|---|
| assets.asset | externalAssetId (Required) |
| details.vulnerabilities[].name | findingName (Required) |
| temporary_id | externalFindingId (Required) |
| severity_category | findingSeverity (Required) |
| assets.asset | assetName (Required) |
| details.vulnerabilities[].cvss.base | cvss3Base |
| evidence_key | detectionResult |
| first_seen | findingFirstFoundOn |
| last_seen | findingLastFoundOn |
| risk_vector | findingType |
| assets.ip_addresses[] | ipAddress |
| details.vulnerabilities[].remediation_tip | remediationStrategy |
| details.vulnerabilities[].name | cveId |
| details.vulnerabilities[].description | findingDescription |
|
vulnerabilityConfidence HIGH | LOW | MEDIUM |
findingSubType Confirmed | Information | Potential |