JFrog Artifactory & Xray Connector

Security teams operating in software-driven environments often lack visibility into vulnerabilities embedded within the artifacts, packages, and container images that make up their software supply chain. The JFrog Artifactory and Xray Connector brings that visibility into Qualys Enterprise TruRisk Management by ingesting Artifactory inventory & software composition analysis findings from Xray's binary-level scans into a centralized risk platform. This allows practitioners to correlate application-layer vulnerabilities discovered in build artifacts and container images with the broader asset inventory already tracked in Qualys ETM. By consolidating software supply chain risk alongside cloud and endpoint security data, security teams can prioritize remediation based on true organizational risk rather than managing findings in isolation across separate toolchains.

Qualys ETM is compatible with JFrog Artifactory and JFrog Xray. JFrog is not affiliated with or endorsing this integration.

Connector Details

The following table provides a comprehensive overview of what the JFrog Artifactory & Xray Connector supports.

Connection Settings

User Roles and Permissions

The JFrog Artifactory & Xray Connector requires an access token with administrative scope to retrieve asset and vulnerability data from Artifactory and Xray APIs.

To generate an access token in JFrog:

1. Log in to your JFrog instance.
2. Navigate to Administration > User Management > Access Tokens.
   
3. Click Generate Token.
4. Provide a token description and set the expiry as required.
5. Set Token Scope to Admin.
6. Under Services, select All or select both Artifactory and Xray.
7. Click Generate and copy the token value. This value is shown only once.
   

The following permission is required:

Authentication Details

Provide the following credentials in the connector configuration screen:

Connector Configuration

Basic Details

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integration tab and locate the JFrog Artifactory & Xray Connector from the Connector Marketplace.
3. Next, to the JFrog connector tile, click Manage from the ellipses menu.
4. Provide a Name and Description for the connector.
5. Select the supported findings type: Vulnerability / Host Asset.
6. Enter the Domain Name and API Token.

Mapping Details

Data Model

The JFrog Artifactory & Xray Connector provides out-of-the-box data model mappings for the following asset types: container images (Docker) and binary repositories. Vulnerability findings are supported for container image assets. View the models in ETM to see all supported fields.

Transform Maps

Default transform maps are provided for each asset and findings type. Transform maps can be created or cloned to customize field transformations.

1. Click Create New to add a new transform map.
2. Provide a Transform Map Name, select a Source Data Model, and select a Target Data Model.
3. Save the map.
4. Alternatively, use Clone from the quick menu to copy and adjust an existing default transform map.

Data Model Mapping – Container Image (Docker Image) Asset Transformation

Data Model Mapping – Binary Repository (Application) Asset Transformation

Data Model Mapping – Container Image Vulnerability Transformation

Schedule

Schedules control the execution of the connector, including scheduling and the data types that are synchronized.

1. Click + to add a new profile.
2. Provide a Name and Description.
3. Select the required Transform Map.
4. Select the findings type: Asset and/or Vulnerability.
5. Set Status to Active or Inactive.
6. Configure a Schedule: select Single Occurrence or Recurring, then set the start and end date and time.
7. Click Next to proceed.

How Does a Connection Work?

The JFrog Artifactory & Xray Connector executes on a configured schedule or on demand, based on the active profile. On each execution, the connector authenticates to the JFrog REST API using the configured domain and access token, fetches the list of repositories and container images, retrieves vulnerability data from JFrog Xray for each asset, applies the configured transform map, and imports the results into ETM.

Each execution performs a full pull. Incremental (delta) synchronization is not supported. The connector transitions through the following states during execution:

1. Registered – The connector has been created and registered to fetch data from JFrog.
2. Scheduled – The connector is queued for its next execution.
3. Processing – The connector is actively fetching asset and findings data from JFrog.
4. Processed – Asset data has been fetched successfully. Findings processing may still be in progress; allow additional time for findings to appear in ETM.

The Processed state indicates the connector completed its asset fetch. Full import of assets and findings, particularly for large environments, may take up to 2 hours. Once complete, the imported data is available in ETM.

In the Connector screen, the configured connector will appear with the state Processed once execution completes.

Viewing Assets and Findings in ETM

After a successful run, JFrog assets and findings appear in ETM as follows:

• Assets: Navigate to Inventory > Assets. Select the relevant asset type (for example, Container Image or Repository). Filter with tags.name:"JFrog Artifactory & Xray" to list assets imported from this connector.
  
• Findings: Navigate to Risk Management > Findings > Vulnerability. Filter with finding.vendorProductName:"JFrog Artifactory & Xray" to list vulnerability findings from this connector.
  

API Endpoints

The connector uses the following JFrog REST API endpoints to retrieve data.

Fetch asset list

Fetch asset details and vulns