Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Detectify - AskJ1 Community
<main> <article class="userContent"> <h2 data-id="detectify-jupiterone-integration-benefits">Detectify + JupiterOne Integration Benefits</h2> <ul><li><p>Visualize Detectify services, domains, subdomains, scan profiles, scan<br> reports, and findings in the JupiterOne graph.</p></li> <li><p>Monitor Detectify findings within the alerts app.</p></li> <li>Monitor changes to Detectify vulnerability scan resources using JupiterOne<br> alerts.</li> </ul><h2 data-id="how-it-works">How it Works</h2> <ul><li><p>JupiterOne periodically fetches vulnerability scan resources from Detectify to<br> update the graph.</p></li> <li><p>Write JupiterOne queries to review and monitor updates to the graph, or<br> leverage existing queries.</p></li> <li><p>Configure alerts to take action when the JupiterOne graph changes, or leverage<br> existing alerts.</p></li> </ul><h2 data-id="requirements">Requirements</h2> <ul><li>JupiterOne requires a Detectify API key to interact with the API.</li> <li>You must have permission in JupiterOne to install new integrations.</li> </ul><h2 data-id="support">Support</h2> <p>If you need help with this integration, please contact<br><a rel="nofollow" href="https://support.jupiterone.io">JupiterOne Support</a>.</p> <h2 data-id="integration-walkthrough">Integration Walkthrough</h2> <h3 data-id="in-detectify">In Detectify</h3> <p>The integration connects directly to <a rel="nofollow" href="https://developer.detectify.com/">Detectify REST API</a> to obtain<br> application scan assets, reports, and findings.</p> <p>Configure the integration by providing an API Key from your Detectify account.<br> JupiterOne by default ingests findings from the past 30 days. The configuration<br> can be changed to ingest findings from the latest scan reports (this option<br> requires Enterprise Plan from Detectify).</p> <p>JupiterOne vulnerability management and scanner integration is built on this<br> high level data model:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Vendor - HOSTS -> Account Account - PROVIDES -> Service (*) Service - SCANS or TESTS -> <Entity> (*) <Entity> - HAS -> Finding </pre> <blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">(*) Examples:</p> </div></blockquote> <p>></p> <blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">Service</code> (e.g. SAST, DAST, IAST, MAST, PenTest, etc.)</li> <li><code class="code codeInline" spellcheck="false" tabindex="0"><Entity></code> (e.g. Application or Host or Device)</li> </ul></div></blockquote> <p>Optionally, the following is added when each scan/assessment/report is also<br> tracked by the integration:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Service - PERFORMS -> Assessment Assessment - IDENTIFIED -> Finding </pre> <h3 data-id="in-jupiterone">In JupiterOne</h3> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Detectify</strong> integration tile and click it.</li> <li>Click the <strong>Add Configuration</strong> button and configure the following settings:</li> </ol><ul><li><p>Enter the <strong>Account Name</strong> by which you'd like to identify this Detectify<br> account in JupiterOne. Ingested entities will have this value stored in<br><code class="code codeInline" spellcheck="false" tabindex="0">tag.AccountName</code> when <strong>Tag with Account Name</strong> is checked.</p></li> <li><p>Enter a <strong>Description</strong> that will further assist your team when identifying<br> the integration instance.</p></li> <li><p>Select a <strong>Polling Interval</strong> that you feel is sufficient for your monitoring<br> needs. You may leave this as <code class="code codeInline" spellcheck="false" tabindex="0">DISABLED</code> and manually execute the integration.</p></li> <li><p>Enter the <strong>API Key</strong> generated from your Detectify account, configured for<br> read access.</p></li> </ul><ol start="4"><li>Click <strong>Create Configuration</strong> once all values are provided.</li> </ol><h2 data-id="how-to-uninstall">How to Uninstall</h2> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Detectify</strong> integration tile and click it.</li> <li>Identify and click the <strong>integration to delete</strong>.</li> <li>Click the <strong>trash can</strong> icon.</li> <li>Click the <strong>Remove</strong> button to delete the integration.</li> </ol><p><br></p> <h2 data-id="data-model">Data Model</h2> <h3 data-id="entities">Entities</h3> <p>The following entities are created:</p> <table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Account</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_account</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Account</code></td> </tr><tr><td>Asset (Domain)</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">web_app_domain</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Application</code></td> </tr><tr><td>Asset (Subdomain)</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">web_app_endpoint</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">ApplicationEndpoint</code></td> </tr><tr><td>Finding</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_finding</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr><tr><td>Scan Profile</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_scan_profile</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td>Scan Report</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_scan</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Assessment</code></td> </tr><tr><td>Service</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_service</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> </tr></tbody></table><h3 data-id="relationships">Relationships</h3> <p>The following relationships are created:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_scan</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">web_app_domain</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_account</code></td> <td><strong>PROVIDES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_service</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_scan</code></td> <td><strong>IDENTIFIED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_service</code></td> <td><strong>PERFORMED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_scan</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_service</code></td> <td><strong>SCANS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">web_app_domain</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">web_app_domain</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_scan_profile</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">web_app_domain</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">web_app_endpoint</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">web_app_endpoint</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">detectify_finding</code></td> </tr></tbody></table><p><br></p> <p>The following relationships are mapped:</p> <table><thead><tr><th>From</th> <th>Relationship</th> <th>To</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0"><ROOT></code></td> <td><strong>DEVELOPS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">web_app_domain</code></td> </tr></tbody></table> </article> </main>
.png)