Invicti Platform Cloud

Invicti Platform is a dynamic application security testing platform that provides proof-based web application and API vulnerability scanning.

Use Cases the Adapter Solves

• Identify Vulnerable Web Applications: Gain visibility into web applications and APIs with identified vulnerabilities from DAST scanning to prioritize remediation efforts.
• Track Application Security Posture: Monitor business applications and their associated assets to understand security coverage across your web application portfolio.

Asset Types Fetched

• Vulnerabilities
• SaaS Applications
• Business Applications
• URLs

Endpoint to Asset Type Mapping:

Data Retrieved through the Adapter

Business Applications - fields such as: Name, Short Description, Organization ID, Tags

URLs - fields such as: Name, Base URL, Asset Type, Deleted

Vulnerabilities - fields such as: Vuln ID, Vendor Description, CVE Severity, Status

Before You Begin

Required Ports

• TCP port 443 (HTTPS)

Authentication Methods

API Key Authentication

The adapter authenticates using the Invicti Platform API with an X-Auth header containing your personal API key. This API key is tied to your user account and inherits your user role permissions.

APIs

Axonius uses the Invicti Platform Inventory API. The following endpoints are called:

• GET /api/inventory/v1/applications - Retrieves application inventory data
• GET /api/inventory/v1/assets - Retrieves asset (target URL) inventory data
• GET /api/inventory/v1/vulnerabilities - Retrieves vulnerability findings for assets

Required Permissions

The API key must be associated with a user account that has sufficient permissions to access inventory data. The API key inherits the permissions of the user account it's associated with.

Minimum Required Role:

The user account associated with the API key should have at least read access to:

• Applications
• Assets
• Vulnerabilities

Note: Invicti Platform uses role-based access control (Owner, Admin, User roles). The exact permission names should be confirmed with your Invicti Platform administrator, as the API documentation indicates permissions are tied to user roles rather than granular API scopes.

Supported From Version

Supported from Axonius version 9.0

Connecting the Adapter in Axonius

1. Navigate to the Adapter Catalog, search for Invicti Platform Cloud, and select the adapter.
2. Click Add Connection.
3. Provide the following parameters.

Required Parameters

1. Host Name or IP Address - Base domain for the API. Should contain a prefix of http:// or https://. Do not add any specific endpoints after the domain. Example: https://platform.invicti.com/
2. API Key - Your personal API key from Invicti Platform user settings (JWT format).
3. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

Optional Parameters

1. HTTPS Proxy - Connect the adapter to a proxy instead of directly connecting it to the domain.
2. HTTPS Proxy User Name - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.
3. HTTPS Proxy Password - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.