Setting up each integration¶

What each connection needs, what it contributes, and the thing about it that most often goes wrong. Nineteen integrations share four patterns — read the pattern first, then the tool.

The four patterns¶

Pattern	Tools	What NxSAM does
API pull	Qualys, Tenable, Nexpose, Prisma, Cortex XDR, CSPM	Connects on a schedule and collects completed scans
API pull with project mapping	Checkmarx, Fortify, AppScan, Snyk, Gitleaks, JFrog, Dependency Track	As above, plus a decision about which project maps to which asset
Report upload	Burp Suite, Netsparker, Acunetix	You export from the tool; NxSAM parses the file
Posture pull	Prisma CSPM, SentinelOne CSPM, Twistlock	Cloud or container posture rather than vulnerabilities

The pattern decides where a failure can occur. An API pull can fail on credentials, authorisation or reachability. A report upload cannot — it fails on parsing instead.

What every API integration needs¶

An endpoint URL. Region-specific for several vendors. A wrong region fails authentication in a way that looks exactly like a wrong password.
An account with API access enabled. Separate from console access in most tools. A security team will often issue a console login and assume it works.
Scope granted to that account. This is the one that bites: the connection succeeds, the account signs in, and it can see none of the scans. Ask the tool's administrator what the API account can see, not what your own account can see.
Network reachability, including any IP allow-list on the vendor side.

Column mapping: what it is and why it matters¶

Report-based and several API integrations map the tool's columns onto NxSAM's fields. Two groups of settings do this.

Date fields. For Qualys and Tenable, the mapping names the column in the uploaded report that holds each date, and the format that column is written in:

Discovered On, with its Discovered On Format
Last Observed, with its Last Observed Format
Status Change Date, with its Status Change Date Format

Tenable repeats the same three pairs for Policy Compliance, and adds a Key Header naming the column that identifies a vulnerability — the one used for matching when Enable Key for VA Vulnerability is on.

A wrong date format is worse than a missing one

03/04/2026 is a valid date in two formats five weeks apart. A missing date is rejected and reported; a misread one is imported and silently wrong, and it shifts every SLA calculation built on it.

Check the format against a current export, not against the documentation — vendors change export defaults between versions.

The vulnerability key. This names the column NxSAM matches on to decide whether a finding is one it has seen before. Changing it after data exists splits history: existing findings are no longer recognised, so they stay open with no new sightings while fresh copies arrive with no history. It is not reversible by changing the setting back.

Checkmarx: the approval rules¶

Checkmarx integrations carry an extra step no other tool has. Checkmarx records a triage state per result, and the integration translates that into NxSAM's own states through three configurable rules:

Rule	Decides
Approval state	Which Checkmarx value means the finding is confirmed
Non-approval state	Which value means it is not yet confirmed
False positive state	Which value means it was dismissed

Each rule is a comparison against a named column of the uploaded report.

This is why the same Checkmarx scan can produce very different NxSAM results at two customers: the rules encode how that organisation uses Checkmarx triage. If findings arrive already approved when they should be pending, or false positives arrive as open findings, these three rules are the cause — not the import.

Per-tool notes¶

Network vulnerability assessment¶

Qualys — the widest column mapping. Also supports QDS-to-severity mapping, so severity can follow the Qualys Detection Score rather than CVSS.
Tenable — one integration covers Tenable.io, Tenable.sc and Nessus, on three tabs: System, SC and IO. It carries two header sets, one for VA and one for Policy Compliance.
Nexpose — API pull; findings land in Network VA alongside the others.
Cortex XDR — a newer source, using endpoint host insight data as VA findings. Ships unconfigured; the screen shows a prompt until credentials are entered.

Application security¶

Checkmarx / Checkmarx SCA / Checkmarx Standalone SCA — three separate integrations. SCA covers third-party libraries, not your code, and standalone SCA runs independently of the main platform. Connecting the wrong one is a common first-time error.
Fortify, AppScan, Snyk Code — static analysis. Project-to-application mapping is the setup step that matters.
Burp Suite, Netsparker, Acunetix — dynamic. Report upload rather than API pull, so the failure mode is parsing rather than authentication.
Gitleaks — secrets in source control. Findings are credentials, so treat the finding detail itself as sensitive.
JFrog Xray, Dependency Track — composition analysis. Dependency Track works from an SBOM rather than from a scan, so it reports on what you declare rather than what it finds.

Container and cloud¶

Prisma Cloud — appears twice, as container security and as CSPM. They are separate integrations with separate credentials despite the shared vendor.
Twistlock — the earlier name for the Prisma container product; present for deployments still running it.
Cortex CSPM — Palo Alto's posture platform, feeding the CSPM screens (Assets, Issues, Cases, Rules, Policies) rather than the Prisma ones. The connection takes the tenant's FQDN, an API Key ID and the API Key, with an optional proxy; Test Connection checks them before saving. It then has two sync actions, and the order matters: Master Sync first, which brings the rules and policies, then Sync, which brings assets, issues and cases against them. A sync run before the master sync has nothing to attach issues to.
SentinelOne CSPM — an alternative posture source, also feeding the CSPM screens. One Data Sync action brings everything.

Prisma CSPM and Cortex/SentinelOne CSPM are different screens

Prisma feeds the four Prisma CSPM screens; Cortex and SentinelOne feed the five CSPM screens. Connecting one does not populate the other, and an empty CSPM module after a successful Prisma sync is expected rather than a fault.

Three integration screens log a template error on load

Checkmarx, Checkmarx SCA and Fortify each report an unknown-property binding in the browser console. The tabs work and the integration functions. It is a known product defect, not a sign of a broken connection.

After the first sync¶

Expect the first collection to take substantially longer than later ones — it has history to fetch. Check three things once it completes:

Did assets get created that you did not expect? Some integrations create assets for scan targets NxSAM does not know about.
Did audits appear that nobody created? Several integrations create an audit per scan. That is normal; scoping what the integration collects is the control.
Do the counts roughly match the tool? Small differences are deduplication. Large ones are scope — the API account seeing more or less than you assumed.

Reconciling the asset list with Tenable¶

The Tenable IO tab compares its asset list against NxSAM's and reports the overlap, which answers question 3 directly rather than by inference. Generate produces a summary; Refresh re-reads the latest one.

Column	What it means
Common IPs (Both)	Hosts both systems know about — the healthy case
Tenable IO Only	Hosts Tenable scans that NxSAM has no asset for
Scanned by Tenable	Of the common hosts, how many Tenable has actually scanned
NxSAM Only	Assets in NxSAM that Tenable is not scanning
Status, Initiated at	The comparison job itself

The two "only" columns are the ones to act on, and they mean opposite things:

Tenable IO Only is data you collect but do not manage — findings on those hosts have nowhere to land.
NxSAM Only is a coverage gap: assets you believe are being assessed and are not. A clean NxSAM with a large NxSAM-Only count is not a healthy estate, it is an unscanned one.

Run this before trusting a first sync

A sync that imports cleanly still tells you nothing about what it missed. This comparison is the only place in the product that shows the difference between the two inventories, and it is quicker than reconciling two exported spreadsheets.