BitSight BitSight Attack Surface Management Integration

TL;DR

Overview

BitSight is a cyber risk ratings and attack surface management platform that continuously scans the clear, deep, and dark web, as well as internet-facing infrastructure, to assess the security posture of an organization and its vendors/third parties. The BitSight Attack Surface Management integration brings in "findings" — individual security observations about monitored assets (domains, hosts, IPs) such as misconfigurations, vulnerabilities, and risk-vector grade impacts, each tagged with a risk category, severity, and affected asset. These findings surface externally-visible weaknesses and exposures — such as email security misconfigurations, open ports, expired certificates, and leaked credentials — before they are exploited by attackers, enabling security teams to prioritize remediation and track risk posture changes over time for both the organization and its supply chain. Ingesting this data into Hunters allows security teams to correlate external exposure findings with internal detections and investigations for a more complete risk picture.

Supported data types

BitSight Attack Surface Management Findings

Table name: bitsight_attack_surface_management_findings

This data type contains individual BitSight findings generated from continuous scanning of internet-facing assets and external risk sources. Each record represents a specific observation (e.g., a missing or weak SPF/DMARC record, an open port, an expired certificate, or a leaked credential) tied to a monitored asset, along with its risk category, risk vector, severity, and whether it impacts the organization's security rating.

Expected format

Logs are expected in JSON format.

{"temporary_id":"RmluZGluZ3NmaW5kaW5ncwIBcJKTL771jDCgVA8Klo0Td1FbD_WRaMAnehwMpzhraM_iPNvw9IrHk6QuAeCyIw==","affects_rating":true,"impact_end_date":null,"impacts_risk_vector_grade":true,"impacts_security_rating":true,"assets":[{"asset":"hostname-d1e6ef47","identifier":null,"category":"critical","importance":0.1,"is_ip":false,"asset_type":"Domain","is_monitored":false,"country_code":null}],"details":{"cvss":{"base":[]},"check_pass":"","grade":"GOOD","remediations":[],"sample_timestamp":"2026-11-03T00:49:45Z","vulnerabilities":[],"rollup_end_date":"2026-11-03","rollup_start_date":"2026-07-07"},"evidence_key":"hostname-d1e6ef47","first_seen":"2026-07-07","last_seen":"2026-11-03","related_findings":[],"risk_category":"Diligence","risk_vector":"spf","risk_vector_label":"SPF","rolledup_observation_id":"_G2OwDL8ukPta7tFVlDwPg==","severity":1.0,"severity_category":"minor","tags":[],"remediation_history":{"last_requested_refresh_date":null,"last_refresh_status_date":null,"last_refresh_status_label":null,"last_refresh_status_reason":null,"last_refresh_reason_code":null,"last_refresh_requester":null,"result_finding_date":null,"instant_rescan_details":null,"result_finding_grade":null},"asset_overrides":[],"duration":null,"comments":null,"remaining_decay":59,"remediated":null,"impacts_risk_vector_details":"AFFECTS_RATING","grace_period_end_date":null,"guest_network_end_date":null,"no_rv_grade_impact_end_date":null,"earliest_cert_expiration_date":null,"decay_date":"2027-01-01","has_threat_insights":false,"threat_groups":[],"threat_activity_score_label":null,"techniques":[],"ttp_ai_enabled":false}

Send data to Hunters

Hunters supports the collection of BitSight logs using API.

To connect BitSight logs:

1. Create API credentials in the BitSight console with read access to the relevant data (findings), following BitSight's Attack Surface Intelligence product documentation.
2. Connect the data source in the Hunters portal with those credentials, as described in this section. Hunters pulls the data from the vendor API on a schedule.