---
title: "BitSight BitSight Attack Surface Management Integration"
slug: "bitsight-attack-surface-management"
updated: 2026-11-05T07:51:15Z
published: 2026-11-05T07:51:15Z
canonical: "docs.hunters.ai/bitsight-attack-surface-management"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# BitSight BitSight Attack Surface Management Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| BitSight Attack Surface Management Findings | ✅ | ✅ | ✅ | ✅ | `bitsight_attack_surface_management_findings` | JSON | API |

## Overview

BitSight is a cyber risk ratings and attack surface management platform that continuously scans the clear, deep, and dark web, as well as internet-facing infrastructure, to assess the security posture of an organization and its vendors/third parties. The BitSight Attack Surface Management integration brings in "findings" — individual security observations about monitored assets (domains, hosts, IPs) such as misconfigurations, vulnerabilities, and risk-vector grade impacts, each tagged with a risk category, severity, and affected asset. These findings surface externally-visible weaknesses and exposures — such as email security misconfigurations, open ports, expired certificates, and leaked credentials — before they are exploited by attackers, enabling security teams to prioritize remediation and track risk posture changes over time for both the organization and its supply chain. Ingesting this data into Hunters allows security teams to correlate external exposure findings with internal detections and investigations for a more complete risk picture.

## Supported data types

### BitSight Attack Surface Management Findings

**Table name:** `bitsight_attack_surface_management_findings`

This data type contains individual BitSight findings generated from continuous scanning of internet-facing assets and external risk sources. Each record represents a specific observation (e.g., a missing or weak SPF/DMARC record, an open port, an expired certificate, or a leaked credential) tied to a monitored asset, along with its risk category, risk vector, severity, and whether it impacts the organization's security rating.

**Expected format**

Logs are expected in JSON format.

`{"temporary_id":"RmluZGluZ3NmaW5kaW5ncwIBcJKTL771jDCgVA8Klo0Td1FbD_WRaMAnehwMpzhraM_iPNvw9IrHk6QuAeCyIw==","affects_rating":true,"impact_end_date":null,"impacts_risk_vector_grade":true,"impacts_security_rating":true,"assets":[{"asset":"hostname-d1e6ef47","identifier":null,"category":"critical","importance":0.1,"is_ip":false,"asset_type":"Domain","is_monitored":false,"country_code":null}],"details":{"cvss":{"base":[]},"check_pass":"","grade":"GOOD","remediations":[],"sample_timestamp":"2026-11-03T00:49:45Z","vulnerabilities":[],"rollup_end_date":"2026-11-03","rollup_start_date":"2026-07-07"},"evidence_key":"hostname-d1e6ef47","first_seen":"2026-07-07","last_seen":"2026-11-03","related_findings":[],"risk_category":"Diligence","risk_vector":"spf","risk_vector_label":"SPF","rolledup_observation_id":"_G2OwDL8ukPta7tFVlDwPg==","severity":1.0,"severity_category":"minor","tags":[],"remediation_history":{"last_requested_refresh_date":null,"last_refresh_status_date":null,"last_refresh_status_label":null,"last_refresh_status_reason":null,"last_refresh_reason_code":null,"last_refresh_requester":null,"result_finding_date":null,"instant_rescan_details":null,"result_finding_grade":null},"asset_overrides":[],"duration":null,"comments":null,"remaining_decay":59,"remediated":null,"impacts_risk_vector_details":"AFFECTS_RATING","grace_period_end_date":null,"guest_network_end_date":null,"no_rv_grade_impact_end_date":null,"earliest_cert_expiration_date":null,"decay_date":"2027-01-01","has_threat_insights":false,"threat_groups":[],"threat_activity_score_label":null,"techniques":[],"ttp_ai_enabled":false}`

## Send data to Hunters

Hunters supports the collection of BitSight logs using API.

**To connect BitSight logs:**

1. Create API credentials in the BitSight console with read access to the relevant data (findings), following BitSight's [Attack Surface Intelligence product documentation](https://www.bitsight.com/products/attack-surface-intelligence).
2. Connect the data source in the Hunters portal with those credentials, as described in [this section](https://docs.hunters.ai/docs/connect-a-data-source-using-apiwebhook). Hunters pulls the data from the vendor API on a schedule.