Overview
About RiskRecon
RiskRecon provides you with the visibility and tools you need to make third-party cyber risk decisions and take action at the speed of business.
Why integrate RiskRecon into the Vulcan platform?
The RiskRecon Connector by Vulcan integrates with the RiskRecon platform to pull and ingest assets type Website and their related vulnerabilities into your Vulcan Platform. Once the integration is complete, the Vulcan Platform scans the report's findings to correlate, consolidate, and contextualize the ingested data to impact risk and remediation priority.
RiskRecon Connector Details
Supported products | RiskRecon - Risk Management |
Category | Application Security - DAST |
Ingested asset type(s) | Websites |
Integration type | UNI directional (data is transferred from the Connector to the Vulcan Platform in one direction) |
Supported version and type | SaaS (latest) |
Connector Setup
Prerequisites and user permissions
Before you begin configuring the Connector, make sure you have the following:
Generating RiskRecon API Token
Go to the RiskRecon platform and log in.
Go to My Account > System Administration.
Click API Keys and then New API Key.
Input a value in the Description field and set the Expiration Date of 1 year.
Finally, click Create API Key.
Copy the generated API Key.
Configuring the RiskRecon Connector
Log in to your Vulcan Cyber dashboard and go to Connectors.
Click on Add a Connector.
Click on the RiskRecon icon.
Set up the Connector as follows:
Enter the API Token you generated earlier.
Select whether to fetch all companies or click Load to select specific companies.
Click the Test Connectivity button to verify that Vulcan Cyber can connect to your RiskRecon instance, then click Create (or Save Changes).
Inactive Assets: You can configure a Vulcan rule to consider inactive assets, and Vulcan will remove assets that do not appear in scans within the configured time range.
Allow some time for the sync to complete. Then, you can review the sync status under Log on the Connector's setup page.
To confirm the sync is complete, navigate to the Connectors page. Once the RiskRecon icon shows Connected, the sync is complete.
RiskRecon Insights in the Vulcan Platform
Viewing RiskRecon vulnerabilities in the Vulcan Platform
To view vulnerabilities by Connector/Source:
Go to the Vulnerabilities page.
Use the Search or Filter input box to select the Vulnerability Source or Connector filter.
Select Risk Recon from the vulnerability source/Connector list to filter results.
Click on any vulnerability for more vulnerability details.
Viewing RiskRecon assets in the Vulcan Platform
To view assets by Connector/Source:
Go to the Assets page.
Click on the relevant asset type tab (Websites).
Use the Search or filter input box to select Connector from the drop-down selection.
Select RiskRecon from the Asset source/Connector list to filter results and view all synced assets.
See the complete list of available asset filters per asset type
Taking Action on vulnerabilities and assets detected by RiskRecon
To take remediation action on vulnerabilities and assets detected by RiskRecon:
Go to the Vulnerabilities / Assets Page.
Click on the Search and Filter input box and select Connector from the drop-down selection.
Locate the RiskRecon option to view all synced vulnerabilities/assets.
Select the relevant vulnerability from the results list.
Click Take Action.
Automating remediation actions on vulnerabilities detected by RiskRecon
Large environments quickly become unmanageable if constant manual attention and effort are necessary to remediate vulnerabilities. You can take advantage of the automation capabilities of Vulcan Cyber and the RiskRecon Connector.
From RiskRecon to the Vulcan Platform - Data Mapping
The Vulcan Platform integrates with RiskRecon through API to pull relevant vulnerabilities and assets data and map it into the Vulcan Platform pages and fields.
Website fields mapping
RiskRecon field | Vulcan field | field/Value example |
host_name or ip_address or domain_name | Asset Uniqueness criteria |
|
host_name or domain_name or ip_address | Asset Name | 
|
Websites | Asset type |
|
host_name or domain_name or ip_address | Asset Address |
|
URL | Asset’s vulnerable pages |
|
hosting_provider asset_value auth_detected (has authentication) host_name domain_name ip_address country_name | Asset details |  
|
company name hosting_provider asset_value domain country_name | Asset Tags - Additional |
|
record_load_timestamp or last_seen | Asset Last scan |  |
asset id + finding_id + unique vulnerability id | Vulnerability instance uniqueness criteria |
|
first_seen | Vulnerability instance first seen | 
|
finding_detail | Vulnerability instance URL |
|
last_seen | Vulnerability instance Last seen |
|
finding_id finding_detail finding_data_value finding_extra_data_value asset_value priority severity ip_address host_name domain_name | Vulnerability instance details |
|
vulnerable | Vulnerability instance status |
|
URL | Vulnerability instance location path |
|
security_criteria | Unique Vulnerability uniqueness criteria |
|
display_name | Unique vulnerability title | 
|
Vulnerability: ssue_long_vuln or issue_short_vuln Introduction: issue_long_intro or issue_short_intro EOL: issue_long_eol or issue_short_eol | Unique vulnerability description |   |
severity | Unique vulnerability details | 
|
- | Unique vulnerability status | Derived from the "vulnerability instances" |
- | Assets-Vulnerability instance connection (info tooltip) | Detailed in the "vulnerability instances section" in the table |
security_criteria | Solution uniqueness criteria |
|
Fix from RiskRecon | Solution Title |
|
solution_long or solution_short | Solution Description |
|
solution_references | Solution References | 
|
Vulnerability status mapping
RiskRecon Status | Vulcan Status |
all ingested findings are vulnerable | Vulnerable |
Vulnerability score mapping
RiskRecon score | Vulcan score |
Critical | 10 |
High | 7 |
Medium | 5 |
Low | 3 |
Info | 0 |
Status Update Mechanisms
Every day, the Vulcan Platform syncs with the vendor's platform to receive updates on existing vulnerabilities and assets and to retrieve new ones (if any added).
The table below lists how the status update mechanism works in the RiskRecon connector for the vulnerabilities and assets in the Vulcan Platform.
Update type in Vulcan | Mechanism (When?) |
The asset is archived | - Asset not seen for X days according to "Last Seen" |
The vulnerability instance status changes to "Fixed" | - If the vulnerability no longer appears in the scan findings. |
Note: Asset or vulnerability updates on the vendor side are reflected on the Vulcan Platform only on the next scheduled connector sync (the next day).
Support and Expected Behaviour
Support and expected behavior remarks on some of RiskRecon ingested and uningested data:
Users have the option to select which companies' data should be ingested into Vulcan.
Findings with a "pass" or "positive" status are not ingested.
The number of vulnerability instances:
RiskRecon issues (Vulcan vulnerability instances) are counted by issue + IP. This means that a host with two IPs and an issue will be counted as two issues in Vulcan. However, RiskRecon counts only the issues without considering the IPs. Consequently, RiskRecon may potentially display a higher count.
The number of unique vulnerabilities:
RiskRecon Security Criteria (Vulcan unique vulnerabilities) that do not involve the disclosure of IP addresses, hosts, or domains are not ingested. As a result, RiskRecon may potentially show a higher number of unique vulnerabilities.
The number of Assets:
RiskRecon's asset view lists only hosts. However, findings may also be associated with an IP or a domain. In Vulcan, these IPs and domains are treated as distinct assets. Consequently, Vulcan may potentially display a higher number of assets.
RiskRecon's UI filters out hosts that are not on a company's owned domains. In contrast, Vulcan displays all hosts, regardless of domain ownership. Therefore, Vulcan may potentially show a higher number of assets.
For detailed instructions on how to compare the number of assets in Vulcan and RiskRecon, refer to the Data Validation section.
RiskRecon Host Issues Tab missing information:
Please note that the value displayed in RiskRecon's host issues tab is not the Security Criteria (Vulcan unique vulnerability) but rather the Security Profile and its parent hierarchy.
Vulcan Vulnerability Instance URL:
The URL field in Vulcan vulnerability instances will only be populated if the
finding_detailfield contains a URL. Otherwise, it will remain blank.
API Endpoints in Use
API | Use in Vulcan |
/v1/toes | Get TOE_IDs (vendor ids) and vendor names |
/v1/hosts/{toe_id} | Assets |
/v1/findings_paginated/{toe_id} | Vulnerability instances |
/v1/display_names/security_criteria | Unique vulnerabilities, solutions |
/v0/cpe/raw_language?language=english&security_criteria={security_criteria} | Unique vulnerabilities data |
Data Validation
This section shows how to validate and compare data between Vulcan and the RiskRecon platform.
Matching Assets
As described in the Support and Expected Behaviour section, RiskRecon and Vulcan don’t show the same number of assets in the UI. RiskRecon doesn’t provide an option to view all assets for all companies.
In order to compare the data with Vulcan, you would need to do it for one company at a time, using the method detailed below. The numbers received from that method should be identical for both RiskRecon and Vulcan.
In RiskRecon:
Choose a company from the "Portfolio" tab.
Go to the “PDF / Data Downloads” tab and scroll down to the “Data Files” section.
Click the download button for each data file except for "Owned Netblocks," and extract the column representing each file's asset.
Combine all extracted columns into a single column in a new spreadsheet.
Remove duplicates from the new column.
Data File | Column |
Hosts | hostname |
Name Servers | hostname |
Domain Records | domain |
Host Headers | hostname |
System Reputation Alerts | intel_hostname |
Links to External Systems with System Reputation Alerts | source_websites |
Software | hostname |
Web Encryption | hostname |
Domain Hijacking Protection | domain_name |
Email Servers | email_server_hostname |
Email Authentication | email_domain_name |
Email Encryption | email_server_hostname |
Shared IP Hosts | Hostname |
Malicious Code | Hostname |
In Vulcan:
Click on the "Assets" tab and then "Websites."
Click on "Filter" and choose "Asset Tag" as the parameter.
Select the name of the company you want to see and click "Apply."
Matching Unique Vulnerabilities
As described in the Support and Expected Behaviour section, RiskRecon and Vulcan don’t show the same number of unique vulnerabilities in the UI. RiskRecon Security Criteria (Vulcan unique vulnerabilities) that do not involve the disclosure of IP addresses, hosts, or domains are not ingested. Potentially, RiskRecon may show a higher number.
In order to compare the data with Vulcan, you would need to do it for one company at a time, using the method detailed below. The numbers received from that method should be identical for both RiskRecon and Vulcan.
In Riskon:
Choose a company from the "Portfolio" tab.
Go to the “Security Profile” tab.
Enter each of the Security Domains and note which Security Criteria have a number higher than zero in their “Issue Count” field. Include only Security Criteria involving IP addresses, hosts, or domains.
Combine the data from all companies.
In Vulcan:
Click on the "Vulnerabilities" tab.
Click on "Filter" and choose "Vulnerability Source" as the parameter.
Select the connector’s name from the dropdown and click "Apply."
Matching Vulnerability Instances
As described in the Support and Expected Behaviour section, RiskRecon and Vulcan don’t show the same number of vulnerability instances in the UI. Vulcan doesn’t ingest RiskRecon issues (Vulcan vulnerability instances) in status pass or positive.
Furthermore, RiskRecon issues are counted by issue + IP. That means that a host with two IPs and an issue would be counted as two issues.
Vulcan counts only the issues without taking into account the IPs.
Potentially, RiskRecon may show a higher number.
Due to these factors, there is no feasible way to validate the number of vulnerability instances by using the UI.
