From d02b5c29066e08ca46082e898f3b7020a9b447cb Mon Sep 17 00:00:00 2001 From: Greg Anderson Date: Wed, 22 Jul 2026 22:47:37 -0600 Subject: [PATCH] docs(connectors): Fairwinds Insights connector reference Document the Fairwinds Insights (insights.fairwinds.com) Kubernetes security connector: the organization + API-token prerequisite, the Location/Organization/Secret/Minimum-Severity mappings, and the whole-account model (every active cluster -> a Record; each Security action item -> finding, numeric-severity mapping, reportType tool tag, resource/image context, CVE extraction, static, dedupe on action-item id). Companion to connectors#764 and dojo-pro#2018. sc-13911 Co-Authored-By: Claude Opus 4.8 --- .../connectors/connectors_tool_reference.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/docs/content/import_data/pro/connectors/connectors_tool_reference.md b/docs/content/import_data/pro/connectors/connectors_tool_reference.md index 3e74c3107d..85a4fc6db7 100644 --- a/docs/content/import_data/pro/connectors/connectors_tool_reference.md +++ b/docs/content/import_data/pro/connectors/connectors_tool_reference.md @@ -452,6 +452,25 @@ You will need an Edgescan API token. Create one from your Edgescan account under Each Edgescan asset becomes a Record, and each open vulnerability on that asset is imported as a finding. Severity is mapped from Edgescan's numeric scale (1–5) to DefectDojo's Info–Critical, and CVE references, the CWE, and a CVSS v3 vector are included where Edgescan provides them. +## **Fairwinds Insights** + +The Fairwinds Insights connector uses the [Fairwinds Insights](https://insights.fairwinds.com) REST API to import **Kubernetes security findings** across your whole organization. DefectDojo enumerates every active **cluster** and creates a Record for each one, then imports that cluster's Security **action items** \(from Polaris, Trivy, Kube\-bench, OPA and the other Insights reports\) as findings — there is no per\-cluster configuration. + +#### Prerequisites + +You will need a Fairwinds Insights **organization** name and an **API token**. Create the token in the Insights app under **Organization Settings \> Tokens**; a `read_only` token is sufficient. The token is org\-scoped and is sent as a bearer token; it is never logged. + +#### Connector Mappings + +1. Leave the **Location** field blank to use `https://insights.fairwinds.com`, or enter your Insights host explicitly. +2. Enter your Insights **Organization** name (the slug shown in your dashboard URL). +3. Enter the Insights API token in the **Secret** field. +4. Optionally, set a **Minimum Severity** to limit which findings are imported. + +DefectDojo maps each active **cluster** to a Record and each Security **action item** to a finding: severity comes from Fairwinds' numeric score \(mapped to DefectDojo's Info–Critical\), the Fairwinds report that produced the item \(`polaris`, `trivy`, `kube-bench`, ...\) becomes a tool tag, the affected Kubernetes resource and container image are included, and any CVE identifiers are extracted. Findings are recorded as static findings and de\-duplicated on the Fairwinds action\-item id. + +See the [Fairwinds Insights API documentation](https://insights.docs.fairwinds.com/technical-details/api/) for more information. + ## **GitGuardian** The GitGuardian connector uses the GitGuardian REST API to import **secret incidents** — exposed credentials GitGuardian has detected across your monitored sources. DefectDojo creates a Record for each monitored source (repository or perimeter) that currently has open incidents, and imports each open incident as a finding.