OpenSecurity MobSF Connector

OpenSecurity MobSF (Mobile Security Framework) is an automated, all-in-one mobile application security testing framework capable of performing static and dynamic analysis on Android and iOS applications. The Balbix integration with MobSF ingests mobile application vulnerability data, security findings, and associated risk information discovered through comprehensive mobile app security assessments.

Balbix leverages AI to aggregate, normalize, and deduplicate ingested data, along with information integrated from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including mobile application vulnerabilities and their business and operational context. Balbix's AI models then analyze this data to provide insights such as deployment gap analysis, risk-based vulnerability prioritization (with detailed ranking and scoring), and risk quantification. This process delivers a comprehensive assessment of mobile application security risk, whether for individual applications, groups of applications, or your entire mobile application portfolio, enabling more informed and effective security decisions.

Integration Summary

The table below provides information about the integration type, asset types, and data types that are fetched by the Balbix connector for MobSF.

Integration Type	File-based Import: A file-based integration used to import mobile application security assessment data from MobSF JSON reports, including application vulnerabilities, security findings, and risk assessments.
Types of Assets Fetched	Mobile applications including Android APK files and iOS IPA files with their associated security analysis results.
Types of Data Fetched	Application metadata (name, package name) Application vulnerabilities organized by analysis type Permission Analysis: Application permissions and their security implications Manifest Analysis: Manifest file security findings and configuration issues Network Security Analysis: Network-related security vulnerabilities and findings Code Analysis: Static code analysis vulnerabilities with CWE mappings and OWASP Mobile references Binary Analysis: Binary security analysis findings with detailed descriptions Application Security (AppSec): Critical security findings categorized by severity levels (warning, high, hotspot)

Data Mapping Details

The MobSF connector processes the following vulnerability data from JSON reports:

Application Information

Application Name: Primary identifier for the mobile application
Application Alias: Package name or bundle identifier

Vulnerability Details

For each vulnerability finding, the connector extracts:

Vulnerability Name: Title or name of the security finding
Vulnerability Description: Detailed explanation of the security issue
Vulnerability Severity: Risk level assessment (excludes informational findings like "warning", "info", "suppressed", "secure", "normal", "unknown")
Vulnerability Details: Additional context including components, rules, scope, MASVS categories, and OWASP Mobile references
CWE Mapping: Common Weakness Enumeration identifiers where available

Analysis Categories Supported

1. Permissions Analysis: Evaluates application permissions and their security implications

2. Manifest Analysis: Reviews application manifest files for security misconfigurations

3. Network Security: Identifies network-related vulnerabilities and insecure communications

4. Code Analysis: Performs static analysis of application source code

5. Binary Analysis: Analyzes compiled application binaries for security issues

6. Application Security: Categorizes findings by severity (warning, high-risk, security hotspots)

Prerequisites

Generate MobSF Analysis Reports

To use the Balbix MobSF connector, you must first generate JSON-formatted security analysis reports from your MobSF instance:

1. Perform Security Analysis: Use MobSF to analyze your mobile applications (Android APK or iOS IPA files)

2. Export JSON Reports: Export the analysis results in JSON format from the MobSF interface

3. Prepare File Upload: Ensure the JSON reports are accessible for upload to the Balbix platform

File Format Requirements

Format: JSON files containing MobSF analysis results
Structure: Must contain the standard MobSF report structure with analysis sections for permissions, manifest, network security, code analysis, binary analysis, and application security findings
Required Fields: Each report must include app_name and package_name fields for proper application identification. If each report has the same app_name but reports on different mobile application platforms, ensure the name is different or the application will be collapsed into a single one.

Data Processing Notes

The connector automatically filters out low-severity findings (warnings, informational items, and suppressed vulnerabilities) to focus on actionable security issues
Vulnerability data is normalized and mapped to Balbix's standardized vulnerability schema
Multiple analysis types from a single application are processed and consolidated under the application's profile

Create and Configure the Connector

After you have completed the prerequisites, follow these steps to create and configure your Balbix connector for OpenSecurity MobSF.

You can find these options in the Connectors menu.