RiskIQ Connector Guide

RiskIQ helps customers discover and assess the security of their entire enterprise attack surface—in the Microsoft Azure cloud, AWS, other clouds, on-premises, and from their supply chain. The Balbix integration with RiskIQ ingests IT Infrastructure assets and associated vulnerabilities discovered by RiskIQ.

Balbix leverages AI to aggregate, normalize, and deduplicate ingested data, along with information integrated from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their business and operational context. Balbix’s AI models then analyze this data to provide insights such as deployment gap analysis, risk-based vulnerability prioritization (with detailed ranking and scoring), and risk quantification. This process delivers a comprehensive assessment of risk, whether for a single asset, groups of assets, or your entire enterprise, enabling more informed and effective security decisions.

Integration Summary

This table provides a summary of the Balbix integration for the RiskIQ connector.

Prerequisites

To configure the Balbix connector, you must first create RiskIQ API credentials with the appropriate permissions. These credentials are required for completing the configuration process. Here are the steps you need to complete:

1. Register for a RiskIQ Community account.

   Note: Registering for a RiskIQ Community account provides an API key but does not include an API secret. It is assumed that the API secret is provided upon purchasing a RiskIQ product.

2. Verify your account by clicking the validation link sent to your email.

3. Confirm your account, then go to the Account Settings page to retrieve your username and API key.

4. Use the API key as shown in the example below:

   USERNAME="your@email.here"
   KEY="API key from account settings"
   
   curl -u $USERNAME:$KEY 'https://api.riskiq.net/pt/v2/dns/passive?query=passivetotal.org'
   

   Note: If the API does not respond, it may be due to the limitations of a community account. To resolve this, consider starting a 30-day trial of RiskIQ’s product for enhanced data access.

Create and Configure the Connector

After you have completed the prerequisites, follow these steps to create and configure your Balbix connector for RiskIQ.

Step 1: Select the Connector

Start by selecting a connector using the steps outlined below:

1. Go to Data Sources from the left navigation bar.

2. In the Connectors table, click + Add Connector.

3. Click Select a Connector to Configure to expand the window and view the list of available connectors.

4. Click the + icon on the RiskIQ tile.

5. Click Next to configure the connector.

Step 2: Configure the Connector

Configure the connector using the steps outlined below.

1. Fill in the required configuration fields.

   	Instance Name
   	RiskIQ Base URL	Enter the base API URL of the server where the information will be fetched (e.g., https://api.riskiq.net/). Make sure the authorized user for this account has the necessary privileges to access the API.
   	RiskIQ API Key	Enter the API key for the user account with the necessary permissions to fetch assets.
   	RiskIQ API Secret	Enter the API secret for the user account with the necessary permissions to fetch assets.
   	Asset Last Seen Days Filter

2. Click Test Connection.

Step 3: Schedule the Connector

Step 4: Review Connector Details

API Reference Documentation

To learn more about the RiskIQ API, see the references listed below:

• RiskIQ API Concepts

• RiskIQ Community Docs