Skip to main content

RiskRecon

Bring your RiskRecon third-party risk portfolio into JupiterOne. Track the cyber and privacy ratings of the vendors you monitor, review their open critical and high findings, and keep an inventory of RiskRecon portal users through queries and alerts.

Installation​

This integration connects to the RiskRecon API (https://api.riskrecon.com/v1, or https://api.sandbox.riskrecon.com/v1 for the sandbox) and ingests the third parties (Targets Of Evaluation, or TOEs) in your RiskRecon portfolio with their ratings, the open findings of the latest analysis of each third party, and the users of your RiskRecon portal. It authenticates with a RiskRecon API bearer token and only reads data. The integration is managed by JupiterOne and runs in the JupiterOne cloud, so no collector is needed.

Prerequisites​

  • A RiskRecon subscription with API access and a portfolio of monitored third parties.
  • A RiskRecon API bearer token.
  • Access to JupiterOne with permission to configure integrations.

Configuration in RiskRecon​

Generate an API bearer token (a JWT) as described in Generate a Bearer Token. Copy the token and store it somewhere safe. Tokens can be valid for up to one year; when the token expires, the integration stops ingesting until you add a new token to the instance.

Configuration in JupiterOne​

To install the RiskRecon integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select RiskRecon. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the RiskRecon account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • The API Token fields and the Findings setting below.

Configuration fields​

FieldRequiredDescription
API TokenYesThe RiskRecon API bearer token. It is masked in JupiterOne and sent in the Authorization: Bearer header.
EnvironmentNoProduction (default) or Sandbox.
Finding SeveritiesNoWhich finding severities to ingest: Critical, Critical and High (default), Critical, High and Medium, or All severities.

When you save the instance, JupiterOne checks the settings and reads one vendor from the RiskRecon API. An invalid or expired token fails the check.

Click Create once all values are provided to finalize the integration.

Data Sources​

Each data source can be enabled or disabled on its own. All data sources are disabled by default, so a new instance ingests only the riskrecon_account entity until you enable the ones you want. To enable them, open the instance, turn on the data sources under Data Sources, and save. They are ingested on the next run.

Data SourceDescriptionEntities Created
VendorsThird parties (TOEs) in your RiskRecon portfolio, with their overall cyber rating (letter and numeric), privacy rating when RiskRecon reports one, the rating of each security domain, subscription level, scan frequency, your internal IDs and names, and seed hostnames.riskrecon_vendor
FindingsOpen findings from the latest analysis of each vendor, limited to the Finding Severities setting, with severity, priority, security domain and criteria, asset value, CVE IDs, affected host and IP address, first and last seen dates, and remediation guidance. Requires Vendors.riskrecon_finding
UsersUsers of your RiskRecon portal, with their name, email, status, scopes and last sign-in.riskrecon_user

Relationships are built only when the data source they need is enabled:

RelationshipRequires
riskrecon_account HAS riskrecon_vendorVendors
riskrecon_vendor HAS riskrecon_findingVendors and Findings
riskrecon_account HAS riskrecon_userUsers

Notes​

  • Findings volume. The integration makes one paginated request per vendor and severity. Large portfolios with All severities selected can take noticeably longer to ingest; the default, Critical and High, keeps the volume bounded.
  • Vendors without findings access are skipped. If RiskRecon denies findings for a vendor (for example, because of its subscription level) or no longer has the vendor, the integration skips that vendor's findings and continues. If your token is denied findings for every vendor, the Findings data source fails so previously ingested findings are kept.
  • Only open findings of the latest analysis are ingested. Findings that RiskRecon no longer reports are removed from the graph on the next run.
  • Vendor findings are not linked to your own assets. RiskRecon findings describe your third parties' internet-facing systems, so riskrecon_finding entities connect to the riskrecon_vendor they belong to, not to hosts in your environment.
  • Personal data. User phone numbers returned by RiskRecon are not ingested.
  • Every run is a full sync. Vendors, findings and users that RiskRecon no longer reports are removed from the graph on the next run.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.

Additional resources​