--- title: Micro Focus Fortify on Demand Connector Guide slug: rbvm-help/micro-focus-fortify-on-demand-connector-guide createdAt: 2026-10-26T13:51:22.680Z --- **Summary**: How to set up and use the Micro Focus Fortify on Demand connector in Ivanti Neurons RBVM/ASPM/VULN KB. ## Overview The Ivanti Neurons RBVM/ASPM/VULN KB platform provides an API-based connector that integrates with Micro Focus’ **Fortify on Demand (FoD)**, enabling customers to bring in their SAST and DAST findings from **Fortify** into Neurons RBVM/ASPM/VULN KB. This allows customers to gain visibility into their overall risk due to vulnerabilities in their source code/web applications and enable a simpler, more efficient way to manage those vulnerabilities. ## User Prerequisites/Fortify on Demand Setup Fortify on Demand is a cloud-based solution. Neurons RBVM/ASPM/VULN KB requires a user account with the following access to communicate with and pull data from Fortify on Demand. - Read access to scan results and their associated issues. - API access with Fortify on Demand API scope as ‘**api-tenant**’. Refer to the following link for more details: https\://\/Docs/en/Content/API/API\_Scopes.htm - Client Id and Client Secret with the following Fortify on Demand user **Read Only **user role. Refer to the following link for more details: https\://\/Docs/en/Content/Administration/Settings/API/API\_CreateKey.htm ## Fortify on Demand Connector API Calls During a connector run, the following API calls pull security vulnerabilities from Fortify on Demand into Neurons RBVM/ASPM/VULN KB. | **API Type** | **Endpoint** | | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | Authentication | https\:///oauth/token | | Fetch List of SDLC status | https\:///api/v3/lookup-items?type=SDLCStatusTypes | | Fetch List of Applications | https\:///api/v3/applications | | Fetch List of Releases | https\:///api/v3/releases?filters=sdlcStatusTypeId:\ | | Fetch List of Vulnerabilities by Release Id | https\:///api/v3/releases/\/vulnerabilities | | Get Vulnerability detail for each Vulnerability | https\:///api/v3/releases/\/vulnerabilities/\/all-data | | Get Vulnerability code detail for each SAST Findings | https\:///api/v3/releases/\/vulnerabilities/\/traces/\/\/snippet | ## Configuring the Fortify on Demand Connector in Neurons RBVM/ASPM/VULN KB Navigate to the **Automate > Integrations** page. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/N6T9UnB5FOanUDKWj7uEe_palo-alto-xpanse-expander.png" alt="Navigation - Automation - Integrations" position="flex-start" size="33" width="229" height="151" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" showCaption="false"} Using the search bar in the upper-right corner of the **Integrations** page, type **Fortify on Demand** to find the connector. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/uI4xPVvGVrM4JfDvQNpyd_micro-focus-fortify-on-demand.png" alt="Fortify on Demand - Search for Connector" position="flex-start" size="97" width="681" height="91" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify on Demand.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify on Demand.png" showCaption="false"} Locate the **Fortify on Demand** card on the page and click **Configuration**. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/wCuHdGfyaX1Ajwzk6exrs_micro-focus-fortify-on-demand1.png" alt="Fortify on Demand - Configuration Button Location" position="flex-start" size="98" width="687" height="303" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify on Demand_1.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify on Demand_1.png" showCaption="false"} In the new window under **Connection**, complete the required fields, as described below. - **Name**: The connector’s name. - **URL**: The API URL to access Fortify on Demand Instance. Refer to this link for more details https\://\/Docs/en/index.htm#API/API\_About.htm and input the **API Root URL **based on the datacenter. - **Client Id**: API Key retrieved from Fortify on Demand instance. Refer to the [User Prerequisites/Setup](docId\:T-fYa1CENEo-e-mSVahwC) section for API scope and role. - **Client Secret**: API Secret retrieved from Fortify on Demand instance. Refer to the [User Prerequisites/Setup](docId\:T-fYa1CENEo-e-mSVahwC) section for API scope and role. - **SSL**: Optional instance SSL certificate in base64 format. - **Select Network**: Neurons RBVM/ASPM/VULN KB network name (ingested data associated with this network). ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/ebsUyVWTxoV25dSViK6yw_micro-focus-fortify-on-demand2.png" alt="Fortify on Demand - Connection Window" position="flex-start" size="72" width="507" height="530" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify on Demand_2.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify on Demand_2.png" showCaption="false"} Click the **Test Credentials** button to ensure the credentials are correct and have the necessary access to make Fortify on Demand API calls. Under Schedule, you can configure the desired schedule for the connector to retrieve results from the Fortify on Demand instance. Users can optionally turn on **Enable auto URBA (Update Remediation by Assessment)**. On marking the **Create Assets that do not have vulnerabilities** options, Neurons RBVM/ASPM/VULN KB will create applications with zero findings. This option will be selected by default, and the user can opt to turn it off. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/jPcufZFVbaY-NrTi7LgY4_micro-focus-fortify-on-demand3.png" alt="Fortify on Demand - Schedule Section" position="flex-start" size="78" width="549" height="460" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify on Demand_3.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify on Demand_3.png" showCaption="false"} Users have the option to ingest the selected applications from Fortify on Demand based on the SDLC status and Release created date fields. - **Release SDLC Status**: Clicking the **All** radio button allows the user to pull applications with all releases. To pull specific applications, click the **Select Status** radio button. Once selected, Neurons RBVM/ASPM/VULN KB makes a dynamic call to Fortify on Demand to fetch all associated releases. Users can select more than one release, as well. - **Release Created Date: **The user can ingest selected applications based on the release created date in Fortify on Demand Instance. Only one type can be selected. Click the **Save** button to save the connector’s configuration and create the connector. Once saved, the connector is now visible on the **Integrations** page under **Currently Configured Integrations**. Clicking the **History** button displays the connector details for each pull. The **Sync** button allows users to perform on-demand sync. The **Edit** button allows the user to edit the connector configuration. The **Delete** button allows the user to delete the connector. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/mkj6WQ-feGrcIVdMs0QZB_micro-focus-fortify-on-demand4.png" alt="Fortify on Demand - Configured Connector" position="flex-start" size="35" width="242" height="278" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify on Demand_4.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify on Demand_4.png" showCaption="false"} Once files have been processed on the Uploads page, view the ingested data by navigating to the **Applications** and **Application Findings** pages. ## Mapping Fortify on Demand fields in Neurons RBVM/ASPM/VULN KB This table showcases the high-level mapping of **Fortify on Demand** fields in Neurons RBVM/ASPM/VULN KB. Neurons RBVM/ASPM/VULN KB pulls both DAST and SAST types of findings from Fortify. | **Neurons** **RBVM/ASPM/VULN KB Fields** | **Fortify on Demand SAST Fields** | **Fortify on Demand DAST Fields** | | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Scanner Reported Severity | items -> severityString | items -> severityString | | Normalized Severity | The **Fortify on Demand** Severity scale: Critical, High, Medium, Low, Informational, and Best Practices
Neurons RBVM/ASPM/VULN KB converts this Severity scale into a scale from 0-10 using specific logic. Contact Neurons RBVM/ASPM/VULN KB Support for more information. | The **Fortify on Demand** Severity scale: Critical, High, Medium, Low, Informational, and Best Practices
Neurons RBVM/ASPM/VULN KB converts this Severity scale into a scale from 0-10 using specific logic. Contact Neurons RBVM/ASPM/VULN KB Support for more information. | | Scanner Plugin | items -> checkId | items -> checkId | | Application Name | Combinations of these fields forms the Application name
items -> applicationName +
items -> releaseName +
items -> sdlcStatusType | Combinations of these fields forms the Application name
items -> applicationName +
items -> releaseName +
items -> sdlcStatusType | | Plugin Source Status | items -> status | items -> status | | Finding Type | items-> "scantype" if this has value Static, then it is SAST | items-> "scantype" if this has value Dynamic, then it is DAST | ### Common Fields in Neurons RBVM/ASPM/VULN KB The following fields in Neurons RBVM/ASPM/VULN KB are defined for Fortify on Demand, along with their default values. - The Scanner Name will be **FortifyonDemandSAST or FortifyonDemandDAST **based on the type of scan. - The Finding Type will be **DAST/SAST **based on the type of scan.