Detectify integration
The Detectify integration is API-key based: Centraleyezer maps each of your web application assets to the corresponding Detectify asset by URL and imports its findings — including CVSS 2/3 scores, evidence and Detectify’s severity ratings. Findings that don’t match a tracked asset are reported to you by email so nothing silently drops.
Scan types imported
- Continuous web application DAST
- External attack surface findings
API connection
Paste your Detectify API key. On every run Centraleyezer resolves each project website asset to its Detectify asset token and pulls all findings for it.
Configuration
Where to get the credentials
Create an API key in Detectify under Team settings → API keys. The key must have access to the assets you want to import.
What gets imported on every run
- Findings per matched asset: title, severity (informational → critical), CVSS 2.0 and 3.0 scores, location, and Detectify’s definition/risk description.
- HTTP request (method, URL, body) and response (status, body) evidence.
- TLS/SSL findings additionally feed the certificate inventory.
- Findings on Detectify assets that match no tracked asset are emailed to the operators for triage.
How imported findings are risk-scored
Every Detectify finding is normalised into Centraleyezer’s risk model on import: the scanner’s native severity scale maps to a configurable DREAD vector (Damage, Reproducibility, Exploitability, Affected users, Discoverability), which combines with asset criticality, network exposure, exploitability intelligence and the platform’s other risk factors to produce one comparable risk score across every scanner you run. CVE, CVSS and CWE metadata are preserved on the finding for reference and reporting, and duplicate findings from repeated imports are automatically correlated instead of creating noise.