> ## Knowledge Base Index > Fetch the complete knowledge base index at: https://docs.brainframe.com/sitemap.xml > Use this file to discover available pages before exploring further. > Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash). # Aikido Security integration > **"Bring code, container and cloud security findings into Brainframe β€” and link them to your risks, assets and compliance controls."** > *Connect* *Aikido.dev* *to Brainframe GRC, review open vulnerabilities at a glance, and import findings or monitored assets as native documents you can govern, track and evidence.* The Aikido.dev integration connects Brainframe to your Aikido workspace through the **Aikido REST API**. Once configured, you get a live security overview of your findings and monitored assets β€” and you can **import any issue or asset as a Brainframe document** so it can be linked to risks, non-conformities, supporting assets, controls and compliance requirements. > πŸ“Œ This integration complements **Brainframe DEFEND**, which maps Aikido automated control checks directly onto compliance framework requirements. See [Brainframe DEFEND (Aikido)](https://docs.brainframe.com/en/article/brainframe-defend-aikido-1kbq8wm/) for automated maturity on ISO 27001 and other standards. The integration browser described here is for **importing individual findings and assets** into your GRC web. --- ## 1️⃣ Before You Begin To configure the integration you will need: * πŸ›  A **Brainframe workspace administrator** account (integration configuration is admin-only). * πŸ” An active **Aikido.dev** account with access to create **REST API credentials** in your organisation settings. * πŸ“‘ The **REST API scopes** listed below enabled on your Aikido API client β€” without them, specific tabs or asset categories will return errors or empty results. > || ⚠️ Aikido enforces **API rate limits**. Heavy use β€” especially **searching across all issue pages** β€” may temporarily return a rate-limit error. Wait a moment and use **Refresh** or **Load more** again. --- ## 2️⃣ Configure the Integration ### Step 1 β€” Create REST API credentials in Aikido 1. Log in to [Aikido.dev](https://app.aikido.dev). 2. Open **Settings β†’ Integrations β†’ REST API** and create a new client named e.g. `Brainframe GRC`. 3. Set the **App Type** to **Private**. 4. Enable the scopes below, then create the credentials. 5. Copy the **Endpoint**, **Client ID** and **Client Secret**. **Required REST API scopes** | Scope | Used for | | ---- | | `issues:read` | Issues tab β€” security findings | | `reports:read` | Reporting context | | `firewall:read` | Firewall-related findings | | `repositories:read` | Assets β†’ Code repos | | `clouds:read` | Assets β†’ Clouds | | `clouds:write` | Cloud asset sync (The write is currently required due to a Aikido limitation in their APIs, if you prefer not, this can be omitted) | | `containers:read` | Assets β†’ Containers | | `domains:read` | Assets β†’ Domains | | `virtual_machine:read` | Assets β†’ VMs | > πŸ“Œ These are **read-only** scopes for browsing and import (`clouds:write` is required by Aikido for cloud inventory sync). Brainframe does not remediate or change findings in Aikido. ### Step 2 β€” Enter credentials in Brainframe Go to **Workspace Settings β†’ Integrations β†’** **Aikido.dev** **β†’ Configure** and fill in: * **Endpoint** β€” defaults to `https://app.aikido.dev/api/` (change only if Aikido provides a different API base URL). * **Client ID** * **Client secret** Then: 1. Click **Test connection**. Brainframe validates the credentials against the Aikido API. The test **must succeed** before you can save. 2. Click **Save**. Credentials are **encrypted at rest** and are never returned to the browser after saving. > πŸ“Œ To change or remove the connection later, return to the same **Configure** screen (gear icon on the integration page). Removing the integration deletes the stored credentials but leaves any already-imported documents intact. ### πŸͺͺ Plan & scope limitations Unlike directory integrations, Aikido does not use Microsoft-style licence tiers inside Brainframe. What you see depends on your **Aikido subscription** and the **scopes enabled** on your API client: | What you want to browse | Requirement | | ---- | | **Issues** (SAST, SCA, secrets, cloud, containers, …) | Active Aikido scanning on those surfaces + `issues:read` | | **Code repos** | Repositories connected in Aikido + `repositories:read` | | **Clouds / cloud assets** | Cloud accounts linked in Aikido + `clouds:read` / `clouds:write` | | **Containers** | Container registries monitored in Aikido + `containers:read` | | **Domains** | Surface monitoring configured + `domains:read` | | **VMs** | Virtual machines inventoried in Aikido + `virtual_machine:read` | > πŸ’‘ If a tab is empty, check first in Aikido that the asset or scan type is actually monitored, then confirm the matching scope is enabled on your API client. --- ## 3️⃣ Using the Integration Open the integration from **Workspace Settings β†’ Integrations β†’** **Aikido.dev** (or the Integrations tile grid). Any workspace user can browse and import; only admins can edit credentials. The **gear** icon opens credential configuration. ### πŸ“Š Top cards (security posture at a glance) Six cards summarise your current view. On the **Issues** tab, the first five cards reflect the **active filters** (severity, status, type and search) β€” so the numbers always match the table below. | Card | What it shows | | ---- | | **Critical** | Count of findings with **Critical** severity. | | **High** | Count of findings with **High** severity. | | **Medium** | Count of findings with **Medium** severity. | | **Low** | Count of findings with **Low** severity. | | **Open** | Open findings in the current view, with a subtitle showing how many are resolved in the filtered set. | | **Repos** | Total **monitored code repositories** in Aikido (always tenant-wide, unaffected by issue filters). | > πŸ“Œ Cards use colour cues: Critical (red), High (orange), Medium (yellow), Low (blue). Use them to decide where to start triage and what to import first. ### πŸ—‚ Tabs & sub-menus Two main tabs organise everything below the cards: #### ⚠️ Issues Your live vulnerability and misconfiguration register from Aikido β€” grouped findings across code, dependencies, secrets, cloud, containers, IaC and more. **Filters** * πŸ”Ž **Search** β€” matches finding title, ID, type or repository (searches across all pages when a term is applied). * **Severity** β€” All / Critical / High / Medium / Low. * **Status** β€” defaults to **Open**; also All / Closed / Snoozed / Ignored. * **Type** β€” All / Open Source (SCA) / Leaked Secret / Cloud / SAST / IaC / Docker Container / Cloud Instance / Surface Monitoring / Malware / EOL / Mobile / SCM Security / AI Pentest / License. * πŸ”„ **Refresh** β€” reload the current list. **Table columns** | Column | Description | | ---- | | Finding | Title of the grouped finding. | | Type | Scan category (SAST, Open Source, Cloud, …). | | Severity | Critical / High / Medium / Low badge. | | Severity Score | Aikido score (0–100). | | Status | Open, Closed, Snoozed, Ignored, etc. | | Repository | Source repo or asset name, when applicable. | **Actions** * Click a **row** to open the finding in Aikido (new tab). * Use **Import** on a row, or select multiple rows and **Import selected**. * **Load more** at the bottom fetches the next page of results (100 per page). #### πŸ—„ Assets Monitored infrastructure and code surfaces registered in Aikido. Switch between six sub-menus: | Sub-menu | What it lists | Key columns | | ---- | | **Clouds** | Linked cloud accounts (AWS, Azure, GCP, …) | Type, name, purpose, account ID, open/ignored issues, last scan | | **Cloud assets** | Individual cloud resources inside those accounts | Type, name, region, cloud ID, issues, last scan | | **Code repos** | Monitored source repositories | Repo name, branch/provider, issues, ignored, last scan | | **Containers** | Container images in registries | Provider, name, registry, tag, issues, last scan | | **Domains** | Surface-monitoring targets | Domain name, type (Front-End, REST API, …), issues, last scan | | **VMs** | Virtual machines | Type, name, cloud/region, instances, issues, purpose, last scan | **Search** is available on Cloud assets, Code repos, Containers and VMs (not on Clouds or Domains). **Actions** * Click a **row** to open the asset in Aikido. * Use **Import** per row or bulk-import via checkboxes. * **Load more** fetches additional pages (50 per page). --- ## 4️⃣ Importing into Brainframe Browsing is read-only until you **import**. Importing turns an Aikido finding or asset into a **native Brainframe document** with a live link back to Aikido. ### How to import * **Single item** β€” click **Import** on any row. * **Bulk** β€” tick checkboxes and use **Import selected** in the toolbar. The **folder selection modal** opens so you can pick the **destination folder** and confirm the **document type** (pre-filled from the mapping below). On confirm, Brainframe reports an outcome per item: **created**, **updated**, **skipped** (already exists) or **failed**. Re-importing the same object updates or skips it β€” you won't create duplicates. Imported documents include a formatted summary (severity, status, scan metadata) and an **Open in Aikido** link. **Issue groups** refresh live from Aikido when you open the document; **assets** display the snapshot captured at import time. ### What each object becomes (document-type mapping) | Aikido object | Imported as | Best used to… | | ---- | | Issue / finding group | **Vulnerability** | Track a specific CVE, secret leak or misconfiguration linked to a risk or non-conformity. | | Cloud account | **Datacenter or Cloud Provider** | Register a cloud tenant as a supporting asset in your dependency chain. | | Cloud asset (resource) | **Cloud Infrastructure** | Document a specific cloud resource (storage, compute, network) tied to a primary asset. | | Code repository | **Source Code Repository** | Link application source to an asset, control or SDLC risk. | | Container image | **Virtual Machine or Container Image** | Add a deployable artefact to your asset inventory. | | Domain | **Domain Name / DNS Registration** | Evidence surface-monitoring scope for web/API exposure risks. | | Virtual machine | **Virtual Machine or Container Image** | Register compute instances as supporting assets. | ### πŸ”— Import directly linked to a document You don't have to start from the settings page. From **any Brainframe document** β€” a risk, non-conformity, asset, control, etc. β€” open the **integration / link action** and choose **Aikido.dev**. The browser opens **scoped to that document**, and anything you import is **automatically linked** to it (bi-directionally). > πŸ’‘ **This is the recommended workflow.** For example: > * From a **general risk** ("Critical dependency vulnerabilities in production services"), import the matching **Critical/High open findings** so the risk shows exactly which CVEs or secrets it covers. > * From a **non-conformity** ("Unpatched container images in scope"), import the affected **container assets** and their **open issues** as evidence. > * From a **primary asset** (customer-facing API), import its **code repository**, **cloud infrastructure** and **domain** to complete the dependency chain. > * From a **control** (secure SDLC / vulnerability management), import representative **findings** to demonstrate control operation during an audit. ### πŸ€– Brainframe DEFEND β€” automated compliance checks Separately from manual import, you can attach **Aikido automated control sets** to compliance framework requirements (e.g. ISO 27001). This gives you a combined maturity view of **manual controls + automated Aikido checks** on your compliance dashboard and in audit exports. Go to **Compliance β†’ Frameworks**, open a requirement, and add an **Automated control** mapped to Aikido control groups. Full setup is documented in [Brainframe DEFEND (Aikido)](https://docs.brainframe.com/en/article/brainframe-defend-aikido-1kbq8wm/). --- ## 5️⃣ Best Practices * 🎯 **Start from the Open + Critical/High filters** β€” import what matters for your risk register and audit scope first. * πŸ”— **Import from the document, not the settings page**, whenever a finding relates to a specific risk, asset or non-conformity β€” automatic linking saves manual work. * πŸ—„ **Register assets before findings** when building a new scope β€” import clouds, repos and containers as supporting assets, then link the vulnerabilities that affect them. * πŸ”„ **Re-import to refresh** β€” existing documents are updated, not duplicated, when Aikido data changes. * πŸ“‹ **Pair manual import with DEFEND** β€” use imported vulnerabilities for granular remediation tracking, and DEFEND automated controls for framework-level maturity reporting. * ⏱ **Avoid rapid repeated searches** β€” searching issues fetches all pages from Aikido; use filters first, then search within a narrowed set. --- ## 6️⃣ Troubleshooting * **Test connection fails** β†’ verify Endpoint, Client ID and Client Secret; confirm the API client is **Private** and scopes are enabled in Aikido. * **Issues tab is empty** β†’ check the Status filter (defaults to **Open**); switch to **All Statuses** or confirm scans have run in Aikido. * **An asset sub-menu is empty** β†’ confirm that asset type is connected and scanned in Aikido, and that the matching read scope is enabled on your API client. * **Rate limit exceeded** β†’ wait briefly and retry; avoid repeated full-text searches in quick succession. * **Imported issue looks outdated** β†’ open the document to trigger a live refresh from Aikido, or re-import the finding. * **DEFEND controls show no automated data** β†’ configure credentials via the automated-control flow on the requirement (see DEFEND article); the integration browser and DEFEND share the same Aikido credentials once saved. --- ## 🎯 Visual Checklist * [x] REST API client created in Aikido with required scopes * [x] Endpoint, Client ID and Client Secret entered in Brainframe * [x] **Test connection** passed and saved * [ ] Critical/High open findings reviewed * [ ] Key assets (repos, clouds, containers) imported and linked * [ ] Findings imported and linked to relevant risks / non-conformities * [ ] DEFEND automated controls mapped to framework requirements *(optional)* --- > πŸ’¬ **Need help?** For Aikido REST API details, open [Aikido REST API settings](https://app.aikido.dev/settings/integrations/api/aikido/rest). For Brainframe DEFEND and automated controls, see [Brainframe DEFEND (Aikido)](https://docs.brainframe.com/en/article/brainframe-defend-aikido-1kbq8wm/). For anything else, contact us at support@brainframe.com.