Sources
PYXA centralizes far more than vulnerability scanners through its connector architecture — 22 source types across scanners, endpoint and cloud platforms, code-level findings, attack surface, patch confirmation, bug bounty, and vendor risk:
| Source | Type ID | Deployments | Configuration |
|---|---|---|---|
| Qualys VM | qualys | Cloud (every platform pod) | API base URL, username, password |
| Tenable | tenable | Tenable Vulnerability Management (cloud, FedRAMP), Tenable Security Center (on-prem), Nessus Professional/Expert/Manager | Host/URL, access key, secret key. The product is recognised from the host: *.tenable.com is the cloud; an appliance is asked whether it is Security Center or Nessus |
| OpenVAS / Greenbone | openvas | Greenbone Community Edition and Enterprise appliances (GMP over TLS, port 9390) | Host/URL, username, password |
| Rapid7 InsightVM | rapid7 | Security Console (on-prem, API v3) and the Insight Platform (cloud, integration API v4) | Console URL with a console user and password, or https://<region>.api.insight.rapid7.com with an Insight API key; optional site ID |
| CSV / JSON import | csv_import | Any | Local file paths for assets/vulns/KB files |
| SARIF import (SAST/SCA — CodeQL, Semgrep, Snyk, etc.) | sarif_import | Any SARIF 2.1.0 producer | Local SARIF file path |
| ASFF import (AWS Security Hub — Inspector, GuardDuty, IAM Access Analyzer) | asff_import | AWS Security Hub exports (ASFF; not the OCSF format) | Local ASFF file path |
| EASM import (attack surface, file-based) | easm_import | Any | Local file path |
| Patrowl (attack surface, live API) | patrowl | Self-hosted PatrowlManager or Patrowl SaaS | Patrowl/PatrowlManager URL, API key |
| watchTowr Platform (attack surface, live API) | watchtowr | Cloud | API base URL, API key |
| Patch deployment import (WSUS/SCCM/Ansible, file-based) | patch_deployment_import | Any | Local file path |
| Microsoft Intune (patch deployment, live API) | intune | Commercial and GCC, GCC High, DoD, 21Vianet (China) | Azure AD tenant ID, app client ID, client secret, optional cloud |
| Bug bounty import (HackerOne/Bugcrowd/Intigriti) | bugbounty_import | HackerOne and Bugcrowd API exports as saved; others in PYXA's flat format | Local file path |
| Microsoft Defender Vulnerability Management (live API) | defender_vm | Commercial (global and regional hosts), GCC, GCC High, DoD | Entra ID tenant ID, app client ID, client secret |
| CrowdStrike Falcon Spotlight (live API) | crowdstrike_spotlight | US-1, US-2, EU-1, US-GOV-1 | API client ID and secret, cloud |
| Amazon Inspector (live API) | aws_inspector | Any region where Inspector is enabled | Access key ID, secret access key, optional session token, regions |
| Wiz (cloud workloads, live API) | wiz | Cloud | Service account client ID and secret, tenant API endpoint |
| GitHub Advanced Security (live API) | github_security | github.com and GitHub Enterprise Server | Organization, access token |
| GitLab Security (live API) | gitlab_security | gitlab.com and self-managed (Ultimate) | Group path, access token |
| Snyk (live API) | snyk | US, EU, AU | Organization ID, API token |
| BloodHound CE (AD attack paths, live API) | bloodhound_api | Self-hosted BloodHound Community Edition | Server URL, API token ID and key |
| BloodHound Enterprise (attack path findings) | bloodhound_enterprise | BloodHound Enterprise tenant | Tenant URL, API token ID and key |
| BloodHound / SharpHound import | bloodhound_import | SharpHound output, as the ZIP or unzipped | Local directory |
| ServiceNow CMDB (asset inventory and owners, live API) | servicenow_cmdb | Any supported release | Instance URL, user name, password, optional table and encoded query |
| SecurityScorecard (vendor/third-party risk) | securityscorecard | Cloud | API key, portfolio ID or domain list |
| Custom / Other | custom | — | Free-form — for community connectors |
Every live-API connector retries a throttled (429) or unavailable (502–504) response, waiting as long as the vendor's Retry-After asks. A verifying scanner's run is only used to close findings when it covered what it claims to: an incremental Tenable run, a Rapid7 run with unreadable assets, and hosts an OpenVAS or Nessus scan did not reach are never read as fixed.
Add any of these from the app itself at /connectors/ — no manual JSON or admin-panel editing needed for the ones above. The in-app Setup wizard (/setup/) walks through which of these are relevant to your organization one question at a time.
Environment Variables
See .env.example for all configuration options. Key variables:
| Variable | Description | Default |
|---|---|---|
DJANGO_SECRET_KEY | Django secret key (set a random value) | — |
DJANGO_DEBUG | Verbose error pages — leave off | False |
PYXA_TLS | on: nginx serves HTTPS with the certificate in nginx/certs/ (generated if absent). off: plain HTTP | on |
PYXA_HTTPS_PORT / PYXA_HTTP_PORT | Host ports for HTTPS and for the redirect from HTTP | 443 / 80 |
DJANGO_FORCE_HTTPS_COOKIES | Secure cookies and redirects with PYXA_TLS=off, when a TLS proxy of your own sits in front | False |
DJANGO_ALLOWED_HOSTS | Comma-separated allowed hosts | localhost |
DB_ENGINE | Database engine | django.db.backends.postgresql (matches docker-compose) |
DJANGO_SUPERUSER_USERNAME/_EMAIL/_PASSWORD | Auto-create an admin account on first start if all three are set | — |
LDAP_ENABLED | Enable LDAP authentication | False |
Generated from README.md in the PYXA repository.