Package: Invicti AppSec Core (on-demand)
NTA integrations overview
The Invicti Network Traffic Analyzer (NTA) enables organizations to discover unknown or undocumented APIs by passively analyzing network traffic. By reconstructing OpenAPI3 specifications from live traffic, the NTA helps build a comprehensive and accurate API inventory - crucial for API security and vulnerability scanning.
This document provides an overview of how the NTA works, its integration options, and the steps to set it up.
Why this matters
Without NTA, you depend on manually documented APIs to build your API inventory. APIs that aren't documented remain unknown and unscanned, creating blind spots in your security posture. The NTA automatically discovers real APIs in use by analyzing live traffic, so your API inventory stays current and comprehensive without manual effort.
What's the Invicti NTA?
The Invicti NTA consists of two layers:
- The Reconstructor: the NTA core service. It receives traffic telemetry, analyzes it, and reconstructs OpenAPI3 specifications. This is where the API discovery happens.
- Capture integrations: lightweight agents or plugins (Kong plugin, Cloudflare Worker, TAP, NGINX, F5) that collect traffic from your infrastructure and forward it to the Reconstructor.
The Reconstructor is always required. The capture integration you choose depends on your infrastructure.
For Kubernetes environments, the NTA supports three capture modes:
- With Istio Service Mesh: Captures both HTTP and HTTPS traffic via Envoy proxy and WASM filters.
- With Tap Plugin: Captures HTTP traffic only via direct inspection of Kubernetes network interfaces.
- With eBPF Sniffer: Captures both HTTP and HTTPS traffic at the Linux kernel level, without requiring a service mesh.
All methods use Helm charts for deployment.
Implementation
The NTA is written in Go (1.23+). The core of the NTA is the Reconstruction Service. This is where traffic analysis and API specification reconstruction happen. The NTA receives traffic telemetry from capture integrations (Kong plugin, Cloudflare Worker, TAP, and others) and reconstructs API specifications from that traffic. As a compiled Go binary, the NTA benefits from Go's efficient memory model and garbage collector, resulting in predictable, low memory overhead.
Note that the capture integrations are separate components - they collect and forward traffic, but the Reconstructor is the NTA.
Prerequisites
- Invicti AppSec Core package (on-demand)
- Admin access to Invicti AppSec Core
- For Helm deployments: a Kubernetes cluster and Helm 3 installed
- For Docker Compose deployments: Docker installed on the host machine
- Network access: the Reconstructor communicates with Invicti AppSec Core via the API hub. If your environment uses a firewall or proxy, allow traffic to the appropriate regional endpoint. Contact your Invicti support team for the correct endpoint URL for your region.
Step 1: Create an NTA source and get your registration token
- Select Discovery > API sources from the left-side menu.
- Click Add source.
- Enter a name for the source configuration. This helps you identify it later in your list of API sources.
- Toggle Exclude empty specifications if you want to skip APIs that don't have defined operations. This streamlines importing and is enabled by default.
- In the Source type section, select Invicti Network Traffic Analyzer.
- Click Continue.
- Click Generate token to create a new registration token.
- Click Copy token and save. Don't skip this step - you'll need it to deploy the NTA.
Always save your registration token immediately. If you navigate away without saving and copying it, you'll need to generate a new one.
- Registration tokens never expire - the 48-hour window only affects UI visibility, not token functionality.
- Generating a new token does not invalidate previously generated tokens.
- You can reuse one token across multiple NTA deployments.
Step 2: Choose the right integration
| Integration Method | HTTPS Support | Best For |
|---|---|---|
| Istio Service Mesh | ✅ | Environments with encrypted traffic and Istio already in use |
| eBPF Sniffer | ✅ | Encrypted traffic without a service mesh; HTTP/2 and gRPC support |
| Tap Plugin | ❌ | Simpler setups where traffic is unencrypted or Istio is not needed |
If your app traffic is encrypted (HTTPS), use either the Istio Mesh integration or the eBPF Sniffer. The eBPF Sniffer doesn't require a service mesh and also supports HTTP/2 and gRPC. The Tap Plugin is sufficient for unencrypted HTTP traffic in simpler environments.
Step 3: Deploy the NTA
Choose the appropriate guide for your deployment:
| Infrastructure | Guide |
|---|---|
| Kubernetes with Istio | NTA with Istio Mesh Service |
| Kubernetes with eBPF Sniffer | NTA with eBPF Sniffer |
| Kubernetes with TAP plugin | NTA with Tap Plugin |
| Kong API Gateway - Kubernetes | NTA with Kong API Gateway |
| NGINX in Docker | NTA with NGINX |
| F5 BIG-IP | NTA with F5 BIG-IP iRule |
| Cloudflare Worker | NTA with Cloudflare Worker |
Step 4: Verify the integration
Once the NTA is deployed and traffic is flowing:
- In Invicti AppSec Core, go to Discovery > API sources.
- Confirm the NTA source status shows as connected.
- Go to APIs > API Inventory. Reconstructed API specifications appear here after traffic flows through your monitored services.
It may take a few minutes for the first API specifications to appear, depending on traffic volume.
Troubleshooting
NTA is offline or not responding
Check your NTA deployment and its network connectivity to Invicti AppSec Core. Verify that the Reconstructor service is running and that the registration token you configured is correct. If the issue persists, contact Invicti Support.
Token expired
Registration tokens are valid for 48 hours for UI visibility purposes. Generate a new registration token and update your NTA installation with it.
No APIs appearing after successful sync
Verify that traffic is flowing through your monitored services and that the capture integration is receiving it. It may take a few minutes for the first API specifications to appear. If no specifications appear after several minutes, check your capture integration logs for errors.
Need help?
Invicti Support team is ready to provide you with technical help. Go to Help Center