Migrate from Astra to middleBrick

Migrating from Astra to middleBrick

What middleBrick covers

Black-box scanning with no agents or SDK dependencies
Completes in under a minute with read-only methods
Covers OWASP API Top 10 (2023), PCI-DSS 4.0, SOC 2 Type II
OpenAPI 3.0/3.1 and Swagger 2.0 parsing with $ref resolution
Authenticated scans for Bearer, API key, Basic, and Cookie
PR checks and CI/CD gates via GitHub Action and CLI

Exporting data from Astra

Begin by exporting your existing scan data from Astra. Use the platform UI or API to download findings, scan definitions, and historical scores in JSON or CSV format. Map severity levels and tags to middleBrick categories so you can align prior work with the new scoring model.

Rebuilding scan history

Transform the exported data into a timeline that middleBrick can consume. Include timestamps, affected endpoints, and remediation status. Recreate trend lines by importing these normalized records manually at first; over time, continuous monitoring will generate a comparable history natively.

Keeping CI wired up during cutover

Shift your CI gates gradually. Point the GitHub Action or pipeline stage to the middleBrick API client first on a staging environment, using the same fail thresholds you set in Astra. Run both tools in parallel for one sprint to validate that block conditions match before decommissioning the old integration.

What you will miss with Astra

middleBrick does not perform intrusive exploit tests such as active SQL injection or command injection, and it does not detect blind SSRF that relies on out-of-band callbacks. It also does not surface business logic flaws, which require domain-specific reasoning. Use a dedicated pentest for these areas.

What you will gain

You gain a black-box scanner that requires no agents or SDKs and completes in under a minute. Reports align directly with OWASP API Top 10 (2023), PCI-DSS 4.0, and SOC 2 Type II control references. The CLI, MCP Server, and PR checks make it simple to integrate across teams while maintaining strict read-only safety posture.

Frequently Asked Questions

Can I import my Astra findings into middleBrick?

Yes. Export findings from Astra as JSON or CSV, remap severity and tags to middleBrick categories, and import them to establish a baseline before running new scans.

Will my existing CI pipelines break during migration?

They can run both tools in parallel. Update the pipeline to call the middleBrick API first, compare results against your Astra thresholds, and only fail builds when confidence in the new results is established.

Does middleBrick cover compliance requirements like HIPAA or GDPR?

The tool aligns with security controls described in PCI-DSS 4.0 and SOC 2 Type II. It surfaces findings relevant to audit evidence but does not certify compliance with HIPAA, GDPR, or other regulations.

Are there differences in authentication support between Astra and middleBrick?

middleBrick supports Bearer, API key, Basic auth, and cookies, with domain verification to ensure only the domain owner can scan with credentials. Header forwarding is limited to allowlisted headers for safety.

Can I run continuous monitoring like Astra did?

Yes. Pro tier provides scheduled rescans, diff detection across scans, email alerts rate-limited to one per hour per API, and signed webhooks that auto-disable after repeated failures.