MongoDB

Required

Fields required for a valid configuration.

Path	Type	Required	Description	Default	Constraints
required	object	Yes	—	—	—

Masked

Sensitive fields under(secrets/credentials).

Path	Type	Required	Description	Default	Constraints
masked	object	Yes	—	—	—

Optional

Optional configuration fields.

Path	Type	Required	Description	Default	Constraints
optional	object	No	—	—	no extra properties
optional.connection	object	No	MongoDB connection and authentication tuning options.	—	no extra properties
optional.connection.app_name	string	No	MongoDB appName (Atlas and driver telemetry label)	—	—
optional.connection.auth_mechanism	enum	No	MongoDB authentication mechanism Allowed values: DEFAULT, SCRAM-SHA-1, SCRAM-SHA-256, MONGODB-AWS, MONGODB-X509, GSSAPI, PLAIN	—	—
optional.connection.auth_source	string	No	Authentication database/source (for example, admin)	—	—
optional.connection.connect_timeout_ms	integer	No	MongoDB connection timeout in milliseconds	10000	min 100, max 120000
optional.connection.direct_connection	boolean	No	Connect directly to a single host instead of topology discovery	—	—
optional.connection.options	object	No	Additional pymongo.MongoClient keyword arguments (advanced usage).	{}	—
optional.connection.replica_set	string	No	Replica set name for on-prem deployments	—	—
optional.connection.tls	boolean	No	Enable TLS for on-prem connections when required	—	—
optional.scope	object	No	MongoDB database and collection selection scope.	—	no extra properties
optional.scope.collection_limit	integer	No	Optional cap on number of collections extracted per database	—	min 1
optional.scope.database	string	No	Single database to scan (optional when include_all_databases is true)	—	—
optional.scope.exclude_collections	array	No	Optional collection denylist. Accepted forms: collection or database.collection	—	—
optional.scope.exclude_collections[]	string	No	—	—	—
optional.scope.exclude_databases	array	No	Database denylist (exact database names)	["admin","config","local"]	—
optional.scope.exclude_databases[]	string	No	—	—	—
optional.scope.include_all_databases	boolean	No	Scan all visible databases except excluded system databases	true	—
optional.scope.include_collections	array	No	Optional collection allowlist. Accepted forms: collection or database.collection	—	—
optional.scope.include_collections[]	string	No	—	—	—
optional.scope.include_system_collections	boolean	No	Include system.* collections when true	false	—

Extracted Metadata

Collection

Field	Type	Required	Description
database	string	Yes	Database name
collection	string	Yes	Collection name
deployment	string	Yes	ATLAS or ON_PREM
document_count	integer	No	Estimated number of documents in the collection

Examples

Atlas cluster discovery scan

Discover all collections in a MongoDB Atlas cluster with random document sampling

Config Payload

{
  "type": "MONGODB",
  "required": {
    "deployment": "ATLAS",
    "cluster_host": "your-cluster.mongodb.net"
  },
  "masked": {
    "username": "your-username",
    "password": "your-password"
  },
  "optional": {
    "scope": {
      "include_all_databases": true
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC",
    "rows_per_page": 50
  }
}

Schedule

{
  "enabled": true,
  "preset": "weekday_morning",
  "cron": "34 6 * * 1-5",
  "timezone": "UTC"
}

On-prem MongoDB with latest-document sampling

Scan an on-prem MongoDB deployment prioritizing newest documents per collection

Config Payload

{
  "type": "MONGODB",
  "required": {
    "deployment": "ON_PREM",
    "host": "your-host",
    "port": 27017
  },
  "masked": {
    "username": "your-username",
    "password": "your-password"
  },
  "optional": {
    "connection": {
      "auth_mechanism": "SCRAM-SHA-256",
      "auth_source": "admin"
    },
    "scope": {
      "include_all_databases": true
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC",
    "rows_per_page": 50
  }
}

Schedule

{
  "enabled": true,
  "preset": "nightly",
  "cron": "24 2 * * *",
  "timezone": "UTC"
}

Atlas secrets detection scan

Scan all collections in Atlas for hardcoded secrets — catches API keys and tokens stored in documents

Config Payload

{
  "type": "MONGODB",
  "required": {
    "deployment": "ATLAS",
    "cluster_host": "your-cluster.mongodb.net"
  },
  "masked": {
    "username": "your-username",
    "password": "your-password"
  },
  "optional": {
    "scope": {
      "include_all_databases": true
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC",
    "rows_per_page": 30
  },
  "detectors": [
    {
      "type": "SECRETS",
      "enabled": true
    }
  ]
}

Schedule

{
  "enabled": true,
  "preset": "nightly",
  "cron": "0 3 * * *",
  "timezone": "UTC"
}