Sonrai Security
Connect Sonrai Security to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Record your Sonrai Security connection as cspm evidence. Automated collection is not available for this provider yet.
| Category | CSPM |
| Connect with | API token |
| What a connection produces | Connection record |
Connect with an API token
-
In Sonrai Security:
- Sign in to Sonrai and open Advanced Search (https://app.sonraisecurity.com/App/GraphExplorer), where Sonrai says tokens can be created in the UI.
- Alternatively, run the GraphQL mutation
GenerateSonraiUserToken(input: \{ expiresIn: <seconds>, name: "<token name>" \}) \{ name expireAt token \}as the user who should own the token. - Copy the returned token immediately; it is only returned at creation and is not retrievable afterwards.
Where to find the other values:
- Account / Org / Workspace (optional): Click the user profile icon on the top right of the Sonrai UI to see your Org Id (sent as the sonraisecurity-com-org header).
- Base URL (optional): https://<yourOrgID>.sonraisecurity.com/graphql
Sonrai Security shows the secret only once, so copy it before you leave the page.
Sonrai Security's public documentation does not cover every step.
Sonrai's public developer docs (docs.sonraisecurity.com/cpf-public/...) are readable without sign-in, unlike the docs root. Tokens last from 2 hours up to 30 days (expiresIn in seconds) and inherit the creator's privileges, so create the token as a user with a read-only Sonrai role for least privilege; Sonrai names no minimum role. Token creation and deletion are logged in Sonrai's User Activity. Missing: the exact buttons and dialog labels for creating a token inside Advanced Search (the docs only say tokens can be created 'via UI (Advanced Search) or API' and show a screenshot).
Source: docs.sonraisecurity.com, docs.sonraisecurity.com, checked 2026-10-07.
-
On Compliance › Connectors, open Sonrai Security, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Sonrai Security publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Attestation | CC7.1 | 1 |
| ISO/IEC 27001 | Attestation | A.8.8 | 1 |
| HIPAA Security Rule | Attestation | 164.308(a)(1) | 1 |
| PCI DSS | Attestation | 6.3.3, 11.3.1 | 1 |
| NIST CSF 2.0 | Attestation | ID.RA-01 | 1 |
These tests are switched on per workspace by the Safeguard team.
Related
- CSPM connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks