Sysdig
Connect Sysdig to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Record your Sysdig connection as cspm evidence. Automated collection is not available for this provider yet.
| Category | CSPM |
| Connect with | API token |
| What a connection produces | Connection record |
Connect with an API token
-
In Sysdig:
- Sign in to Sysdig Secure and, from the user menu, go to Settings › User Profile.
- Copy the Sysdig Secure API token shown there (the Monitor or Secure token is displayed depending on your interface and team) and paste it into Safeguard's API token / Personal access token field. Reset Token generates a new one and immediately invalidates the old token.
Where to find the other values:
- Base URL (optional): Sysdig's SaaS regions page lists the Secure API endpoint for your region, for example
https://secure.sysdig.com(US East),https://us2.app.sysdig.com(US West AWS) orhttps://app.us4.sysdig.com(US West GCP). Your region matches the website URL you use to reach Sysdig. - Account / Org / Workspace (optional): The token is scoped to your current team; not shown in a documented UI location.
Sysdig's public documentation does not cover every step.
The user API token carries the user's own permissions. Sysdig also documents Team Service Accounts as an alternative, but the fetched page did not give their click path or a read-only role, so the least-privilege option is unsourced. The token stays visible in User Profile (not one-time).
Source: docs.sysdig.com, docs.sysdig.com, checked 2026-10-07.
-
On Compliance › Connectors, open Sysdig, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Sysdig publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Attestation | CC7.1 | 1 |
| ISO/IEC 27001 | Attestation | A.8.8 | 1 |
| HIPAA Security Rule | Attestation | 164.308(a)(1) | 1 |
| PCI DSS | Attestation | 6.3.3, 11.3.1 | 1 |
| NIST CSF 2.0 | Attestation | ID.RA-01 | 1 |
These tests are switched on per workspace by the Safeguard team.
Related
- CSPM connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks