Arctic Wolf
Connect Arctic Wolf to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Record your Arctic Wolf connection as endpoint detection & response evidence. Automated collection is not available for this provider yet.
| Category | Endpoint Detection & Response |
| Connect with | API token |
| What a connection produces | Connection record |
Connect with an API token
-
In Arctic Wolf:
- Sign in to the Arctic Wolf Unified Portal (
https://dashboard.arcticwolf.com/); use the Unified Portal, not the MSP portal. - In the navigation menu, click Organization Profile › Personal API Keys.
- Select Create an API Key, enter a name that identifies the key's purpose, set an expiration period and click Create Key.
- Copy the token now; after you close the window you cannot view it again. Paste it into Safeguard's API token / Personal access token field.
Where to find the other values:
- Account / Org / Workspace (optional): Not shown in a documented UI location. Arctic Wolf's docs say to call the Organizations API with the key; it maps your tenant to its organization ID and region (POD).
- Base URL (optional): Determined by the POD (region) the Organizations API returns; not shown in a documented UI location.
Arctic Wolf shows the secret only once, so copy it before you leave the page.
Arctic Wolf notes that keys created in child portals are associated with user permissions; conglomerate or MSP customers should create the key in the parent or MSP internal Unified Portal. The Data Retrieval API needs a valid Data Explorer license. The Organizations API endpoint and response details are in a downloadable spec, not on the fetched page.
Source: docs.arcticwolf.com, docs.arcticwolf.com, checked 2026-10-07.
- Sign in to the Arctic Wolf Unified Portal (
-
On Compliance › Connectors, open Arctic Wolf, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Arctic Wolf publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Attestation | CC6.8 | 1 |
| ISO/IEC 27001 | Attestation | A.8.7 | 1 |
| HIPAA Security Rule | Attestation | 164.308(a)(5) | 1 |
| PCI DSS | Attestation | 5.2.1 | 1 |
| NIST CSF 2.0 | Attestation | DE.CM-09 | 1 |
These tests are switched on per workspace by the Safeguard team.
Related
- Endpoint Detection & Response connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks
Endpoint Detection & Response connectors
The 32 Endpoint Detection & Response connectors Safeguard connects to, how each one connects, and a setup page for each.
Arctic Wolf Managed Awareness
Connect Arctic Wolf Managed Awareness to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.