Red Canary

Connect Red Canary to collect endpoint detection & response evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Red Canary:

   1. Sign in to Red Canary as a user whose roles give only the read access Safeguard needs; the token is limited to that user's roles.
   2. Click your user icon at the top right and select View profile.
   3. In the Security Settings section, go to Generate API Authentication Token.
   4. Click Generate, then copy the token and save it securely.

   Where to find the other values:

   • Subdomain: The first part of your Red Canary address: https://<subdomain>.my.redcanary.co/.

   The token is tied to the individual user profile and works across every subdomain linked to that profile. Generating a new token revokes the existing one, which would break other integrations using the same user's token; consider a dedicated user. The docs now carry Zscaler MDR branding. The page does not say whether the token can be viewed again.

   Source: docs.redcanary.com, checked 2026-10-07.

   The permissions Safeguard needs: read access.

2. On Compliance › Connectors, open Red Canary, click Connect, choose API token and fill in:

   Field	What to enter
   Subdomain	Required. The part before .my.redcanary.co in your address.
   API key	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Red Canary and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Endpoint Detection & Response connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks