Chronosphere

Connect Chronosphere to collect observability evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Chronosphere:

   1. In Chronosphere (now Cortex XCOR), click Go to Admin in the navigation menu, then select Platform › Service Accounts.
   2. Click + Service Account to open the Add Service Account dialog and name it.
   3. In the Service Account Type section, select Restricted and choose Read-only (read-only accounts are permitted only to query data; a restricted account can access only the telemetry ingest and query APIs).
   4. Click Save and copy the token. This is the only time the service account's token is displayed; if you lose it, delete and recreate the service account.

   Where to find the other values:

   • Instance URL: Your tenant address, INSTANCE.chronosphere.io (the address you sign in to).

   Chronosphere shows the secret only once, so copy it before you leave the page.

   Chronosphere docs now redirect to Palo Alto Networks' Cortex XCOR docs. Read-only is a subtype of a Restricted service account (an Unrestricted account has full access to all APIs, including administration). The exact control used to pick Read-only among the extra Restricted fields was not quoted verbatim.

   Source: docs-xcor.paloaltonetworks.com, checked 2026-10-07.

   The permissions Safeguard needs: read-only service account.

2. On Compliance › Connectors, open Chronosphere, click Connect, choose API token and fill in:

   Field	What to enter
   Instance URL	Required. An address under chronosphere.io.
   API token	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Chronosphere and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Observability connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks