Grafana
Connect Grafana to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Grafana to collect observability evidence with automated compliance tests, switched on per workspace.
| Category | Observability |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Grafana's guide | grafana.com |
Connect with an API token
-
In Grafana:
- Sign in to Grafana and click Administration in the left-side menu.
- Click Users and access › Service accounts › Add service account.
- Enter a Display name, pick the Viewer role in the role picker, and click Create.
- On the service account, click Add service account token, enter a name, optionally set an expiration date, and click Generate token. Copy the token.
- If Viewer does not cover what Safeguard reads, in Grafana Enterprise combine the service account with role-based access control to grant only the specific permissions Safeguard needs.
Grafana's public documentation does not cover every step.
The fetched page does not quote whether the token is shown only once, and does not list the RBAC actions included in the Viewer role; whether Viewer includes alert.provisioning:read was not verified. Verification: the RBAC action names (org.users:read, alert.provisioning:read, serviceaccounts:read) and the Instance URL hint (Grafana Cloud stack under grafana.net) were not on the fetched page and were removed from the steps.
Source: grafana.com, checked 2026-10-07.
The permissions Safeguard needs:
org.users:read,alert.provisioning:read,serviceaccounts:read. -
On Compliance › Connectors, open Grafana, click Connect, choose API token and fill in:
Field What to enter API token Required. Stored encrypted and never shown again. Instance URL Required. An address under grafana.net. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Grafana and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3, CC7.2 | 5 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.17, A.5.18, A.6.5, A.8.2, A.8.16 | 5 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.312(b) | 4 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5, 8.6.3, 10.4.1 | 5 |
| NIST CSF 2.0 | Automated tests | DE.CM-01, PR.AA-01, PR.AA-05 | 5 |
These tests are switched on per workspace by the Safeguard team.
Related
- Observability connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks