ThreatConnect
Connect ThreatConnect to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect ThreatConnect to collect security automation evidence with automated compliance tests, switched on per workspace.
| Category | Security Automation |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| ThreatConnect's guide | docs.threatconnect.com |
Connect with an API token
-
In ThreatConnect:
- Log in to ThreatConnect with an Organization Administrator account.
- From the Settings menu in the top navigation bar, select Org Settings. On the Membership tab, click Create API User.
- In the API User Administration window, fill out the required fields. Set System Role to Api User and choose the least-privileged Organization Role available.
- Optionally enter the number of days in Token Expiration (days).
- To use Access ID and Secret Key, record the Secret Key and the Access ID, then click SAVE. To use an API token instead, click SAVE USER AND GENERATE TOKEN and copy the token.
Where to find the other values:
- Base URL: Public Cloud: https://app.threatconnect.com/api. Dedicated or on-premises: your own instance's address.
ThreatConnect shows the secret only once, so copy it before you leave the page.
The Secret Key is not accessible after the API User Administration window closes. The Organization Role option names were not listed on the fetched page; pick a read-only role if your org has one.
Source: knowledge.threatconnect.com, docs.threatconnect.com, checked 2026-10-07.
-
On Compliance › Connectors, open ThreatConnect, click Connect, choose API token and fill in:
Field What to enter Base URL Optional. Your own server: an https address reachable from the internet. Access ID Optional. Secret key Optional. Stored encrypted and never shown again. Or, instead: API token (optional).
-
Click Connect with token.
Frameworks
Safeguard's automated tests read ThreatConnect and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 2 |
| ISO/IEC 27001 | Automated tests | A.5.18 | 2 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 2 |
| PCI DSS | Automated tests | 7.2.1, 8.2.5 | 2 |
| NIST CSF 2.0 | Automated tests | PR.AA-01 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Security Automation connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks