Burp Suite
Connect Burp Suite to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Burp Suite to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.
| Category | Vulnerability Scanning |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Burp Suite's guide | portswigger.net |
Connect with an API token
-
In Burp Suite:
- Log in to Burp Suite DAST and go to Team › Add a new user.
- Enter a name and username that identify the user (for example Safeguard), and an email address (for example the admin user's email).
- Select the login type API Key.
- Click the save icon in the upper-right corner.
- When prompted, copy the API key and URL and save them somewhere secure. You cannot retrieve the API key for an existing user later.
- Add the API user to a group whose roles grant only the viewing access Safeguard needs. Burp Suite DAST assigns roles to groups, and you can restrict users' access to specific sites.
Where to find the other values:
- Server URL: The URL shown together with the API key when the API user is saved (the address of your Burp Suite DAST server).
Burp Suite shows the secret only once, so copy it before you leave the page.
API users cannot log in to the web UI. The exact role and permission names for a view-only group were not quoted in the fetched pages (see Managing roles locally / Managing groups locally in the DAST user guide). Applies to cloud and self-hosted Burp Suite DAST (formerly Burp Suite Enterprise Edition).
Source: portswigger.net, portswigger.net, checked 2026-10-07.
The permissions Safeguard needs:
view sites, scans and issues. -
On Compliance › Connectors, open Burp Suite, click Connect, choose API token and fill in:
Field What to enter Server URL Required. Your own server: an https address reachable from the internet. API key Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Burp Suite and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC7.1 | 3 |
| ISO/IEC 27001 | Automated tests | A.8.8 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1) | 3 |
| PCI DSS | Automated tests | 6.3.3, 11.3.1 | 3 |
| NIST CSF 2.0 | Automated tests | ID.RA-01, ID.RA-06 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Vulnerability Scanning connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks