Checkmk
Connect Checkmk to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Record your Checkmk connection as observability evidence. Automated collection is not available for this provider yet.
| Category | Observability |
| Connect with | API token |
| What a connection produces | Connection record |
Connect with an API token
-
In Checkmk:
- In Checkmk, go to Setup › Users › Users and create a dedicated user for Safeguard (for example automation).
- When creating it, set the Automation secret for machine accounts; that secret is the API password.
- Under Setup › Users › Roles and permissions, give the user a role limited to what Safeguard reads.
- Safeguard sends the credentials as the header Authorization: Bearer <USERNAME> <AUTOMATION SECRET>; enter the secret in the token field and the user name in Account.
Where to find the other values:
- Base URL (optional): {PROTO}://{HOST_NAME}/{SITE_NAME}/check_mk/api/{API_VERSION}, for example http://myserver/mysite/check_mk/api/v1.
- Account / Org / Workspace (optional): The automation user's name (or your site name, which is part of the base URL).
Checkmk's public documentation does not cover every step.
Record-only connector. Checkmk notes that using all REST API endpoints needs fairly extensive permissions; no read-only role name is given on the fetched page, which also does not say how the automation secret is generated or whether it can be viewed again.
Source: docs.checkmk.com, checked 2026-10-07.
-
On Compliance › Connectors, open Checkmk, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Checkmk publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Attestation | CC6.2, CC6.3, CC7.2 | 2 |
| ISO/IEC 27001 | Attestation | A.5.18, A.8.16 | 2 |
| HIPAA Security Rule | Attestation | 164.308(a)(1), 164.308(a)(3) | 2 |
| PCI DSS | Attestation | 7.2.4, 10.4.1 | 2 |
| NIST CSF 2.0 | Attestation | DE.AE-06, PR.AA-05 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Observability connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks