Instana
Connect Instana to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Instana to collect observability evidence with automated compliance tests, switched on per workspace.
| Category | Observability |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Instana's guide | ibm.com |
Connect with an API token
-
In Instana:
- Log on to your Instana account.
- From the navigation menu in the Instana UI, click Settings.
- On the Security & access tab, in the Access Control section, click API tokens.
- Enter a name for your token and set the appropriate permissions.
- After the API token is generated, copy it and keep it secure.
Where to find the other values:
- Instance URL: The address of your Instana UI; IBM documents the API base URL as https://<TENANT>-<UNIT>.instana.io/api, where <TENANT>-<UNIT> is your tenant and unit name.
Instana's public documentation does not cover every step.
The menu path and base URL come from IBM's 'Instana REST API and SDKs' page. The button label for creating the token and the exact permission checkbox names (for alert configuration and user read access) were not on a page that could be fetched: the IBM Docs pages 'Web REST API' and 'Getting Started with the Instana REST API' returned HTTP 404 to automated fetches. IBM search snippets (not verified on a fetched page) say creating unit-specific API tokens needs the API token configuration permission assigned through an Instana group, and that personal API tokens (Settings > User Settings > Personal API Tokens) inherit the creating user's permissions. Whether the token is shown only once is not stated.
Source: ibm.com, checked 2026-10-07.
The permissions Safeguard needs:
alert configurations and users: read. -
On Compliance › Connectors, open Instana, click Connect, choose API token and fill in:
Field What to enter Instance URL Required. An address under instana.io. API token Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Instana and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3, CC7.2 | 3 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.16 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.312(b) | 3 |
| PCI DSS | Automated tests | 7.2.4, 8.2.5, 10.4.1 | 3 |
| NIST CSF 2.0 | Automated tests | DE.CM-01, PR.AA-01, PR.AA-05 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Observability connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks