D3 Security
Connect D3 Security to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect D3 Security to collect security automation evidence with automated compliance tests, switched on per workspace.
| Category | Security Automation |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| D3 Security's guide | docs.d3security.com |
Connect with an API token
-
In D3 Security:
- In D3 SOAR, go to Configuration › Integrations and open the integration or command whose webhook Safeguard will call.
- Open the command's card and, in the Webhook Authentication section, select the API Key option.
- Expand the row for the site you want and copy the request URL and the header value. The header name is d3key.
Where to find the other values:
- API URL: The request URL shown in the command's webhook configuration for the site.
- Header name: d3key.
- Header value: The header value (webhook key) shown with the request URL for the site.
- Username: The username of the D3 SOAR user account making the request.
- Site: The D3 SOAR site that holds the data; it is the site row you expanded in the webhook configuration.
D3 Security's public documentation does not cover every step.
The fetched D3 page shows the webhook steps for one integration (Microsoft Sentinel Fetch Incident); the exact button to generate a key for a utility command (such as Get Incidents) was not documented publicly. D3 REST APIs accept API keys or JWT and need Username and Site.
Source: docs.d3security.com, docs.d3security.com, checked 2026-10-07.
The permissions Safeguard needs:
the command's webhook key. -
On Compliance › Connectors, open D3 Security, click Connect, choose API token and fill in:
Field What to enter API URL Required. Your own server: an https address reachable from the internet. Header name Required. Header value Required. Username Required. Site Required. -
Click Connect with token.
Frameworks
Safeguard's automated tests read D3 Security and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC7.3, CC7.4 | 2 |
| ISO/IEC 27001 | Automated tests | A.5.26 | 2 |
| HIPAA Security Rule | Automated tests | 164.308(a)(6) | 2 |
| PCI DSS | Automated tests | 12.10.1 | 2 |
| NIST CSF 2.0 | Automated tests | RS.MA-03, RS.MI-02 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Security Automation connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks