StackRox
Connect StackRox to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect StackRox to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.
Step-by-step guide: Connect StackRox.
| Category | Vulnerability Scanning |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| StackRox's guide | docs.redhat.com |
Connect with an API token
-
In StackRox:
- In the StackRox / RHACS portal, go to Platform Configuration › Integrations.
- Scroll to the Authentication Tokens category and click API Token.
- Click Generate Token.
- Enter a name for the token and select the role Analyst (read-only access for all resources).
- Click Generate, then copy the generated token. You will not be able to view it again.
Where to find the other values:
- Instance URL: The URL of your StackRox Central portal (the address you use to open the web console).
StackRox shows the secret only once, so copy it before you leave the page.
StackRox is the upstream open-source project of Red Hat Advanced Cluster Security; steps are from the RHACS 4.11 docs (the vendor_doc given), and community StackRox builds may differ slightly by version. API tokens expire one year after creation.
Source: docs.redhat.com, docs.redhat.com, checked 2026-10-07.
The permissions Safeguard needs:
Analyst (system role). -
On Compliance › Connectors, open StackRox, click Connect, choose API token and fill in:
Field What to enter Instance URL Required. Your own server: an https address reachable from the internet. API token Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read StackRox and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC4.1, CC6.1, CC6.3, CC6.7, CC6.8, CC7.1, CC7.2, CC7.3 | 13 |
| ISO/IEC 27001 | Automated tests | A.5.17, A.5.25, A.8.2, A.8.8, A.8.9, A.8.16, A.8.24 | 13 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(8), 164.312(b) | 10 |
| PCI DSS | Automated tests | 2.2.1, 6.3.3, 7.2.2, 8.6.3, 10.4.1, 11.3.1 | 9 |
| NIST CSF 2.0 | Automated tests | DE.AE-02, DE.CM-01, ID.IM-02, ID.RA-01, ID.RA-06, PR.AA-01, PR.AA-05, PR.PS-01 | 10 |
These tests are switched on per workspace by the Safeguard team.
Red Hat Advanced Cluster Security connect to the same provider as StackRox, and these tests run for a connection made through any of them.
Related
- Vulnerability Scanning connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks