Connect StackRox or Red Hat Advanced Cluster Security so Safeguard can check vulnerability timelines, policy violations, enforcement, notifiers and compliance results.

Connect StackRox (Red Hat Advanced Cluster Security)

Safeguard reads your StackRox Central with an API token, GET calls only: vulnerability findings per workload, cluster health, open policy violations, policy enforcement, notifiers and their health, and compliance scan results. The StackRox and Red Hat Advanced Cluster Security cards connect the same way, to a self-hosted Central or to an RHACS Cloud Service instance.

Before you start

Central must be reachable at a public https:// address. For RHACS Cloud Service, that is your instance's Central URL, for example https://acs-<id>.acs.rhcloud.com. Safeguard refuses private, loopback and cloud-metadata addresses before it sends anything.
The checks about workloads, vulnerabilities and violations need at least one secured cluster reporting to Central. Without one, Central-level checks (policies, notifiers, compliance) still run, and the cluster checks have nothing to evaluate.

1. Create an API token in Central

In Central, open Platform Configuration › Integrations.
Under Authentication Tokens, choose API Token, then Generate token.
Name it, for example "Safeguard compliance", and choose the Analyst role. Analyst reads every resource and changes none.
Click Generate and copy the token. Central shows it once.

2. Connect it in Safeguard

Open Compliance › Connectors, search for StackRox (or Red Hat Advanced Cluster Security) and click Connect.
Choose API token:

Field	What to enter
Instance URL	Your Central URL, for example `https://acs-<id>.acs.rhcloud.com`
API token	The token

Click Connect with token. The card shows Verified once Central accepts the token.

What Safeguard checks

Critical, high and medium vulnerabilities are fixed within their time limits
Scan coverage: every secured cluster's sensor is reporting to Central, so its workloads are assessed
Open violations of high and critical policies are triaged
Enforcement is turned on for deploy-time and runtime policies
A notifier is configured and healthy
Compliance scan results, per secured cluster

Troubleshooting

Not working, refusing the address: Central must be a public https:// address.
Not working with a 401 or 403: generate a new token with the Analyst role.