Integrations
The integration hub connects CMDash to the security and IT tools in your environment. Integrations are the primary source of data for posture signals, compliance evidence, and risk context. CMDash supports 23+ connectors [Command+] with a subset available on lower tiers (Starter: up to 3 integrations; Essentials: up to 10 integrations). See the pricing & entitlement matrix for the canonical tier limits.
Integration Hub Overview
Navigate to Integrations to see the full list of available and connected integrations. The hub is divided into two tabs:
- Connected — integrations that are active and syncing
- Available — the full library of connectors not yet configured
For each connected integration, the hub shows:
- Name and logo of the integration
- Health status — a color-coded badge (green = healthy, amber = warning, red = error)
- Last synced — the timestamp of the most recent successful sync
- Data types — what categories of data this integration provides (e.g., assets, vulnerabilities, alerts, user identities)
- Mapped controls — a count of how many compliance controls this integration's data is currently linked to as evidence
Connecting an Integration
Click Add Integration or select an integration from the Available tab. You will be directed to a setup flow specific to that integration. The general steps are:
- Select the integration from the library.
- Enter credentials — typically an API key, OAuth token, or service account credentials. Credentials are encrypted at rest and in transit.
- Configure scope — select which data types to pull (some integrations offer granular selection of asset groups, severity levels, etc.).
- Test connection — CMDash validates the credentials and attempts a test sync.
- Save — once validated, the integration is activated and a full initial sync begins.
Individual integration setup guides with step-by-step instructions for each connector are available in the docs:
- CrowdStrike Falcon
- Tenable
- Duo Security
- Microsoft Defender
- SentinelOne
- Carbon Black
- Cisco Umbrella
- Proofpoint
- Coalition
- Amazon Web Services (configuration checks through a read-only IAM role)
- AWS Security Hub
Amazon Web Services and AWS Security Hub sign in with an IAM role you create, so CMDash never holds a secret from your account. On the Connect form, keep Create a role with CloudFormation (recommended) selected. CMDash shows an External ID it issued for the connection and the CMDash principal to trust. Create the role from the CMDash CloudFormation template (a Launch the stack in AWS link appears on the form when your deployment publishes the template to Amazon S3; otherwise download the template from the form and upload it in CloudFormation), copy the stack's RoleArn output, paste it into IAM role ARN, then Test Connection and Connect. CMDash will not connect a role whose trust policy does not require the External ID. The access-key mode remains for connections made before role mode existed. The full steps, permissions and troubleshooting are in the AWS setup guide.
Understanding Sync Data
Each integration provides one or more data types. Common data types and their uses in CMDash:
| Data Type | Example Sources | Used For |
|---|---|---|
| Vulnerabilities | Tenable, CrowdStrike, Qualys | Posture signals 1 and 3; evidence for ID.RA controls |
| User Identities and MFA Status | Duo, Okta, Azure AD | Posture signal 2; evidence for access control requirements |
| Endpoints and Assets | CrowdStrike, SentinelOne, Defender | Asset inventory; scope for vulnerability signals |
| Security Alerts and Incidents | SIEM, EDR tools | Posture signal 4; evidence for Detect and Respond controls |
| Policy and Configuration | Cloud security tools | Evidence for Configuration Management controls |
| Email Security | Proofpoint | Evidence for Protect controls; phishing incident frequency |
Sync Frequency
Each integration syncs on a schedule: every 4 hours by default, and never more often than your plan allows — once a day on Free, every 4 hours on Starter, and hourly on Essentials and above. CMDash checks every 15 minutes for integrations that are due, and the detail panel shows the interval an integration actually syncs at.
Sync Now on the integration's detail panel queues a sync straight away, once per plan window. Inside the window it tells you when the next sync is available. Scheduled syncs count toward the same window.
Some integrations can also push changes through webhooks; where supported, this is noted in the integration's setup guide. On Essentials and above an event triggers a sync within 5 minutes. On Free and Starter an event triggers a sync straight away when the plan's window is open; inside the window it is synced when the window ends, together with everything else that changed.
Self-hosted installs have no plan limit by default: each integration syncs at its own interval. See the self-hosting guide, "Integration sync frequency".
Credential Rotation Reminders
If an integration uses API keys or tokens with an expiry, CMDash tracks the configured expiry date and sends a reminder notification 30 days before expiration, and again at 7 days. To update credentials, open the integration's detail panel, click Edit Credentials, and enter the new values. The integration continues syncing without interruption if the new credentials are saved before the old ones expire.
Deactivating an Integration
To stop using an integration without losing its setup, choose Deactivate on its card or detail page (Owners and Admins). CMDash keeps the connection, its settings and its stored credentials, but stops syncing it, stops checking its health, and leaves it out of the integration health counts, coverage and "needs attention" lists. It shows a Deactivated badge, and the Integrations summary reports it separately.
Reactivate resumes it. CMDash re-checks the stored credential with the provider first: the integration becomes Active only if the check passes, and is Unhealthy if it does not. A deactivated integration does not use one of your plan's integration slots, so Reactivate is subject to the plan limit like a new connection.
Deactivate is not Disconnect: Disconnect erases the stored credentials and you must enter them again to reconnect.
Integration Health Alerts
When an integration fails to sync, CMDash generates a health alert. The alert appears in the notification center and (if configured) is delivered to the channels set up in the Notifications section. Integration health alerts are categorized by severity:
- Warning — sync completed but with partial data (e.g., rate limit reached, some assets missing)
- Error — sync failed; data may be stale
When an integration is in an error state, posture signals that depend on that integration's data are flagged with a staleness indicator in the Posture view and on the Dashboard signal cards. This prevents stale data from artificially inflating or deflating your score without visibility.