47 tools you already own

Pulls managed hosts, detections, and host vulnerabilities from Falcon so endpoint-protection controls are evidenced by live agent coverage rather than a spreadsheet.

Onboarded devices, alerts, and software vulnerabilities from Defender for Endpoint, mapped to endpoint and vulnerability-management controls.

Agent inventory, threats, and patch status from SentinelOne — the one adapter that reports patch state directly, feeding remediation-timeliness evidence.

Endpoint inventory and incidents from Cortex XDR, evidencing endpoint-protection coverage against your control set.

Sensor inventory and alerts from Carbon Black Cloud, so agent coverage is measured rather than assumed.

macOS fleet inventory from Jamf Pro with FileVault boot-volume encryption state, OS version, and management-framework connectivity — the evidence a CC6.7 device-encryption control actually needs.

Managed-device inventory from Intune via Microsoft Graph — device encryption state, OS version, enrolment status, and last sync across Windows, macOS, iOS and Android.

Apple device inventory from Kandji with FileVault state, OS version, agent connectivity, and lost-device status folded into managed coverage.

Scan findings and scanned assets from Tenable.io or Nessus, including how long findings have been open against your remediation SLA.

Detections and host assets from Qualys VMDR, including how long each finding has been open against your remediation SLA.

Vulnerability findings and asset inventory from Rapid7 InsightVM, including finding age against your remediation SLA.

External attack-surface findings from Coalition Control — the outside-in view your cyber insurer is already looking at.

Reads your AWS configuration directly — root MFA, root access keys, password policy, S3 Block Public Access, CloudTrail, KMS key rotation and EBS encryption. Needs a read-only IAM credential and nothing else; no Security Hub subscription required.

Reads your Azure subscription configuration directly — storage account public access and secure transfer, managed-disk encryption, and activity-log export. Needs a Reader role assignment; no Defender for Cloud plan required.

Reads your GCP project configuration directly — bucket public-access prevention and uniform access, Data Access audit logs, user-managed service-account keys, and Cloud KMS rotation. Needs a read-only service account.

Findings and compliance-standard results from Security Hub, so AWS control state is evidence rather than a screenshot.

Security alerts, recommendations, and regulatory-compliance state across your Azure subscriptions.

Cloud issues and vulnerability findings from Wiz across every connected account, mapped to cloud-security controls.

Alerts and vulnerability findings from Orca’s agentless cloud scanning.

Notable events from Splunk ES, plus correlation-search coverage that shows which ATT&CK techniques you can actually detect.

Incidents from Microsoft Sentinel, plus analytics-rule coverage showing which ATT&CK techniques you can actually detect.

Detections from Chronicle’s rule engine, normalised alongside every other source so one incident view spans your whole estate.

Detection-rule coverage from Elastic Security, mapped to ATT&CK techniques so detection gaps are visible.

MFA enrolment and factor coverage, suspicious sign-in events, and the SaaS app catalog — the broadest identity signal cmdash ingests.

MFA registration and conditional-access posture from Entra ID (formerly Azure AD), via Microsoft Graph.

MFA enrolment and device coverage from Duo, turning multi-factor control claims into a percentage you can show.

2-Step Verification enrolment, super and delegated admin counts, dormant and suspended accounts, and the third-party OAuth apps your users have authorised — read-only, via the Admin SDK.

MFA enrolment and privileged (sudo) accounts from the JumpCloud directory, plus managed-device inventory with OS version, full-disk encryption state, agent connectivity, and last check-in.

Syncs the employee roster with hire and termination dates, so joiner/leaver evidence and access reviews come from HR’s own system of record instead of a spreadsheet.

Pulls employees and contractors from one worker feed with employment status, start and end dates, and reporting lines — the roster behind onboarding, offboarding, and access-review evidence.

Reads employees and contractors across every company the connection administers, with hire and termination dates — without ever requesting the compensation scope.

Syncs the Workday worker roster — employees and contingent workers, supervisory organization, and management chain — from the Staffing REST API for joiner/leaver and access-review evidence.

Background-screening STATUS and dates for your people — who was screened, when it was requested, and whether it came back — as SOC 2 CC1.4 evidence. Report contents and the clear/consider outcome are never read.

Background-screening STATUS and dates for Canadian, UK and international hiring, as SOC 2 CC1.4 evidence. Like Checkr, cmdash reads the lifecycle only — never the report or its result.

Threat events from Proofpoint Targeted Attack Protection, including click activity.

Blocked DNS requests and security events from Umbrella, evidencing perimeter and web-filtering controls.

Dependabot, code-scanning, and secret-scanning alerts across your repositories, as evidence for secure-development controls.

Branch protection and merge-approval settings across your organisation’s repositories — the SOC 2 CC8.1 / ISO A.8.32 evidence that a change cannot reach production without review. Plain GitHub; no Advanced Security licence required.

Protected-branch and merge-approval settings across your GitLab groups, on GitLab.com or a self-managed instance, evidencing that changes are authorised before they merge.

Two-way: security issues flow in, and cmdash can open a Jira issue for a remediation task so the work happens where your team already works.

Security incidents flow in from ServiceNow, and cmdash pushes remediation tasks back as records so the work is tracked where your team already tracks it.

Phishing-simulation results and training completion, turning security-awareness controls into a measured number instead of an attestation.

Breach-and-attack-simulation results from AttackIQ — evidence a control was TESTED, not merely attested.

Simulation results from SafeBreach, feeding the same tested-vs-attested credibility gate as AttackIQ.

Data-loss-prevention policy violations from Purview via Microsoft Graph, so data-protection controls are evidenced by what the DLP engine actually caught rather than by the policy document that describes it.

Reads your CISO Assistant risk scenarios, applied controls, requirement assessments, policies and evidence over its REST API and maps them onto CMDash — the same migration the CSV importer does, without exporting five files by hand. Preview every row before anything is written.

Define your own HTTP/REST source — endpoint, auth, request template and a field mapping — and CMDash syncs it on a schedule like any built-in connector. No CMDash release required, and no waiting for a vendor to be added.