AttackIQ — Integration Setup

What this integration is for: breach-and-attack-simulation results are the strongest evidence CMDash accepts — a control that has been tested rather than merely attested. AttackIQ observations are ingested at the VALIDATED tier, above anything a questionnaire or policy can produce.

Prerequisites

• An AttackIQ Security Optimization Platform tenant (SaaS app.attackiq.com, or a self-hosted deployment with its own hostname)
• An AttackIQ API token
• Completed assessment runs — an empty results feed produces no observations
• The AttackIQ platform reachable from CMDash's sync workers over the public internet (see the base-URL note in Step 2)
• CMDash Essentials tier or above

Step 1: Create an API Token

1. Log in to AttackIQ and open your user profile / Settings → API Token (the exact location varies by platform version).
2. Generate a token and copy it immediately.
3. Prefer a token owned by a dedicated, read-only service user.

Minimum privileges. The adapter issues two GET requests and nothing else: the results feed and the scenario catalog. It never starts, schedules, stops, or edits an assessment, and never touches assets or agents. Grant the service user read access to assessment results and, if your platform separates it, the scenario catalog — no operator, admin, or asset-management role is required. If your tenant restricts results visibility per project/assessment, the token only sees what that user sees, so scope it to the assessments you want evidenced rather than granting a broad role.

Token transport. CMDash sends the token as Authorization: Bearer <token>. If your AttackIQ deployment expects a different token scheme, the connection will return 401 no matter how the token is scoped — raise it with CMDash support rather than widening permissions.

Step 2: Connect in CMDash

1. Navigate to Integrations in your CMDash dashboard.
2. Find AttackIQ and click Connect.
3. Enter:
   • API Key — the AttackIQ token from Step 1 (stored as this connection's access token)
   • Configuration (JSON), only if you are not on the SaaS platform:
     jsonCopy

     { "baseUrl": "https://attackiq.example.com" }
     

4. Click Connect.

Base URL format:

• Omit baseUrl entirely to use the SaaS default, https://app.attackiq.com.
• Self-hosted deployments must set it to their own console hostname — scheme and host only (plus a port if non-standard). CMDash appends /v1/... itself; a trailing slash is stripped for you, a trailing /v1 is not and yields 404.
• The host must be publicly resolvable. CMDash validates it when you save the connection and again on every request; private/reserved addresses and .internal / .local / localhost hosts are refused, so an on-premises appliance needs a public hostname or reverse proxy.

What Syncs

Each usable result becomes a BAS_CONTROL_VALIDATION maturity observation at the VALIDATED tier, timestamped with the run's own execution time (not the sync time), and linked back to the AttackIQ report URL when the platform supplies one. Outcomes map as:

The scenario catalog supplies each result's ATT&CK technique (the first tagged technique is used) and, where AttackIQ's compliance-mapping module is enabled, its control-framework tags. Only two framework labels are recognised, exactly as spelled:

• NIST CSF 2.0
• CIS Controls v8 (and the shorter CIS Controls)

Any other label is deliberately dropped rather than guessed at, and the result is still ingested — just without a control stamp. If your AttackIQ mappings use different framework names, renaming them to the two labels above is what turns these results into control evidence. Catalog fetch failures are non-fatal for the same reason: results still land, without control references.

Troubleshooting

The connection detail page shows the health check's message. The health check calls GET {baseUrl}/v1/results?limit=1, so it exercises the same credential and reachability path a sync does:

• HTTP 401: The token was revoked or regenerated, or the deployment does not accept a Bearer token.
• HTTP 403: The token's user cannot read assessment results.
• HTTP 404: baseUrl carries an extra path segment, or points at something other than the AttackIQ console.
• URL host not allowed: … / … resolves to a private/reserved address: The platform host is internal-only; CMDash's workers cannot reach it by design.
• Request to <host> timed out: No response within 15 seconds.
• AttackIQ circuit open — provider recently failing repeatedly: 5 failures inside 60 seconds tripped the per-tenant breaker; it fails fast for a 30-second cool-off and then probes.
• Sync log shows AttackIQ results API failed: <status>: The results feed returned non-2xx mid-run. This is the one required dataset, so the whole sync attempt fails and is retried.
• Observations appear with no control reference: Either the scenario catalog fetch failed (logged as AttackIQ scenario-catalog fetch failed … — non-fatal by design) or the scenario's framework labels are not one of the two recognised strings above.
• Sync reports success but zero observations were created: Every result was filtered out. The usual causes are (a) every outcome was ERROR or an unrecognised value, or (b) the results feed is returning a shape the adapter does not recognise — it expects a JSON array of objects carrying id, scenarioId, outcome, and ranAt. If your platform version returns a paginated envelope or snake-cased fields, report it to CMDash support; no permission change will fix it.
• Old results stop counting: BAS_CONTROL_VALIDATION observations decay on a 90-day half-life. Re-running the assessment is what refreshes the evidence.

Rate Limits & Sync Behavior

Credential Rotation

AttackIQ API tokens do not carry an expiry CMDash can read, so no expiry warning banner is shown for this integration. Rotate on your own cadence — quarterly, or whenever the owning service user changes.

To rotate:

1. In AttackIQ, generate a new token for the same service user.
2. In CMDash: Settings → Integrations → AttackIQ → Edit.
3. Enter the new API Key and Save.
4. Revoke the old token in AttackIQ once the connection reports healthy.

Multiple Instances / Multi-Site

Each connection reads one AttackIQ platform through one token. Separate deployments — or separate service users scoped to different assessment sets — each need their own CMDash connection.

To add another:

1. Create a token in the additional AttackIQ deployment, following Step 1.
2. In CMDash: Settings → Integrations → Add Integration → AttackIQ.
3. Enter the token and, for a self-hosted platform, its baseUrl.
4. Give the connection a descriptive name (e.g. AttackIQ - Prod, AttackIQ - Lab).
5. Click Connect.

Validation evidence from every connection feeds the same control-validation rollup, alongside SafeBreach if you run both.

Compliance Framework Coverage

Unlike most integrations, AttackIQ's control coverage is driven by your own scenario mappings rather than a fixed table — the adapter stamps whatever your platform reports, provided the framework label is one it recognises.

Results whose scenarios carry no recognised mapping still count toward control-validation maturity and ATT&CK technique coverage; they simply do not stamp a specific control.