Coalition Control — Integration Setup

Prerequisites

• Active Coalition cyber insurance policy with Coalition Control entitlement
• Coalition Control admin access to your organization
• CMDash Command tier or above (insurance adapters require Command)

Step 1: Generate a Control API Key

1. Log in to Coalition Control.
2. Go to Settings → Developer → API Keys.
3. Click Generate New Key.
4. Name: CMDash Integration.
5. Scope: Read-only.
6. Expiration: 90 days (rotate before expiry).
7. Copy the generated key.

Step 2: Locate Your Policy ID

1. In Coalition Control, go to Policies.
2. Click the active policy, copy the Policy ID from the URL or metadata panel.

Step 3: Connect in CMDash

1. Navigate to Integrations in your CMDash dashboard.
2. Find Coalition Control and click Connect.
3. Enter:
   • API Key
   • Policy ID
   • Base URL (default https://api.coalition.com)
4. Click Save & Test Connection.

What Syncs

Coalition's alerts are exposure-level findings (open RDP, expired TLS, missing patches on internet-exposed hosts) — CMDash normalizes these into the Vulnerability data model so they surface on the Risks page alongside CVEs from scanners like Tenable or Qualys.

Severity Mapping

• CVSS score >= 9 → critical
• CVSS 7 – 8.9 → high
• CVSS 4 – 6.9 → medium
• CVSS 0.1 – 3.9 → low
• Otherwise, Coalition's severity string is used as-is

Known Limitations

• Alerts are read 500 per request, up to a ceiling of 25,000 per sync. Reaching the ceiling, a failed later page, or a Coalition API that ignores offset shows the sync as Partial with a warning instead of Healthy. Coalition's alerts API reference is not public, so the offset parameter is confirmed only by the live canary (docs/integrations/drift-canary.md).

• Coalition does not currently expose claim or insurance-policy data via API. Only attack-surface findings are ingested.

• Deep remediation guidance lives in the Coalition Control UI; CMDash surfaces the finding + affected asset + CVE only.

• Adapter reads are scoped per-policy. If you hold multiple Coalition policies, each needs its own CMDash connection.

Troubleshooting

• HTTP 401: API Key scope is probably still set to admin — downgrade it to read-only or regenerate. Coalition rejects admin keys for unattended API use.
• No alerts visible: if your policy's discovery pass is still in progress (typical for new policies), wait 24 hours after Coalition's initial scan completes.
• Dropped alerts: Coalition deduplicates alerts across discovery passes, which can cause historical alerts to disappear from the /v1/alerts?status=open endpoint. CMDash's lastSyncAt filter relies on updated_since, so dedup is invisible to us.