Connector matrix
| Provider | Signal | 800-171 controls | Why it counts |
|---|---|---|---|
| AWS | CloudTrail events | AU-2AU-6AU-12 | Auditable events, review, and audit record generation. |
| AWS | Config compliance | CM-6CM-8 | Configuration settings and system component inventory. |
| AWS | IAM users + keys | AC-2AC-6IA-2IA-5 | Account management, least privilege, MFA, authenticator management. |
| AWS | GuardDuty findings | SI-4 | System monitoring. |
| Entra ID | Sign-in logs | AC-7IA-2 | Unsuccessful logon attempts, user identification and authentication. |
| Entra ID | Conditional access | AC-3AC-17IA-2(1) | Access enforcement, remote access, MFA to privileged accounts. |
| Entra ID | User inventory | AC-2 | Account management. |
| GitHub | Org 2FA | IA-2 | User identification and authentication. |
| GitHub | Branch protection | CM-3CM-4 | Configuration change control and analysis. |
| GitHub | Audit log | AU-2AU-6AU-12 | Auditable events, review, generation. |
| GitHub | Secret scanning | SA-11 | Developer testing and evaluation. |
| Endpoint agent | Host state (patch, config) | CM-6CM-7SI-2 | Config, least functionality, flaw remediation. |
| Endpoint agent | AV / EDR presence | SI-3 | Malicious code protection. |
| Endpoint agent | Disk encryption | SC-28 | Protection of information at rest. |
| Endpoint agent | Firewall state | SC-7 | Boundary protection. |
| Endpoint agent | Local admin membership | AC-6 | Least privilege. |
| Endpoint agent | Failed logon count | AC-7AU-2 | Unsuccessful logon attempts + auditable event. |
| BYO webhook | Any HMAC-signed JSON | configurable | Pipe Splunk / Tenable / Wiz / n8n. Map to controls on the connection. |
Pull-based (AWS, Entra ID, GitHub)
Configure once at /systems/{id}/integrations. Symbiosis runs the collector on a schedule and on demand. Findings land in the ConMon feed and attach to the mapped controls.
Push-based (endpoint agent, BYO)
Get an HMAC secret at connect time. The agent or your webhook posts JSON to a per-connection URL. Signatures are verified with timing-safe compare before anything hits the database.