CloudAzure Integration
Discover Azure cloud exposure, API services, identity context and telemetry for attack-path validation.
Deterministic evidenceScope-aware executionAdaptive capability
What this covers
Azure Integration: enrich context before validation and move evidence after it.
Integrations should be specific: what data comes in, what evidence goes out and how teams act on validated findings.
01What comes in
- Asset, API, service, log, repository, gateway, ownership or telemetry context depending on the integration.
- Metadata that helps ThreatCanary map relationships, identify owners and understand behaviour.
- Signals that improve discovery, drift detection, sensitive data classification and attack-path reasoning.
02What goes out
- Validated findings with affected assets, APIs, evidence, severity rationale and remediation guidance.
- Exposure changes, attack-path events, retest outcomes and owner assignments.
- Links back to ThreatCanary so analysts and engineers can review full evidence chains.
03How it helps teams
- Reduces manual copying between security, engineering and operations tools.
- Routes work to the team that owns the affected asset or API.
- Keeps remediation, reporting and detection workflows connected to the same evidence.
04Governance
- Use least-privilege credentials and approved scopes for integration access.
- Audit configuration changes, exports, credential use and sensitive workflow actions.
- Disable or limit integrations when policy, region or data-handling requirements demand it.
