Send evidence to Vanta
Vanta is a compliance platform that tracks tests and controls for SOC 2, ISO 27001, CMMC, and other frameworks. Gardience can send it what it knows about your fleet every hour, so the servers Gardience manages show up in Vanta next to your laptops and cloud accounts.
This connection is in preview: it is built and tested against Vanta's published API, and it appears in the console once it has been checked against a real Vanta account. Until then, Gardience support can turn it on for you.
What Gardience sends
#| In Vanta | What it holds |
|---|---|
| Vulnerable components | Every Windows and Linux machine. Vulnerabilities are filed under these. |
| Package vulnerabilities | Each open CVE on each machine: severity, whether a fix is out, the CVE id, and how to install the fix. Ones in CISA's Known Exploited Vulnerabilities catalog come first. |
| Windows computers | Windows 10 and 11 machines: system drive encryption, antivirus, firewall, and whether the Windows Update service is on. |
| Custom resource "Gardience machines" | One record per machine: hardening score, pending updates, restart needed, disk encryption, and vulnerability counts. |
Choose any of these. Vulnerabilities need the machines too, because Vanta files each vulnerability under its machine.
Gardience reports only what it has seen:
- A drive counts as encrypted only when Gardience has seen BitLocker on, or LUKS under
/. - Windows computers are sent with managed set to false: Vanta means a mobile device management system, and Gardience is not one.
- For antivirus other than Microsoft Defender, Gardience sees that the product is running but cannot read its signature age, so it never reports those signatures as current.
- Vanta takes at most 10,000 records in one send. With more open vulnerabilities than that, the least urgent are left out and the console says how many.
Connect
#You need the admin role, and an admin account in Vanta.
- In Vanta, open Settings > Developer Console and create an app for a private integration. Copy its client ID and client secret.
- In the app, find the resource ID Vanta shows for each record type you want to send.
For Gardience machines, first create a custom resource in Vanta (Resources > Create resource) with these properties:
Property Type osstring hardeningScoreint32 hardeningCheckedboolean pendingUpdatesint32 restartNeededboolean diskEncryptedboolean openVulnerabilitiesint32 fixableVulnerabilitiesint32 exploitedVulnerabilitiesint32 compliantboolean lastCheckedtimestamp - In the console, open Administration > Vanta.
- Choose Vanta or Vanta for Government (FedRAMP), paste the client ID and secret, and paste a resource ID for each record type you want. Leave a type empty to skip it.
- Click Connect and send. Gardience signs in to Vanta first and saves nothing if Vanta refuses.
The first send starts at once. After that Gardience sends every hour. Send now sends straight away.
In Vanta, write tests on the Gardience machines resource, for example "hardeningScore is at least 90" or "exploitedVulnerabilities is 0", and map them to your controls.
How it works
#- Each send replaces what Gardience sent before. A machine that leaves the fleet leaves Vanta at the next send.
- Gardience signs in with the app's client ID and secret on every send. The secret is sealed in the Gardience vault and sent only to Vanta.
- Gardience only sends. Nothing in Vanta changes a machine.
- If Vanta is limiting requests, Gardience waits and tries again, up to three times, then tries again the next hour.
- A failed send is recorded in the audit log (
vanta.send_failed) with Vanta's answer. Connecting and disconnecting are recorded too (vanta.connected,vanta.disconnected).
Disconnect
#Open Administration > Vanta and click Disconnect. Sends stop at once. What Gardience already sent stays in Vanta until you remove it there, or delete the app in Vanta's Developer Console.