Import Data from SecurityScorecard

Mondoo can import data from SecurityScorecard and combine it with your Mondoo findings. SecurityScorecard evaluates your external attack surface by domain across risk factors such as network security, DNS health, patching cadence, and application security. The unified view gives you Mondoo's security visualization, prioritization, and ticketing on top of that external posture data.

PrerequisitesCopy Anchor Link

• Editor or Owner access to the Mondoo space
• A SecurityScorecard account
• An API token from that account

Generate a SecurityScorecard API tokenCopy Anchor Link

1. Log into SecurityScorecard.
2. Go to My Settings > API.
3. Generate an API token and copy it. You need it in the next section.

To learn more, see the SecurityScorecard API documentation.

Add a SecurityScorecard integrationCopy Anchor Link

In the Mondoo App, navigate to the space where you want to add the integration. In the side navigation bar, select Integrations. In the top right, select INSTALL. On the Install Integration page, find the integration you want by browsing a category or searching by name:

1. Under Third-Party Data, select SecurityScorecard.

2. In Integration Name, enter a name for the integration.

3. Fill in:

   • Domain. The domain to import from your SecurityScorecard portfolio, for example example.com.
   • API Token. The token you generated in SecurityScorecard.

4. Leave Create new assets for unique detections enabled so Mondoo adds an asset for every domain SecurityScorecard discovers that doesn't already exist in this space. Disable it to only attach findings to assets you already track.

5. Select Create Integration.

What Mondoo importsCopy Anchor Link

Mondoo imports the domains and subdomains SecurityScorecard has discovered for your configured domain as assets. IP addresses that don't map to a known domain are imported as standalone assets. SecurityScorecard's findings are security issues and misconfigurations (such as weak TLS ciphers or missing DMARC records) rather than CVEs. They attach to the matching asset.

To see the imported assets, navigate to the space and select Inventory > Assets. Assess and improve your security to review and prioritize the findings alongside the rest of your inventory.

Manage this integrationCopy Anchor Link

To open an existing integration, navigate to the space, select Integrations in the side navigation, choose SecurityScorecard, then select the integration.

From the integration detail page, you can:

• Edit settings. Select the edit (pencil) icon to update the integration name, domain, or asset-creation preference. Leave API Token blank to keep the current token, or enter a new one to rotate it.
• Trigger an immediate import. Select Run.
• Remove the integration. Select the trash icon and confirm.

After you connectCopy Anchor Link

Once the import finishes, your SecurityScorecard findings appear in Mondoo alongside its own. Assess and improve your security to review and prioritize them.