Docs
Control checks
44 checks across 24 real integrations. Each row below is the exact controlId string to use when creating a check, from the dashboard or the REST API. See a category page for the exact API call, authentication method, and target format each check uses.
| controlId | Verifies |
|---|---|
tls-certificate-valid | A domain has a currently active TLS certificate within its validity window. |
github-branch-protection-enabled | A specific branch of a GitHub repository has branch protection enabled. |
github-org-2fa-enforced | A GitHub organization requires two-factor authentication for all members. |
gitlab-branch-protection-enabled | A specific branch of a GitLab project has a protected-branch rule enabled. |
gitlab-instance-2fa-enforced | A GitLab instance requires two-factor authentication for all users. |
bitbucket-branch-restrictions-enabled | A specific branch of a Bitbucket repository has at least one branch-restriction rule configured. |
jira-ip-allowlist-enforced | An enabled IP-allowlist policy exists for an Atlassian organization. |
aws-iam-mfa-enforced | MFA is enforced for IAM users and the account root user in an AWS account. |
webpage-accessibility-scan | A verified domain's own pages have no real axe-core WCAG 2.1 A/AA violations. |
cloudflare-dnssec-enabled | DNSSEC is enabled on a Cloudflare-managed DNS zone. |
digitalocean-firewalls-configured | At least one firewall is configured in a DigitalOcean account. |
okta-mfa-enforced | An Okta org's MFA enrollment policy requires at least one authentication factor. |
azure-ad-mfa-enforced | An Azure AD tenant has at least one enabled Conditional Access policy requiring MFA. |
google-workspace-2fa-enforced | 2-Step Verification is enforced by org policy for active users in a Google Workspace domain. |
gcp-2sv-enforced | 2-Step Verification is enforced by org policy for active users in a Google Cloud organization. |
auth0-mfa-enforced | An Auth0 tenant enforces MFA for its users. |
duo-mfa-enrollment-enforced | MFA enrollment is required across a Duo Security integration. |
onelogin-mfa-enrolled | MFA enrollment is required across a OneLogin org. |
jumpcloud-mfa-enforced | At least one active JumpCloud policy enforces multi-factor authentication. |
slack-2fa-enforced | Two-factor authentication is required workspace-wide for a Slack workspace. |
datadog-sso-enforced | SSO is enforced for a Datadog org. |
crowdstrike-sensor-health-enabled | CrowdStrike sensors report healthy across a tenant. |
pagerduty-ip-allowlist-enforced | An IP allowlist is enforced for a PagerDuty account. |
servicenow-mfa-enforced | MFA is enforced for a ServiceNow instance. |
zendesk-2fa-enforced | Two-factor authentication is required for a Zendesk account. |
jamf-filevault-enforced | FileVault disk encryption is enforced across devices managed by Jamf Pro. |
microsoft-intune-device-compliance | Devices report compliant against their assigned Microsoft Intune compliance policy. |
snowflake-mfa-enforced | MFA is enforced for users in a Snowflake account. |
webpage-accessibility-flow-scan | A defined multi-step user journey (for example a signup or checkout flow) on a verified domain has no real axe-core WCAG 2.1 A/AA violations across any of its pages. |
webpage-cookie-consent-scan | A verified domain's own homepage presents a compliant cookie-consent banner before setting non-essential cookies. |
aws-s3-encryption-enforced | Every S3 bucket in an AWS account has default server-side encryption enabled. |
aws-s3-public-access-blocked | Every S3 bucket in an AWS account has all four public-access-block settings enabled. |
aws-rds-encryption-enforced | Every RDS database instance in an AWS account has storage encryption enabled. |
aws-rds-automated-backups-enabled | Every RDS database instance in an AWS account has automated backups enabled. |
aws-kms-key-rotation-enabled | Every rotation-eligible KMS key in an AWS account has automatic key rotation enabled. |
aws-ec2-security-groups-restricted | No security group in an AWS account exposes a sensitive port to the public internet. |
aws-cloudtrail-enabled | An AWS account has at least one multi-region CloudTrail trail that is actively logging. |
azure-storage-accounts-secure | Every Storage Account in an Azure subscription enforces HTTPS-only traffic and disallows anonymous public blob access. |
azure-sql-server-secure | Every Azure SQL server enforces TLS 1.2 or higher and has auditing enabled. |
azure-key-vault-secure | Every Key Vault in an Azure subscription has soft-delete, purge-protection, and RBAC authorization enabled. |
azure-nsg-restricted | No Network Security Group rule in an Azure subscription allows a sensitive port in from the public internet. |
gcp-storage-buckets-secure | Every Cloud Storage bucket in a Google Cloud project has uniform bucket-level access enabled and no public IAM binding. |
gcp-vpc-firewall-restricted | No enabled ingress VPC firewall rule in a Google Cloud project allows a sensitive port in from the public internet. |
gcp-cloud-sql-secure | Every Cloud SQL instance in a Google Cloud project requires SSL/TLS connections and has automated backups enabled. |