Appearance
Evidence Connections
Where to find it: Controls & Assurance, then Evidence Fabric (/evidence/fabric), then Connections.
A Connection (CON-YYYY-NNNN) is a configured, credentialed link to an external system that holds evidence about your control environment.
What a connection is
A connection is the access, not the collection. It says "OrviQ can reach this system, as this identity, with these permissions". What is actually collected is defined separately by a Collector.
Separating the two means one connection can serve many collectors — one link to your identity platform can feed collectors for MFA enforcement, privileged account inventory, dormant account detection and access review completion.
Connection statuses
| Status | Meaning |
|---|---|
active | Operating normally |
inactive | Configured but not in use |
degraded | Reachable but not performing correctly |
error | Failing |
A degraded connection produces stale evidence, not failing evidence
When a connection stops delivering, assertions do not turn to fail — they go stale. Effectiveness then reads not_assessed or partially_effective rather than ineffective, because a broken pipe is not a failing control. Monitor connection health directly; do not rely on control effectiveness to tell you a feed has stopped.
Credential handling
Credentials for connections are held securely and are never displayed after entry.
Principles:
- Use a dedicated service identity per connection, not a personal account.
- Grant the minimum read scope needed. A collector reading MFA enforcement state needs to read directory configuration, not to write it.
- Rotate credentials on your normal cycle. Connections support rotation without recreating the connection or losing its history.
- Never place credentials in a collector name, description or note field.
See Secret Handling Principles.
Setting up a connection
- Open Evidence Fabric, then Connections.
- Select Add connection.
- Choose the source system type.
- Provide the endpoint and the service credentials.
- Test the connection before saving it as active.
- Set the status to
active.
Requires connection.manage and the Continuous Assurance entitlement.
Testing and rotation
Test verifies reachability and authentication without collecting anything. Run it after any credential change.
Rotate replaces credentials in place. The connection keeps its identity and its history, so collectors and the assertions they have produced are unaffected.
Choosing what to connect
Connect systems that are the authoritative source for a control's operation, not systems that merely report on it.
| Good source | Why |
|---|---|
| The identity platform, for MFA enforcement | It is where enforcement is configured |
| The endpoint management platform, for agent deployment | It knows which endpoints have the agent |
| The backup platform, for job completion | It knows whether jobs ran |
| The cloud provider, for configuration state | It is the system of record |
| Weaker source | Why |
|---|---|
| A ticketing system, for whether a review happened | It records that a ticket closed, not that a review was performed |
| A spreadsheet export | It records what someone typed |
The second group is not worthless — sometimes it is all that exists. But be clear in the collector description about what the evidence actually demonstrates.
Permissions
| Action | Permission |
|---|---|
| View connections | connection.read |
| Create, configure, test and rotate connections | connection.manage |
Both require the continuous_assurance entitlement.
Example
A bank operates six connections:
| Connection | Source | Feeds |
|---|---|---|
CON-2026-0001 | Identity platform | MFA enforcement, privileged account inventory, dormant accounts |
CON-2026-0002 | Endpoint management | Agent deployment, patch state, disk encryption |
CON-2026-0003 | Cloud provider | Configuration baselines, storage encryption, public exposure |
CON-2026-0004 | Backup platform | Job completion, retention conformance |
CON-2026-0005 | Vulnerability scanner | Scan coverage, critical finding counts |
CON-2026-0006 | Log platform | Log source coverage, retention |
Six connections feed nineteen collectors producing assertions across eleven scopes. Each connection uses a dedicated read-only service identity, rotated quarterly.
When CON-2026-0004 moved to degraded after a platform upgrade changed an endpoint, backup assertions went stale within 48 hours and the backup indicators moved to not_assessed. The connection health alert — not the control effectiveness reading — is what told the team the feed had broken.
Troubleshooting
"The connection tests successfully but collectors return nothing." Authentication works; the service identity probably lacks read permission on the specific resource. Check the scope granted to the identity.
"The connection went to error after a credential rotation." The rotation was applied on one side only. Rotate in the source system and update the connection.
"Assertions went stale but the connection shows active." The connection is reachable but the collector may be paused or failing. Check the collector run history.
"Connections are not available." Requires the continuous_assurance entitlement and connection.read.