This connector analyzes the XML results file produced by PingCastle to generate indicators on the security level of Active Directory (AD) and synchronize vulnerabilities from the report as gaps in Tenacy.
This article is intended for technical teams or pilots responsible for AD hardening and for configuring connectors in Tenacy.
This connector collects several types of information:
AD indicators: number of users, active users, dormant accounts, machines, accounts with passwords, users with a password that expires.
AD security level indicators: overall PingCastle score, privileged accounts score, machines and users score.
Vulnerabilities as gaps in Tenacy: a gap is a deviation identified against a security baseline, recorded in a registry so it can be tracked and handled. Each vulnerability reported by PingCastle includes its name, its criticality (based on PingCastle points) and its description.
Add and configure the connector
To add this connector, go to Catalogue > Connectors > PingCastle > Add connector
After adding it, you must configure:
Operated by: the perimeter (the organizational unit that measures, indicators and gaps are attached to in Tenacy) that sets and drives the AD hardening rules, and to which the default indicators will be attached.
Frequency: how often PingCastle XML files are imported, and the periodicity of the associated indicators.
⚠️ When this connector is instantiated, the measure (the control that centralizes compliance and risk treatment on a perimeter) Active Directory hardening (TE163) will be automatically implemented on the perimeter targeted by the connector, if it isn't already.
Once the connector is created, the configuration continues:
Risk points threshold: the threshold above which risks identified by PingCastle will be synchronized as gaps in Tenacy.
Gap registry: the registry where issues identified by PingCastle will be recorded as gaps.
If you select an existing registry, gaps are added to it.
If you enter the name of a registry that doesn't exist yet, Tenacy creates it automatically when you save the configuration.
Maximum number of gaps: lets you limit the number of gaps created at each synchronization, up to 100.
If you set a value, only the most critical gaps within that limit are synchronized.
If the field is left empty, Tenacy automatically synchronizes the 100 most critical vulnerabilities (or fewer, if the threshold identifies fewer) above the chosen threshold.
💡In the XML file, the GenerationDate field is used to attach indicators to their correct production period, regardless of the import date. For a report produced in November with a monthly periodicity, the extracted indicators will be attached to the previous full period: October.
⚠️If reports are imported out of chronological order, gap statuses (open/closed) are not guaranteed, because gap import relies on the connector's execution date rather than the date in the XML report.
💡 PingCastle expresses its scores as a "risk level": 100/100 is therefore a bad score. Tenacy expresses its scores as a "compliance level": a PingCastle score of 100 will therefore equal 0 in Tenacy.
Run your first test
Once the connector is properly configured, test the integration by running an initial execution.
Go to ⚙️ > Connectors > Click on the PingCastle connector > Run now > Add your file:
💡 Feel free to contact Tenacy support if you have any questions regarding this.
Frequently asked questions
I don't have a gap registry for PingCastle yet, what happens?
You can type the name of a new registry directly in the "Gap registry" field. Tenacy creates it automatically when you save the configuration, so you don't need to create it beforehand.
Why does the score shown in Tenacy seem reversed compared to PingCastle?
PingCastle scores on a "risk level" (the higher the score, the higher the risk), while Tenacy scores on a "compliance level" (the higher the score, the better the compliance). A PingCastle score of 100 therefore corresponds to a Tenacy score of 0.
What happens if I import my PingCastle reports out of order?
Gap open/close statuses are no longer guaranteed, since Tenacy relies on the connector's execution date (not the date in the XML report) to track how gaps evolve. We recommend importing reports in their chronological production order.
Can I limit the number of gaps created per import?
Yes, via the "Maximum number of gaps" field, up to 100. If you leave this field empty, Tenacy automatically synchronizes the 100 most critical vulnerabilities (or fewer) above the chosen risk points threshold.