Discovery connectors

Plan requirement: Enterprise organization administrator.

Connectors enrich AI app discovery from enterprise systems. They do not read prompt bodies, and they do not replace browser or gateway enforcement. Credentials are encrypted at rest and are not returned after saving, so keep the source credential in your provider secret-management process.

Open Administration → Enterprise controls → Encrypted discovery connectors.

Google Workspace

1. Enable the Admin SDK API in a Google Cloud project.
2. Create a service account and enable domain-wide delegation.
3. In Google Admin, authorize:
   • admin.directory.user.readonly
   • admin.directory.user.security
4. Enter the service-account email, PEM private key, delegated Workspace admin, customer ID, and a conservative maximum-user cap.
5. Sync and confirm authorized AI OAuth clients appear in Discovery.

The connector reads active users and authorized OAuth client inventory. It does not read messages or Drive content. A 403 usually indicates missing delegation, scope, API enablement, or delegated-admin privilege.

Microsoft Entra ID

1. Create a single-tenant app registration.
2. Grant Microsoft Graph application permission Application.Read.All.
3. Add Directory.Read.All only when delegated permission-grant counting is enabled.
4. Grant tenant admin consent.
5. Enter the directory ID, application ID, and client secret value.
6. Sync and verify known enterprise applications.

Okta

1. Prefer an OAuth service app with okta.apps.read and a limited resource set.
2. Enter the public Okta organization URL, token, and Bearer scheme.
3. If you must use a legacy API token, select SSWS, create it with a dedicated least-privileged administrator, and rotate it frequently.
4. Sync and confirm active AI applications are inventoried.

Slack

Use a Slack Enterprise audit-log token for recent app-install activity or an approved-apps token, depending on the inventory you need. The installing actor must have the Slack Enterprise permissions required by that API. Enter the Enterprise or workspace scope requested by the Orthalon form, sync, and verify that only expected applications match the catalog.

GitHub

Create a fine-grained token or GitHub App credential with read-only access to the organization's installed applications. Enter the organization name, token, and the default public GitHub API URL. Change the API base URL only for a publicly reachable GitHub Enterprise Server API.

Generic network source

Import a pasted CSV/JSON network export or configure a bounded public HTTPS JSON feed. Records require a destination domain; user and event counts are optional. Filter the source to AI destinations when possible and never expose an internal or private-network URL.

Security and browser-management sources

Orthalon includes bounded adapters for Cloudflare Gateway, Zscaler, Netskope, Microsoft Defender for Cloud Apps, Palo Alto Prisma Access, iboss, and Chrome Enterprise. Each adapter imports destination, event-count, time, and an aggregate distinct-user count where available. Individual user identifiers are discarded after aggregation. It does not import prompt bodies or response content.

Use the provider's read-only reporting or audit scope. Enter the public tenant API hostname and required account identifiers in Orthalon, then store the token through the encrypted connector form. Pagination, response size, request time, and record count are bounded. Private-network targets and redirects are rejected.

Successful syncs create a per-connector current snapshot. If a previously reported domain is absent from the next complete sync, that connector observation becomes inactive; the cross-source organization inventory remains as historical evidence. If a provider returns the configured maximum number of groups or directory users, Orthalon reports a truncation warning and preserves older observations instead of treating the partial response as a complete snapshot.

Cloudflare Gateway

Create an account API token with the minimum permission needed to read Gateway analytics, then enter the account ID and token. Orthalon queries bounded gatewayL7RequestsAdaptiveGroups metadata. Use a smaller lookback if the sync reports that the group limit was reached.

Zscaler

Enter the tenant's Zscaler API cloud hostname and an operator-managed bearer token authorized for Web Insights transaction data. Orthalon restricts the host to supported Zscaler domains and calls the tenant /zsapi/v1/transactionData/web contract. Confirm this bearer-token flow with the tenant's Zscaler API configuration before production.

Netskope

Create an API v2 token that can read data-search events. Enter the public *.goskope.com tenant hostname and token. Orthalon uses the bounded REST API v2 data-search page endpoint and discards individual user identifiers after counting them.

Microsoft Defender and Palo Alto

Defender for Cloud Apps needs the tenant portal region and a read-only activity token. Palo Alto Prisma Access needs a TSG ID and logging-read service-account token. Both tokens are operator-rotated; validate the tenant region and provider rate limits in staging.

iboss

iboss reporting paths vary by tenant contract. Ask the customer's iboss administrator or iboss support for the public tenant hostname, exact web-event reporting API path, pagination fields, and a read-only bearer token. Enter only the path, such as /contracted/report/path, not a full URL. Orthalon rejects query strings, fragments, traversal, and non-iboss hosts. Do not assume an example path from another customer applies to this tenant.

Chrome Enterprise

Enable Chrome Enterprise Security Insights and obtain an OAuth access token with chrome.management.securityinsights.readonly. Enter the Workspace customer ID and token. This adapter imports the current API's suspicious URL-visit counts broken down by EVENT_DOMAIN; it is not a complete history of every URL visit. Chrome reports with a delay, so compare against the same fixed one-day, one-week, or four-week window in the provider console.

The current Zscaler, Palo Alto, and Chrome Enterprise configurations accept an operator-managed access token. Rotate it in the provider and Orthalon before it expires. Native refresh-token exchange is not claimed.

Shared connector test

1. Use provider sandboxes and an Enterprise staging organization.
2. Save the connector and confirm secrets disappear from the UI.
3. Select Sync and inspect the corresponding background job.
4. Confirm the status returns to CONNECTED.
5. Compare matched and unmatched records in AI Discovery & Governance.
6. Run the same sync again; counts should remain stable rather than accumulate.
7. Rotate or revoke the provider credential and confirm the next sync fails.
8. Replace the configuration, recover, then test Disconnect.

The web application and the connector background worker must use the same connector encryption key. If the keys differ, saved provider credentials cannot be decrypted during sync.

Mocked adapter tests verify normalization and safety contracts. A connector is ready for a customer only after its provider-specific staging test succeeds with that tenant's scopes, pagination behavior, rate limits, and token lifetime.