Open Connector
Return Guard security context to Infra

Return Guard security context to Infra

Share findings, incident references, and protection observations for mapped assets in the Infra project that owns the workload.

Share Guard security summaries so an infrastructure operator can identify findings and incidents associated with a mapped workload. Raw evidence remains under Guard's separate access controls.

Before you begin

You need the following connection and authority:

  • The Infra–Guard connection is Connected.
  • Confirmed mappings associate the intended Infra resources with Guard assets.
  • A Guard Administrator can approve the source asset group, and an Infra Organization Admin can approve the receiving project.

Approve the return direction

  1. In Organization → Connector → Connections → Connection → Sharing, select Edit sharing.
  2. For Guard to Infra, select the source asset group, receiving project, and Security summaries. Review the mapped asset IDs in the selection preview.
  3. Select Save changes. In Grants, have each product administrator approve the exact revision, then select Activate grant.
  4. In Overview, confirm the replacement active grant revision and a successful Guard-to-Infra synchronization after activation.

If the revision remains pending, the earlier active grant still applies. Inspect the missing approval in Grants; saving the selection again does not approve it.

Follow a finding to its source

  1. In Connection → Resources, open a mapped workload that has a Guard finding or incident. Inspect its severity, source reference, and observation time.
  2. Follow the source link to Guard. Confirm that its asset ID matches the mapping and compare the source finding's revision or observation time.
  3. In Infra, open the mapped workload. Inspect Connector context for the same source reference and time. If the finding has changed, wait for or request Connection → Activity → Synchronize and inspect its result.

If the source link is unavailable to the infrastructure operator, the shared summary does not grant Guard evidence access. A Guard administrator can review the required identity and access grants.

For containment, use Guard response actions. For workload changes, use Infra's native lifecycle operation and inspect its result. An incident closure does not release isolation or complete an Infra operation.