docs(cloud-security): refresh product docs to current backend + web UI#309
Merged
Conversation
Catches the Cloud Security (CNAPP) section up to the product as it stands after the last ~2 weeks of changes, verified against the backend, CLI/SDK, REST API, and web UI. Highlights: - Providers: expand from 7 to the 13 connectors across cloud/identity/SaaS/ AI/LimaCharlie (adds OpenAI, Anthropic, LimaCharlie self-inventory, Auth0, GitHub, Entra). New "Connecting Providers" page with per-provider setup. - Classification v2: the retired `auto_classify` boolean is replaced by explicit `content_class`/`resource_type` rules; document the OR->AND matcher semantics and the new matcher fields (resource_type/provider/ region/public); note `store_kind` folded into `resource_type`. - Findings: add the `device_posture` class (11 total), workload-group shared-fix scoping, and the CIEM capability model (access scored by the capability a grant confers). - Events: current taxonomy - created/updated/closed/still_open plus the operator-disposition verbs (resolved/dismissed/reopened/assigned) and the sync_completed first-sync summary, with correct payload shapes. - API/CLI: add the new routes (findings/classes, ciem/identity, topology, policy/vocabulary, providers/manifest, fleet/overview, simulate/*, policy/suggest) and the new CLI commands (fleet overview, provider manifest, export subgroup, inventory --provider). - Topology view, Identity 360, Simulate/preview + policy autocomplete, and the MSSP fleet board documented; graph/CAASM/compliance updated (10 frameworks; native limacharlie + google_workspace CAASM sources; managed devices + device posture). - Reference page: fix the wrong onboarding recipe (gcp_scope + credentials, not scope + secret.secret_name) and stale provider list. - Add a "Getting Started" flow covering both the console and IaC paths. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GN4tviN7x5MWk9LE4yTK8Q
lcbill
approved these changes
Jul 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Catches the Cloud Security (CNAPP) documentation up to the product as it stands after the last ~2 weeks of changes. Every command, route, Hive field, event name, and provider was verified against the current backend, Python CLI/SDK, REST API gateway, and web UI — not memory.
What changed
Providers (7 → 13). New Connecting Providers page covering all connectors across cloud infra / identity / SaaS / AI / LimaCharlie self-inventory — adds OpenAI, Anthropic, LimaCharlie, Auth0, GitHub, and Entra, with each one's scope fields and credential shape.
Classification v2. The retired
auto_classifyboolean is replaced by explicit, previewablecontent_class/resource_typerules. Documents the OR → AND matcher semantics (a rule matches only when every populated dimension matches; a rule with no matcher matches nothing), the new matcher fields (resource_type,provider,region,public), and thatstore_kindfolded intoresource_type.Findings & events. Adds the
device_posturefinding class (11 total), workload-group shared-fix scoping (source_scope/target_scope), and the CIEM capability model (access scored by the capability a grant confers, not grant existence). Rewrites the event taxonomy to the current set —cloud_finding.created/.updated/.closed/.still_openplus the operator-disposition verbs (.resolved/.dismissed/.reopened/.assigned) and thecloudsec.sync_completedfirst-sync summary — with correct payload shapes.API & CLI. Adds the new routes (
findings/classes,ciem/identity,topology,policy/vocabulary,providers/manifest,fleet/overview,simulate/resources,simulate/findings,policy/suggest) and the new CLI commands (fleet overview,provider manifest, theexportsubgroup,inventory --provider). Notes which features are console + REST only (no CLI).Feature coverage. Documents the Topology view, Identity 360, Simulate/preview + policy autocomplete, and the MSSP fleet board; updates the graph, CAASM (10 compliance frameworks; native
limacharlie+google_workspacesources; managed devices + device posture), and compliance pages.Fixes. The
8-referenceonboarding recipe used the wrong fields (scope+secret.secret_name) — corrected togcp_scope+credentials: hive://secret/...; stale 5-provider list refreshed.Getting Started. Rewritten to cover both the console flow (Settings → Providers → Add provider → Test Provider) and the equivalent IaC/CLI path.
Validation
mkdocs build --strictpasses (exit 0).markdownlint-cli2clean on all changed files.🤖 Generated with Claude Code