How DSALTA integrates with Grafana — data collected, setup guide, and automated compliance checks.
Overview
How to connect
Automated checks
Useful links
DSALTA connects to Grafana using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules.
Read-only access. DSALTA never modifies, creates, or deletes resources in your Grafana environment.
DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.
DSALTA reads the Grafana user roster — names, emails, roles and active status, which appears on your Access page; and incidents, which appear on your Incidents page.It calls these Grafana endpoints:
/api/org/users
/api/alertmanager/grafana/api/v2/alerts
Permissions the checks require:org.users:readEvery request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Grafana environment.
There is no Reconnect button. Open Integrations → Connected, click Manage on the Grafana card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Grafana. This usually happens when the service-account token expires or is revoked — generate a new token in Grafana and reconnect.
Data is not syncing
Make sure the service account still has the Admin role (needed to read organization users), then click Sync from integrations on the Integrations page (Connected tab) — it refreshes every connected integration at once.
1
Start in DSALTA
Open Integrations in the DSALTA sidebar, find Grafana Cloud, and click Connect to open the connect panel.
2
Find your Grafana domain
Your domain is the host in your Grafana URL — e.g. for https://acme.grafana.net, it’s acme.grafana.net.Enter the host only — no https://, no trailing path. Take everything between https:// and the first / in your Grafana URL: from https://acme.grafana.net/a/cloud-home-app the value is acme.grafana.net. The field in the credential window shows this as a placeholder (https:// example.grafana.net), which is a hint about the shape, not text to copy.Self-hosted and Grafana Enterprise instances work the same way — use your own instance host (for example grafana.internal.acme.com) instead of a .grafana.net address. Nothing else in the setup changes.
3
Create a service-account token
In Grafana: Administration → Users and access → Service accounts → Add service account with the Admin role (so it can read org users and firing alerts) → Add service account token → name it, set an expiry, and Generate token → copy the glsa_… value. You’ll enter your domain and token in the next step.
Setting an expiry is optional — by default a Grafana service-account token never expires. If you do tick Set expiration date, record the date: when the token expires the integration flips to Disconnected, and because there is no Reconnect button you have to disconnect, generate a fresh token, and connect again.
Create the service account inside the Grafana organization whose members you want reviewed. A service account only works in the organization it was created for, and DSALTA reads the roster of that one organization — a token made in the wrong org returns the wrong list of users.
The Admin role is doing two jobs. It gives the service account org.users:read, which is what the roster sync and both access checks need, and it gives it alerting read, which is what the Reported incidents should be closed check needs. A Viewer or Editor service account will still connect and still sync users, but the incidents check will come back Failed with a permission error rather than a compliance result.
4
Finish in DSALTA
Return to the connect panel you opened in step 1, enter the credential you just created, and confirm to complete the connection.
Once connected, Grafana Cloud appears on the Connected tab and the checks below begin reporting after the first sync.
Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.
.png?fit=max&auto=format&n=tsMQJyneJ1xquFUo&q=85&s=4d401cc03b547d99b6f75a6bd170c334)
