Overview

Blackpoint Cyber Inspector (Beta)

Blackpoint Cyber's CompassOne platform delivers Managed Detection and Response (MDR) across endpoint and cloud environments. The Blackpoint Cyber Inspector (Beta) connects to CompassOne with a single partner-level API token, discovers each of your managed customer tenants, and reports security posture, detections, asset inventory, vulnerability findings, and dark-web credential exposures back into Liongard — so a posture drop, a new critical vulnerability, or a leaked credential surfaces without logging into CompassOne for each customer.

What you can monitor

The Blackpoint Cyber Inspector collects MDR and exposure data for each managed customer tenant, including:

• CompassOne security posture score, status, and maturity level, with the deductions behind the score
• Detections (alert groups) and their open or resolved status
• Asset inventory across devices, users, software, sources, and surveys
• Vulnerability findings by severity, and vulnerability scan status
• Dark-web credential exposures

How it works

A parent launchpoint holds one CompassOne partner API token and discovers every customer tenant your MSP manages. Liongard creates a child launchpoint for each tenant, mapped to its own Liongard Environment, so MDR posture can be tracked independently per customer. Your MSP's own internal CompassOne tenant is excluded from discovery.

Benefits

• Track every customer's CompassOne security posture score over time and get alerted when it changes.
• Get alerted when a customer's critical vulnerability or failed scan count changes.
• Get alerted when a customer's dark-web credential exposures change, so you can act before credentials are used.
• Keep open detections visible alongside the rest of each customer's asset intelligence.
• Prove the value of your MDR service in QBRs with posture, detection, and exposure history.

Inspector Setup Preparation

Step 1: Create the API Key in CompassOne

1. Sign in to the CompassOne portal at compassone.blackpointcyber.com.
2. Select your account avatar in the top right, then select API Keys.
3. Select + Add API Key, name the key (e.g., "Liongard"), and select Create Key.
4. Copy the key and store it securely — you'll enter it when configuring the parent Inspector.

Inspector Setup:

Step 2: Configure the Blackpoint Cyber Inspector in Liongard

1. Log in to the Liongard platform.
2. In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the Blackpoint Cyber Inspector > Select Add System.

Since Blackpoint Cyber is a multi-tenant system where a single partner account manages many customers, you'll set up a single "Parent" Inspector that will then auto-discover a "Child" Inspector for each customer tenant.

Fill in the following information:

• Type of Inspector: Parent
• Environment: Select your MSP's Environment
• Friendly Name: Suggested Naming: [MSP Name] Blackpoint Cyber Parent
• Agent: Select the On-Demand Agent
• Inspector Version: Latest
• API Token: The API key created in the CompassOne portal in Step 1
• Scheduling: The Inspector will default to run once a day at the time it's set up. Here you can adjust the schedule
• Select Save. The Inspector will now be triggered to run within the minute.

Step 3: Child Inspector Setup

After the first run of the Parent Inspector, each customer tenant will be auto-discovered and surfaced in the Discovered Systems tab on the Inspectors > Blackpoint Cyber Inspector page. Child Inspectors are named Blackpoint Cyber - [Tenant Name], and Liongard suggests an Environment for each based on the tenant name.

• Activate or Archive your Discovered Systems by ensuring they're mapped to the correct Environment > Check the checkbox to the left of Inspector(s) > Select the Actions drop-down menu > Activate Launchpoints (or Archive Launchpoints).
• Click Save.

Proof-of-concept and onboarding tenants are discovered too. Archive any you don't want to track.

The Blackpoint Cyber Inspector ships 8 alert rules. All are disabled by default, so enable the ones you want to use. See the Blackpoint Cyber Inspector Summary for the full list.

Troubleshooting

• Setup error on the first run (401): The API token is missing, mistyped, or was revoked in CompassOne — create a new key and re-enter it.
• Authorization error on a child (403): The token is valid but can't reach that tenant. Confirm the key was created by a partner-level user with access to the customer, then re-run the inspector.
• Your MSP's own tenant doesn't appear in Discovered Systems: This is expected. The inspector excludes your internal CompassOne tenant and discovers managed customer tenants only.
• Security posture scores differ in scale between customers: The maximum score depends on each customer's CompassOne edition. Compare the score against its Max Score rather than assuming a fixed scale.

Inspector FAQs