Connector Health

When a connector or collector breaks, QuantAssure doesn't get louder — it gets quieter. Fewer findings come in, the posture score stops moving, and a dashboard that's actually blind looks exactly like one that's clean. That inversion is the most dangerous failure mode a security platform can have: it's most reassuring precisely when it's least trustworthy.

Connector health exists to close that gap. It's a standing check on every source feeding your data — marketplace connectors and scheduled collectors alike — so "we have nothing to report" and "we can't report" are never the same silence. If a source shows up degraded or failing, treat every count and score below it as incomplete, not improved.

The Four Statuses

• Healthy — collecting on schedule, most recent attempt succeeded.
• Degraded — the source is still landing data, but its most recent attempt failed, or it has one or more failures in a row without yet crossing the failing threshold. Treat this as an early warning, not an incident.
• Failing — the source has stopped delivering trustworthy data: repeated failures, or so long since a successful run that its data is stale for what that source is expected to report. Findings from a failing source should not be read as "all clear" — they're absent, not resolved.
• Never run — a source is configured but has never completed a successful collection. This is deliberately its own state rather than folded into "healthy." A brand-new organisation, or a collector you enabled but haven't triggered yet, has produced zero evidence either way — it hasn't earned a clean bill of health, it just hasn't been checked.

Push Connectors vs. Pull Collectors

QuantAssure gets data two ways — see connecting a system for the full picture — and health is judged differently for each, because silence means something different depending on how a source is supposed to speak:

• Push connectors (the GitHub App, the Google Workspace Marketplace app, the AWS EventBridge connector) send events as they happen. A quiet repo or a quiet AWS account can be legitimately silent for a while, so a push connector only reads failing after three consecutive failed deliveries — one bad attempt doesn't condemn it.
• Pull collectors (GitHub, Mosyle, AWS, Pulumi, Google Drive, AWS Security Hub — run by the Assure Agent on a schedule) are judged on their most recent scheduled run alone. A scheduled run that failed is broken collection, so a pull collector reads failing the moment a single run fails — it doesn't get three strikes, because there's no ambiguity to wait out.

If you see one source turn red on its first failure while another takes a few in a row, that's this rule working as intended, not inconsistent behaviour.

Staleness Windows Vary by Source

A source that hasn't reported in a while isn't automatically failing — how long is tolerable depends on how often that source is expected to speak. There's no single global cutoff:

• Push connectors — GitHub App: 14 days; Google Workspace and AWS: 7 days. Wider windows, because these are event-driven and legitimately go quiet when nothing newsworthy happens upstream.
• Pull collectors — GitHub, Mosyle, Google Workspace, and AWS: 2 days; Pulumi and Google Drive: 7 days. Tighter windows on the sources that run most frequently, since a missed schedule there is a clearer signal that something broke. Any collector without its own window — AWS Security Hub, for instance — falls back to 2 days.

An Organisation With No Sources

An organisation that hasn't connected anything yet isn't "healthy" — there's nothing here to vouch for. It reports as not qualified with zero sources, and the guidance is connect a source, not investigate a failure. That's a distinct message from an org whose sources are configured but degraded or failing, where the guidance is the opposite: something that was working needs attention.

Where You'll See It

• Dashboard banner — appears at the top of your dashboard only when collection coverage isn't fully healthy. A clean dashboard shows no banner at all; that's the point — you should never have to go looking for whether your numbers are trustworthy.
• API — the connector health endpoint returns the status of every connector and collector plus an overall qualified/not-qualified summary, for anyone building their own reporting on top of QuantAssure.
• AI client access (MCP) — an agent working through your findings can check collection health directly, and get_posture_summary carries a coverage signal by default so an agent never reports on your posture without knowing whether the underlying data is complete. See AI Client Access (MCP) for the tool and scope details.