Confluence

Confluence

The Confluence Integration in the Praetorian Guard Platform (PGP)

The Confluence integration in PGP provides continuous scanning of your organization's Confluence spaces — pages and blog posts, across all historical versions — to detect exposed secrets such as API keys, tokens, passwords, and other sensitive information. PGP connects to your Confluence Cloud instance using an API token and automatically discovers all spaces, scanning their content for security risks. On subsequent scans, PGP performs incremental checks — only re-scanning spaces with recently modified content.

Prerequisites

Before you begin, ensure you have:

  • A Confluence Cloud instance
  • An Atlassian account with access to the target Confluence spaces
  • Access to your PGP account

Creating an API Token in Atlassian

  1. Sign in to your Atlassian account and go to the API Tokens page
  2. Click Create API token
  3. Give the token a descriptive name (e.g., "PGP Integration") and click Create
  4. Copy the token immediately — it will not be shown again

Note: The Confluence integration does not support fine-grained API tokens at this time. You must use a classic API token generated from the Atlassian account security page.

Configuring the Integration in PGP

  1. In PGP, navigate to the Integrations page
  2. Find and click on Confluence Cloud under the "SaaS Security" section
  3. Provide the following details:
    • Base URL — Your Confluence Cloud tenant URL (e.g., https://your-org.atlassian.net)
    • User Email — The email address of the Atlassian account that owns the API token
    • Access Token — The API token you created
  4. Click Connect to establish the integration

Once configured, PGP will discover all accessible Confluence spaces and scan their pages and blog posts — including prior versions — for exposed secrets. Subsequent scans automatically detect modified content and only re-scan spaces with changes.

Verifying the Connection

To verify that your connection is working:

  1. Navigate to Assets in PGP
  2. Look for confluence:space assets — each discovered space appears as an asset named after the space
  3. Check the Integrations page to confirm the Confluence connection status

Remediating Exposed Secrets

Confluence retains a full version history of every page, so a secret that appears in a document may also exist in one or more previous revisions of that document. Removing the secret from the current version does not remove it from prior versions, where it remains discoverable by anyone with access to the page history.

To fully eliminate the exposure:

  1. Remove the secret from the current version of the page
  2. Delete or purge every prior page version that still contains the secret
  3. Rotate the affected credential to invalidate any copies that may have already been captured

Until every historical version is cleaned, the secret should be treated as compromised.

Troubleshooting

Common issues and solutions:

  • Unable to Connect — Verify that your Base URL is correct and includes the full tenant URL (e.g., https://your-org.atlassian.net). Only Confluence Cloud (https://…atlassian.net) is supported; self-hosted Data Center/Server instances cannot be connected
  • Authentication Errors — Ensure the API token is valid and the user email matches the account that generated the token
  • No Spaces Discovered — Confirm the Atlassian account has read access to the target Confluence spaces
  • Fine-Grained Token Errors — The integration does not support fine-grained tokens. Use a classic API token instead

If you continue to experience issues, contact PGP Support.

Managing Your Connection

To manage your Confluence connection:

  1. In PGP, navigate to the Integrations page
  2. Find your Confluence Cloud connection
  3. Use the options menu (⋮) to update the stored credential (Refresh Token) or remove the connection (Disconnect)

Additional Resources

Need help? Contact our support team for assistance.