Skip to main content

​
Overview

The BeyondTrust integration enables ThreatAware to collect read-only data from your BeyondTrust platform, providing visibility into privileged account management, access controls, and security configurations.
Connection Method: API Setup Time: 15 minutes Access Required: BeyondTrust Administrator account

​
Data collected

The BeyondTrust integration provides:
  • Privileged account information
  • Access control data
  • Security audit logs
  • API access permissions

​
Use cases

Privileged Access Tracking

Monitor privileged account usage and access patterns

Access Control Validation

Verify access control policies are in place

Security Monitoring

Detect anomalies in privileged access

Compliance Auditing

Generate reports on privileged access management

​
Setup instructions

1

Log in to BeyondTrust Console

Access the BeyondTrust administrative console with an account that has API access permissions.
2

Create API Account

Navigate to Management > API Configuration.
  • Select Add API Account
  • Set the Access Permissions according to ThreatAware’s requirements
  • After creation, note the Client ID and Client Secret
Only grant the minimum permissions necessary. Store credentials securely immediately after creation.
3

Generate OAuth Token

Go to the OAuth settings in BeyondTrust.
  • Generate a new OAuth Token
  • Ensure it has access to the necessary API scopes for ThreatAware
  • Copy the token for use in ThreatAware
OAuth tokens may have expiration dates. Set reminders to renew tokens as required.
4

Identify Production Sub-domain

Locate your BeyondTrust Production Sub-domain name. This is used to configure the API endpoint in ThreatAware.Example: mycompany if your site is mycompany.beyondtrust.com
5

Configure in ThreatAware

Complete the integration setup in ThreatAware:
  • Navigate to Settings > Integrations
  • Search for and select BeyondTrust
  • Enter the required credentials:
    • Client ID: The API account Client ID
    • Client Secret: The API account Client Secret
    • Production Sub-domain: Your BeyondTrust production sub-domain
    • OAuth Token: The OAuth token generated
  • Click Authorize to establish the integration
6

Verify Connection

After connecting, verify the integration is working:
  • Check for a confirmation message on ThreatAware
  • Confirm that the Integration Status shows as Active

​
Required credentials

Field Name: BeyondTrust Client ID Type: String Description: The Client ID generated during API account setupThis ID is displayed when you create the API account in BeyondTrust.
Field Name: BeyondTrust Client Secret Type: Password (encrypted) Description: The secret key generated alongside the Client ID
The Client Secret is only displayed once during API account creation. Store it securely immediately.
Field Name: BeyondTrust Production Sub-domain Type: String Description: Your BeyondTrust site’s production sub-domain nameExample: mycompany (for mycompany.beyondtrust.com)
Field Name: BeyondTrust OAuth Token Type: Password (encrypted) Description: The OAuth token generated in BeyondTrust OAuth settings
OAuth tokens may expire. Monitor the token’s expiration date and regenerate as needed.

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings > Integrations in ThreatAware
    • Confirm the BeyondTrust integration shows Active status
    • Check the last sync timestamp
  2. Verify Data Collection
    • Wait 5-10 minutes for the initial data sync
    • Check for privileged access data in ThreatAware
    • Verify API permissions and access control information
  3. Test Queries
    • Create a test query to filter data from BeyondTrust
    • Verify the privileged access information matches your expectations

​
Troubleshooting

Symptoms: Integration was working but now shows authentication errorsSolutions:
  • Check the OAuth Token expiration date
  • Regenerate a new OAuth token in BeyondTrust if expired
  • Update the token in ThreatAware integration settings
  • Set calendar reminders to renew tokens before expiration
Symptoms: Integration connects but no data appears or is incompleteSolutions:
  • Verify API permissions align with ThreatAware’s requirements in the BeyondTrust console
  • Review the BeyondTrust API Documentation for permission details
  • Check that the API account has access to privileged account data
  • Ensure the OAuth token has the necessary scopes configured
Symptoms: Integration status shows authentication failureSolutions:
  • Verify the Client ID and Client Secret are exactly as displayed in BeyondTrust
  • Ensure there are no extra spaces in any credential
  • Confirm the API account is active and not disabled
  • Check that your BeyondTrust account has administrator privileges
Symptoms: Integration fails to connect or times outSolutions:
  • Verify the Production Sub-domain is correct for your BeyondTrust site
  • Check firewall rules allow outbound HTTPS (443) to BeyondTrust servers
  • Test connectivity to your BeyondTrust instance in a browser
  • Confirm your BeyondTrust platform is online and responsive

​
Additional resources

BeyondTrust API Documentation

Official BeyondTrust API documentation for detailed permissions and configuration

ThreatAware Support

Contact ThreatAware support for integration assistance

​
Best practices

Credential Management
  • Create a dedicated API account specifically for ThreatAware
  • Document all credentials in your organisation’s password manager
  • Set calendar reminders to renew OAuth tokens before expiration
  • Monitor for authentication failures in ThreatAware regularly
Security Considerations
  • Only grant the minimum permissions necessary for the integration
  • Limit API account scope to required data and resources
  • Review BeyondTrust audit logs periodically for API usage
  • Follow your organisation’s least privilege principles