> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# BeyondTrust

> Connect ThreatAware to BeyondTrust to monitor privileged account management and access controls

## Overview

The BeyondTrust integration enables ThreatAware to collect read-only data from your BeyondTrust platform, providing visibility into privileged account management, access controls, and security configurations.

<Info>
  **Connection Method**: API
  **Setup Time**: 15 minutes
  **Access Required**: BeyondTrust Administrator account
</Info>

## Data collected

The BeyondTrust integration provides:

* Privileged account information
* Access control data
* Security audit logs
* API access permissions

## Use cases

<CardGroup cols={2}>
  <Card title="Privileged Access Tracking" icon="shield-halved">
    Monitor privileged account usage and access patterns
  </Card>

  <Card title="Access Control Validation" icon="clipboard-check">
    Verify access control policies are in place
  </Card>

  <Card title="Security Monitoring" icon="eye">
    Detect anomalies in privileged access
  </Card>

  <Card title="Compliance Auditing" icon="file-contract">
    Generate reports on privileged access management
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to BeyondTrust Console">
    Access the BeyondTrust administrative console with an account that has **API** access permissions.
  </Step>

  <Step title="Create API Account">
    Navigate to **Management** > **API Configuration**.

    * Select **Add API Account**
    * Set the **Access Permissions** according to ThreatAware's requirements
    * After creation, note the **Client ID** and **Client Secret**

    <Warning>
      Only grant the minimum permissions necessary. Store credentials securely immediately after creation.
    </Warning>
  </Step>

  <Step title="Generate OAuth Token">
    Go to the **OAuth** settings in BeyondTrust.

    * Generate a new **OAuth Token**
    * Ensure it has access to the necessary API scopes for ThreatAware
    * Copy the token for use in ThreatAware

    <Tip>
      OAuth tokens may have expiration dates. Set reminders to renew tokens as required.
    </Tip>
  </Step>

  <Step title="Identify Production Sub-domain">
    Locate your BeyondTrust Production Sub-domain name. This is used to configure the API endpoint in ThreatAware.

    Example: `mycompany` if your site is `mycompany.beyondtrust.com`
  </Step>

  <Step title="Configure in ThreatAware">
    Complete the integration setup in ThreatAware:

    * Navigate to **Settings** > **Integrations**
    * Search for and select **BeyondTrust**
    * Enter the required credentials:
      * **Client ID**: The API account Client ID
      * **Client Secret**: The API account Client Secret
      * **Production Sub-domain**: Your BeyondTrust production sub-domain
      * **OAuth Token**: The OAuth token generated
    * Click **Authorize** to establish the integration
  </Step>

  <Step title="Verify Connection">
    After connecting, verify the integration is working:

    * Check for a confirmation message on ThreatAware
    * Confirm that the **Integration Status** shows as **Active**
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Client ID" icon="key">
    **Field Name**: BeyondTrust Client ID
    **Type**: String
    **Description**: The Client ID generated during API account setup

    This ID is displayed when you create the API account in BeyondTrust.
  </Accordion>

  <Accordion title="Client Secret" icon="lock">
    **Field Name**: BeyondTrust Client Secret
    **Type**: Password (encrypted)
    **Description**: The secret key generated alongside the Client ID

    <Warning>
      The Client Secret is only displayed once during API account creation. Store it securely immediately.
    </Warning>
  </Accordion>

  <Accordion title="Production Sub-domain" icon="server">
    **Field Name**: BeyondTrust Production Sub-domain
    **Type**: String
    **Description**: Your BeyondTrust site's production sub-domain name

    **Example**: `mycompany` (for `mycompany.beyondtrust.com`)
  </Accordion>

  <Accordion title="OAuth Token" icon="key">
    **Field Name**: BeyondTrust OAuth Token
    **Type**: Password (encrypted)
    **Description**: The OAuth token generated in BeyondTrust OAuth settings

    <Tip>
      OAuth tokens may expire. Monitor the token's expiration date and regenerate as needed.
    </Tip>
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the BeyondTrust integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait 5-10 minutes for the initial data sync
   * Check for privileged access data in ThreatAware
   * Verify API permissions and access control information

3. **Test Queries**
   * Create a test query to filter data from BeyondTrust
   * Verify the privileged access information matches your expectations

## Troubleshooting

<AccordionGroup>
  <Accordion title="Token Expiry Issues" icon="triangle-exclamation">
    **Symptoms**: Integration was working but now shows authentication errors

    **Solutions**:

    * Check the **OAuth Token** expiration date
    * Regenerate a new OAuth token in BeyondTrust if expired
    * Update the token in ThreatAware integration settings
    * Set calendar reminders to renew tokens before expiration
  </Accordion>

  <Accordion title="Permission Issues" icon="ban">
    **Symptoms**: Integration connects but no data appears or is incomplete

    **Solutions**:

    * Verify API permissions align with ThreatAware's requirements in the BeyondTrust console
    * Review the [BeyondTrust API Documentation](https://beyondtrust.com/docs) for permission details
    * Check that the API account has access to privileged account data
    * Ensure the OAuth token has the necessary scopes configured
  </Accordion>

  <Accordion title="Invalid Credentials" icon="ban">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify the **Client ID** and **Client Secret** are exactly as displayed in BeyondTrust
    * Ensure there are no extra spaces in any credential
    * Confirm the API account is active and not disabled
    * Check that your BeyondTrust account has administrator privileges
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the **Production Sub-domain** is correct for your BeyondTrust site
    * Check firewall rules allow outbound HTTPS (443) to BeyondTrust servers
    * Test connectivity to your BeyondTrust instance in a browser
    * Confirm your BeyondTrust platform is online and responsive
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="BeyondTrust API Documentation" icon="book" href="https://beyondtrust.com/docs">
    Official BeyondTrust API documentation for detailed permissions and configuration
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Create a dedicated API account specifically for ThreatAware
  * Document all credentials in your organisation's password manager
  * Set calendar reminders to renew OAuth tokens before expiration
  * Monitor for authentication failures in ThreatAware regularly
</Tip>

<Tip>
  **Security Considerations**

  * Only grant the minimum permissions necessary for the integration
  * Limit API account scope to required data and resources
  * Review BeyondTrust audit logs periodically for API usage
  * Follow your organisation's least privilege principles
</Tip>