Skip to main content

​
Overview

The Config Manager | SCCM integration enables ThreatAware to collect data from Config Manager | SCCM, providing visibility into your security posture and cyber asset management.
Connection Method: API Setup Time: 15-30 minutes Access Required: Administrator account with API permissions

​
Use cases

Device & Asset Tracking

Monitor devices and assets managed by Config Manager | SCCM

Security Compliance

Track security posture and compliance status

User & Access Management

Identify users, roles, and access patterns

Threat Detection

Detect threats and vulnerabilities in real-time

​
Setup instructions

1

**Log in to ThreatAware**:

  • Open the ThreatAware dashboard and navigate to Settings → Integrations.
2

**Locate SCCM**:

  • Use the search bar to find SCCM in the integrations list.
3

**Connect SCCM**:

  • Click Connect, and a pop-up window will appear.
4

**Create a User in SCCM**:

  • Set up a dedicated user in SCCM with Read-Only Analyst permissions.
5

**Configure Firewall Port Forwarding**:

  • Create a port forward on your firewall to the SCCM server.
  • Lock down access to the current ThreatAware allowlist IP addresses, available in-product under Settings → Integrations → AWS Account / IP Whitelist Info
6

**Input Details in ThreatAware**:

  • Enter the following details into the ThreatAware integration form:
  • Public IP Address: The public IP address of the SCCM server.
  • Forwarded Port: The port configured for the SCCM server.
  • SCCM Username: The credentials for the user created in SCCM.
  • SCCM Password: The password associated with the SCCM username.
  • Ensure firewall rules are strictly configured to allow traffic only from ThreatAware’s dedicated IPs.
  • For more information, refer to SCCM or ThreatAware documentation.

​
Input Details

  • Public IP Address: Publicly accessible IP of the SCCM server.
  • Forwarded Port: Port used to access the SCCM server externally.
  • Username: SCCM user with Read-Only Analyst permissions.
  • Password: Password for the SCCM user account.

​
Verification and Troubleshooting

  • Verification: Confirm that the Integration Status in ThreatAware displays as Active once details are entered.
  • Troubleshooting:
  • Connection Issues: Verify that the public IP and forwarded port are correctly configured.
  • Permission Errors: Ensure the SCCM user has the appropriate permissions.

​
Data collected

The Config Manager | SCCM integration provides:
  • Device and asset information
  • Security compliance and posture data
  • User and access information
  • System performance metrics
  • Configuration and policy information

​
Required credentials

To set up the Config Manager | SCCM integration, you will need:
  • API Key or Token: Obtain from Config Manager | SCCM admin console
  • API Secret or Client Secret: Keep this secure
  • API Endpoint URL: The Config Manager | SCCM API base URL
  • Service Account: Admin account or dedicated integration user
  • Service Account Password: Associated credentials
Create a dedicated service account specifically for ThreatAware integration and store all credentials securely in your organisation’s password manager.

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings → Integrations in ThreatAware
    • Confirm the integration shows Active status
    • Check the last sync timestamp
  2. Verify Data Collection
    • Wait up to 60 minutes for the initial data collection
    • Verify data appears in device details or dashboards
  3. Test Queries
    • Create a test query to filter data from this integration
    • Verify results match your expectations

​
Troubleshooting

Symptoms: Integration fails to connect or shows errorSolutions:
  • Verify all credentials are correct and copied without extra spaces
  • Ensure the API endpoint URL is accessible from ThreatAware
  • Check firewall rules allow outbound HTTPS (port 443) to the API endpoint
  • Confirm API credentials have not expired
  • Verify the service account has necessary permissions
Symptoms: Invalid credentials errorSolutions:
  • Double-check the API key and secret are correct
  • Verify the API credentials have not been revoked
  • Ensure you are using the correct API version
  • Check if IP whitelisting is required
  • Review admin logs for authentication failures
Symptoms: Integration active but no data visibleSolutions:
  • Wait 60 minutes for initial synchronization
  • Verify API credentials have read permissions
  • Check the service account can access required data
  • Ensure data exists in the source system
  • Review ThreatAware integration logs
Symptoms: Only some data is being collectedSolutions:
  • Verify the service account permissions for all resources
  • Check for API rate limit issues
  • Review source system for data availability
  • Contact ThreatAware support if the issue persists

​
Best practices

Security Considerations
  • Create a dedicated service account specifically for the ThreatAware integration
  • Use read-only API permissions (never grant write access)
  • Store credentials securely in your organisation’s password manager
  • Rotate API credentials annually or per your security policy
  • Monitor authentication failures and API usage regularly
  • Review and audit integration activity periodically
  • Enable multi-factor authentication on the service account if available
  • Restrict the service account to only necessary resources and permissions