> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Config Manager | SCCM

> Connect ThreatAware to Config Manager | SCCM to track security posture and device inventory

## Overview

The Config Manager | SCCM integration enables ThreatAware to collect data from Config Manager | SCCM, providing visibility into your security posture and cyber asset management.

<Info>
  **Connection Method**: API
  **Setup Time**: 15-30 minutes
  **Access Required**: Administrator account with API permissions
</Info>

## Use cases

<CardGroup cols={2}>
  <Card title="Device & Asset Tracking" icon="computer">
    Monitor devices and assets managed by Config Manager | SCCM
  </Card>

  <Card title="Security Compliance" icon="shield-check">
    Track security posture and compliance status
  </Card>

  <Card title="User & Access Management" icon="users">
    Identify users, roles, and access patterns
  </Card>

  <Card title="Threat Detection" icon="triangle-exclamation">
    Detect threats and vulnerabilities in real-time
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="**Log in to ThreatAware**:">
    * Open the ThreatAware dashboard and navigate to **Settings → Integrations**.
  </Step>

  <Step title="**Locate SCCM**:">
    * Use the search bar to find **SCCM** in the integrations list.
  </Step>

  <Step title="**Connect SCCM**:">
    * Click **Connect**, and a pop-up window will appear.
  </Step>

  <Step title="**Create a User in SCCM**:">
    * Set up a dedicated user in SCCM with **Read-Only Analyst** permissions.
  </Step>

  <Step title="**Configure Firewall Port Forwarding**:">
    * Create a port forward on your firewall to the SCCM server.
    * Lock down access to the current ThreatAware allowlist IP addresses, available in-product under **Settings → Integrations → AWS Account / IP Whitelist Info**
  </Step>

  <Step title="**Input Details in ThreatAware**:">
    * Enter the following details into the ThreatAware integration form:
    * **Public IP Address**: The public IP address of the SCCM server.
    * **Forwarded Port**: The port configured for the SCCM server.
    * **SCCM Username**: The credentials for the user created in SCCM.
    * **SCCM Password**: The password associated with the SCCM username.

    ### Important Notes and Links

    * Ensure firewall rules are strictly configured to allow traffic only from ThreatAware’s dedicated IPs.
    * For more information, refer to SCCM or ThreatAware documentation.

    ### Input Details

    * **Public IP Address**: Publicly accessible IP of the SCCM server.
    * **Forwarded Port**: Port used to access the SCCM server externally.
    * **Username**: SCCM user with **Read-Only Analyst** permissions.
    * **Password**: Password for the SCCM user account.

    ### Verification and Troubleshooting

    * **Verification**: Confirm that the **Integration Status** in ThreatAware displays as **Active** once details are entered.
    * **Troubleshooting**:
    * **Connection Issues**: Verify that the public IP and forwarded port are correctly configured.
    * **Permission Errors**: Ensure the SCCM user has the appropriate permissions.
  </Step>
</Steps>

## Data collected

The Config Manager | SCCM integration provides:

* Device and asset information
* Security compliance and posture data
* User and access information
* System performance metrics
* Configuration and policy information

## Required credentials

To set up the Config Manager | SCCM integration, you will need:

* **API Key or Token**: Obtain from Config Manager | SCCM admin console
* **API Secret or Client Secret**: Keep this secure
* **API Endpoint URL**: The Config Manager | SCCM API base URL
* **Service Account**: Admin account or dedicated integration user
* **Service Account Password**: Associated credentials

<Tip>
  Create a dedicated service account specifically for ThreatAware integration and store all credentials securely in your organisation's password manager.
</Tip>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings → Integrations** in ThreatAware
   * Confirm the integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait up to 60 minutes for the initial data collection
   * Verify data appears in device details or dashboards

3. **Test Queries**
   * Create a test query to filter data from this integration
   * Verify results match your expectations

## Troubleshooting

<AccordionGroup>
  <Accordion title="Connection Failed" icon="triangle-exclamation">
    **Symptoms**: Integration fails to connect or shows error

    **Solutions**:

    * Verify all credentials are correct and copied without extra spaces
    * Ensure the API endpoint URL is accessible from ThreatAware
    * Check firewall rules allow outbound HTTPS (port 443) to the API endpoint
    * Confirm API credentials have not expired
    * Verify the service account has necessary permissions
  </Accordion>

  <Accordion title="Authentication Failed" icon="lock">
    **Symptoms**: Invalid credentials error

    **Solutions**:

    * Double-check the API key and secret are correct
    * Verify the API credentials have not been revoked
    * Ensure you are using the correct API version
    * Check if IP whitelisting is required
    * Review admin logs for authentication failures
  </Accordion>

  <Accordion title="No Data Appearing" icon="database">
    **Symptoms**: Integration active but no data visible

    **Solutions**:

    * Wait 60 minutes for initial synchronization
    * Verify API credentials have read permissions
    * Check the service account can access required data
    * Ensure data exists in the source system
    * Review ThreatAware integration logs
  </Accordion>

  <Accordion title="Incomplete or Partial Data" icon="hourglass">
    **Symptoms**: Only some data is being collected

    **Solutions**:

    * Verify the service account permissions for all resources
    * Check for API rate limit issues
    * Review source system for data availability
    * Contact ThreatAware support if the issue persists
  </Accordion>
</AccordionGroup>

## Best practices

<Tip>
  **Security Considerations**

  * Create a dedicated service account specifically for the ThreatAware integration
  * Use read-only API permissions (never grant write access)
  * Store credentials securely in your organisation's password manager
  * Rotate API credentials annually or per your security policy
  * Monitor authentication failures and API usage regularly
  * Review and audit integration activity periodically
  * Enable multi-factor authentication on the service account if available
  * Restrict the service account to only necessary resources and permissions
</Tip>