Skip to main content

​
Overview

The Darktrace Agent integration enables ThreatAware to collect network security and threat detection data from your Darktrace instance. This integration provides visibility into network anomalies and potential security threats detected by Darktrace’s AI-driven platform.
Connection Method: API Token with Optional Port Forwarding Setup Time: 20 minutes Access Required: Darktrace Administrator account, Firewall access (if on-premise)

​
Data collected

The Darktrace Agent integration provides:
  • Network traffic analysis and anomalies
  • Threat detection and AI insights
  • Device and endpoint visibility
  • Security incident information

​
Use cases

Network Anomaly Detection

Monitor network traffic for unusual patterns and potential threats

Threat Intelligence Integration

Integrate Darktrace threat detections with your ThreatAware platform

Endpoint Visibility

Gain visibility into devices and endpoints across your network

Incident Investigation

Correlate Darktrace incidents with other security data in ThreatAware

​
Setup instructions

1

Log in to ThreatAware

Access the ThreatAware dashboard.
  • Navigate to Settings > Systems
  • Search for “Darktrace Agent”
2

Click Connect

Click the Connect button to start the integration setup.
  • A pop-up window will appear with credential input fields
3

Log in to Darktrace Console

Log in to your Darktrace console with an administrator account.
  • You will need to generate API credentials
4

Navigate to Admin Settings

In the Darktrace console:
  • Click Admin in the left-hand panel
  • Select System Config
  • Scroll to the bottom of the configuration page
5

Generate API Token

In the System Config section:
  • Look for the API token generation option
  • Click Generate to create a new API token
  • Copy the generated API Token
  • Also note the Private Token if shown
  • Store these securely
Save both tokens immediately. Some API providers do not allow you to retrieve them again after creation.
6

Retrieve Platform URL

Obtain your Darktrace platform URL:
  • Copy the base URL from your browser address bar
  • If cloud-hosted: typically https://<instance>.darktrace.com
  • If on-premise: you’ll need to set up port forwarding (see next step)
7

Configure Port Forwarding (On-Premise Only)

If your Darktrace platform is hosted on-premise:
  • Create a port forwarding rule on your firewall to the Darktrace server on port 443
  • Restrict inbound access to the current ThreatAware allowlist IP addresses, available in-product under Settings → Integrations → AWS Account / IP Whitelist Info
  • Format your URL as: https://<PUBLIC_IP>:<PORT>
Only allow connections from ThreatAware’s IP addresses for security. Do not expose Darktrace directly to the public internet without restrictions.
8

Input Details in ThreatAware

Return to the ThreatAware connection dialog and enter:
  • Platform URL: Your Darktrace instance URL
  • API Token: The API token generated in step 5
  • Private Token: The private token generated in step 5
  • Click Connect to establish the integration
9

Verify Connection

After connecting, verify the integration is working correctly.
  • Check the connection status indicates success
  • In ThreatAware, navigate to Settings > Systems and verify the status shows Connected
  • Wait 5-10 minutes for initial data synchronization

​
Required credentials

Field Name: Darktrace Platform URL Type: String Description: The URL of your Darktrace instanceFor Cloud-Hosted:
  • Format: https://<instance>.darktrace.com
  • Example: https://acme.darktrace.com
For On-Premise:
  • Format: https://<PUBLIC_IP>:<PORT>
  • Example: https://203.0.113.42:8443
Field Name: Darktrace API Token Type: String (sensitive) Description: The API token generated in Darktrace System Config
Store this token securely in your organisation’s password manager. It provides access to your Darktrace data.
Field Name: Darktrace Private Token Type: String (sensitive) Description: The private token generated in Darktrace System Config
This is a sensitive credential. Store it securely alongside your API token.

​
On-premise network configuration

ThreatAware connects from a dedicated set of AWS IP addresses. Configure your firewall to allow inbound traffic from the current allowlist, available in-product under Settings → Integrations → AWS Account / IP Whitelist Info.Both should connect on port 443 (HTTPS) to your Darktrace server.
Example firewall rule:
  • External Interface: Your public IP address
  • External Port: 8443 (or your chosen port)
  • Internal Host: Your Darktrace server IP (e.g., 192.168.1.50)
  • Internal Port: 443
  • Restrict Source to the current ThreatAware allowlist IPs (see Settings → Integrations → AWS Account / IP Whitelist Info)
  • Protocol: HTTPS/TLS

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings > Systems in ThreatAware
    • Locate the Darktrace Agent integration
    • Confirm the status shows Connected
  2. Verify Data Collection
    • Wait 10 minutes for the initial data poll
    • Look for network anomalies and threat data appearing in ThreatAware
    • Verify the data matches your Darktrace instance
  3. Test Connectivity
    • If on-premise, verify port forwarding from the public IP to Darktrace
    • Confirm ThreatAware can reach the platform URL

​
Troubleshooting

Symptoms: Integration fails to connect or times outSolutions:
  • Verify the Platform URL is correct and accessible
  • For cloud-hosted: test the URL in a browser
  • For on-premise: verify firewall port forwarding is active
  • Ensure ThreatAware’s allowlist IPs are whitelisted (see Settings → Integrations → AWS Account / IP Whitelist Info)
  • Confirm Darktrace server is online and responding
  • Check firewall logs for blocked connections
Symptoms: Integration status shows authentication failureSolutions:
  • Verify both the API Token and Private Token are correctly entered
  • Ensure both tokens are complete and without extra spaces
  • Confirm the tokens haven’t expired
  • Try regenerating new tokens in the Darktrace console
  • Verify the user account creating tokens has admin privileges
  • Check that tokens are still valid in the Darktrace System Config
Symptoms: Integration shows connected but no anomaly or threat data appearsSolutions:
  • Verify Darktrace has network traffic to analyze
  • Wait at least 10 minutes for initial data synchronization
  • Confirm the API tokens have permission to access threat data
  • Review Darktrace documentation for API scopes and permissions
  • Check that your Darktrace license includes API access
  • Contact Darktrace support if data collection continues to fail
Symptoms: Can’t reach the on-premise Darktrace instanceSolutions:
  • Verify port forwarding rule is active and persistent
  • Confirm the internal Darktrace server IP is correct
  • Test the URL from another machine on your network
  • Review firewall logs for blocked connections
  • Verify inbound rules allow traffic on the external port
  • Ensure the forwarded port (e.g., 8443) is not blocked locally

​
Additional resources

Darktrace Documentation

Official Darktrace documentation for API configuration and troubleshooting

ThreatAware Support

Contact ThreatAware support for integration assistance

​
Best practices

Credential Management
  • Create a dedicated user account or API credentials for ThreatAware
  • Store API and Private tokens securely in your password manager
  • Rotate tokens annually or per your security policy
  • Document which accounts have API credential generation privileges
  • Monitor for authentication failures in ThreatAware regularly
Network Security (On-Premise)
  • Restrict firewall port forwarding to only ThreatAware’s AWS IP addresses
  • Use a non-standard external port to reduce exposure
  • Regularly review firewall logs for unauthorized access attempts
  • Keep Darktrace updated to the latest version
  • Monitor for unusual API access patterns that could indicate compromise