> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Darktrace Agent

> Connect ThreatAware to Darktrace Agent to monitor network security and anomalies

## Overview

The Darktrace Agent integration enables ThreatAware to collect network security and threat detection data from your Darktrace instance. This integration provides visibility into network anomalies and potential security threats detected by Darktrace's AI-driven platform.

<Info>
  **Connection Method**: API Token with Optional Port Forwarding
  **Setup Time**: 20 minutes
  **Access Required**: Darktrace Administrator account, Firewall access (if on-premise)
</Info>

## Data collected

The Darktrace Agent integration provides:

* Network traffic analysis and anomalies
* Threat detection and AI insights
* Device and endpoint visibility
* Security incident information

## Use cases

<CardGroup cols={2}>
  <Card title="Network Anomaly Detection" icon="radar">
    Monitor network traffic for unusual patterns and potential threats
  </Card>

  <Card title="Threat Intelligence Integration" icon="shield-alert">
    Integrate Darktrace threat detections with your ThreatAware platform
  </Card>

  <Card title="Endpoint Visibility" icon="network-wired">
    Gain visibility into devices and endpoints across your network
  </Card>

  <Card title="Incident Investigation" icon="magnifying-glass">
    Correlate Darktrace incidents with other security data in ThreatAware
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to ThreatAware">
    Access the ThreatAware dashboard.

    * Navigate to **Settings** > **Systems**
    * Search for "Darktrace Agent"
  </Step>

  <Step title="Click Connect">
    Click the **Connect** button to start the integration setup.

    * A pop-up window will appear with credential input fields
  </Step>

  <Step title="Log in to Darktrace Console">
    Log in to your Darktrace console with an administrator account.

    * You will need to generate API credentials
  </Step>

  <Step title="Navigate to Admin Settings">
    In the Darktrace console:

    * Click **Admin** in the left-hand panel
    * Select **System Config**
    * Scroll to the bottom of the configuration page
  </Step>

  <Step title="Generate API Token">
    In the System Config section:

    * Look for the API token generation option
    * Click **Generate** to create a new API token
    * Copy the generated **API Token**
    * Also note the **Private Token** if shown
    * Store these securely

    <Tip>
      Save both tokens immediately. Some API providers do not allow you to retrieve them again after creation.
    </Tip>
  </Step>

  <Step title="Retrieve Platform URL">
    Obtain your Darktrace platform URL:

    * Copy the base URL from your browser address bar
    * If cloud-hosted: typically `https://<instance>.darktrace.com`
    * If on-premise: you'll need to set up port forwarding (see next step)
  </Step>

  <Step title="Configure Port Forwarding (On-Premise Only)">
    If your Darktrace platform is hosted on-premise:

    * Create a port forwarding rule on your firewall to the Darktrace server on **port 443**
    * Restrict inbound access to the current ThreatAware allowlist IP addresses, available in-product under **Settings → Integrations → AWS Account / IP Whitelist Info**
    * Format your URL as: `https://<PUBLIC_IP>:<PORT>`

    <Warning>
      Only allow connections from ThreatAware's IP addresses for security. Do not expose Darktrace directly to the public internet without restrictions.
    </Warning>
  </Step>

  <Step title="Input Details in ThreatAware">
    Return to the ThreatAware connection dialog and enter:

    * **Platform URL**: Your Darktrace instance URL
    * **API Token**: The API token generated in step 5
    * **Private Token**: The private token generated in step 5
    * Click **Connect** to establish the integration
  </Step>

  <Step title="Verify Connection">
    After connecting, verify the integration is working correctly.

    * Check the connection status indicates **success**
    * In ThreatAware, navigate to **Settings** > **Systems** and verify the status shows **Connected**
    * Wait 5-10 minutes for initial data synchronization
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Platform URL" icon="globe">
    **Field Name**: Darktrace Platform URL
    **Type**: String
    **Description**: The URL of your Darktrace instance

    **For Cloud-Hosted**:

    * Format: `https://<instance>.darktrace.com`
    * Example: `https://acme.darktrace.com`

    **For On-Premise**:

    * Format: `https://<PUBLIC_IP>:<PORT>`
    * Example: `https://203.0.113.42:8443`
  </Accordion>

  <Accordion title="API Token" icon="key">
    **Field Name**: Darktrace API Token
    **Type**: String (sensitive)
    **Description**: The API token generated in Darktrace System Config

    <Tip>
      Store this token securely in your organisation's password manager. It provides access to your Darktrace data.
    </Tip>
  </Accordion>

  <Accordion title="Private Token" icon="lock">
    **Field Name**: Darktrace Private Token
    **Type**: String (sensitive)
    **Description**: The private token generated in Darktrace System Config

    <Tip>
      This is a sensitive credential. Store it securely alongside your API token.
    </Tip>
  </Accordion>
</AccordionGroup>

## On-premise network configuration

<AccordionGroup>
  <Accordion title="AWS IP Addresses" icon="shield">
    ThreatAware connects from a dedicated set of AWS IP addresses. Configure your firewall to allow inbound traffic from the current allowlist, available in-product under **Settings → Integrations → AWS Account / IP Whitelist Info**.

    Both should connect on port 443 (HTTPS) to your Darktrace server.
  </Accordion>

  <Accordion title="Firewall Port Forwarding Setup" icon="network-wired">
    **Example firewall rule:**

    * External Interface: Your public IP address
    * External Port: `8443` (or your chosen port)
    * Internal Host: Your Darktrace server IP (e.g., `192.168.1.50`)
    * Internal Port: `443`
    * Restrict Source to the current ThreatAware allowlist IPs (see **Settings → Integrations → AWS Account / IP Whitelist Info**)
    * Protocol: HTTPS/TLS
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Systems** in ThreatAware
   * Locate the Darktrace Agent integration
   * Confirm the status shows **Connected**

2. **Verify Data Collection**
   * Wait 10 minutes for the initial data poll
   * Look for network anomalies and threat data appearing in ThreatAware
   * Verify the data matches your Darktrace instance

3. **Test Connectivity**
   * If on-premise, verify port forwarding from the public IP to Darktrace
   * Confirm ThreatAware can reach the platform URL

## Troubleshooting

<AccordionGroup>
  <Accordion title="Connection Refused or Timeout" icon="triangle-exclamation">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the Platform URL is correct and accessible
    * For cloud-hosted: test the URL in a browser
    * For on-premise: verify firewall port forwarding is active
    * Ensure ThreatAware's allowlist IPs are whitelisted (see **Settings → Integrations → AWS Account / IP Whitelist Info**)
    * Confirm Darktrace server is online and responding
    * Check firewall logs for blocked connections
  </Accordion>

  <Accordion title="Authentication Failed" icon="ban">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify both the **API Token** and **Private Token** are correctly entered
    * Ensure both tokens are complete and without extra spaces
    * Confirm the tokens haven't expired
    * Try regenerating new tokens in the Darktrace console
    * Verify the user account creating tokens has admin privileges
    * Check that tokens are still valid in the Darktrace System Config
  </Accordion>

  <Accordion title="No Data Appearing" icon="database">
    **Symptoms**: Integration shows connected but no anomaly or threat data appears

    **Solutions**:

    * Verify Darktrace has network traffic to analyze
    * Wait at least 10 minutes for initial data synchronization
    * Confirm the API tokens have permission to access threat data
    * Review Darktrace documentation for API scopes and permissions
    * Check that your Darktrace license includes API access
    * Contact Darktrace support if data collection continues to fail
  </Accordion>

  <Accordion title="On-Premise Firewall Issues" icon="fire">
    **Symptoms**: Can't reach the on-premise Darktrace instance

    **Solutions**:

    * Verify port forwarding rule is active and persistent
    * Confirm the internal Darktrace server IP is correct
    * Test the URL from another machine on your network
    * Review firewall logs for blocked connections
    * Verify inbound rules allow traffic on the external port
    * Ensure the forwarded port (e.g., 8443) is not blocked locally
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Darktrace Documentation" icon="book" href="https://www.darktrace.com">
    Official Darktrace documentation for API configuration and troubleshooting
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Create a dedicated user account or API credentials for ThreatAware
  * Store API and Private tokens securely in your password manager
  * Rotate tokens annually or per your security policy
  * Document which accounts have API credential generation privileges
  * Monitor for authentication failures in ThreatAware regularly
</Tip>

<Tip>
  **Network Security (On-Premise)**

  * Restrict firewall port forwarding to only ThreatAware's AWS IP addresses
  * Use a non-standard external port to reduce exposure
  * Regularly review firewall logs for unauthorized access attempts
  * Keep Darktrace updated to the latest version
  * Monitor for unusual API access patterns that could indicate compromise
</Tip>