Skip to main content

​
Overview

The Darktrace XDR integration enables ThreatAware to collect threat detection data from your Darktrace deployment, providing visibility into AI-driven security insights and incident response across your organisation.
Connection Method: API Setup Time: 15 minutes Access Required: Darktrace Administrator account

​
Data collected

The Darktrace XDR integration provides:
  • Threat detections and incidents
  • AI-driven security insights
  • Anomalous behaviour patterns
  • Security event data
  • Compliance and risk metrics

​
Use cases

Threat Detection Monitoring

Track AI-driven threat detections and security incidents

Anomaly Detection

Monitor anomalous behaviour patterns in your environment

Incident Response

Correlate Darktrace insights with device inventory for faster response

Security Analytics

Analyze security trends and identify patterns

​
Setup instructions

1

Log in to Darktrace Console

Access the Darktrace Console with an account that has administrator privileges.
2

Navigate to API Settings

In the Darktrace console:
  • Go to Settings > Integrations > API Tokens
  • This is where you’ll create your API token
3

Create an API Token

Click Add Token to create a new API token for ThreatAware integration.
  • Assign a descriptive name (e.g., “ThreatAware Integration”)
  • Set the permissions to Read-only for monitoring purposes
  • Copy the API Token that is generated
The API Token will only be displayed once. Copy it immediately and store it securely.
4

Enter API Token in ThreatAware

In ThreatAware:
  • Navigate to Settings > Integrations
  • Search for and select Darktrace
  • Paste the API Token into the required field
5

Connect and Verify

Click Connect to establish the integration.Verify the connection status shows Active in ThreatAware.

​
Required credentials

Field Name: Darktrace API Token Type: Password (encrypted) Description: The API token generated in Darktrace for integration access
Store this credential securely in your organisation’s password manager. The API token provides access to Darktrace security data.

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings > Integrations in ThreatAware
    • Confirm the Darktrace integration shows Active status
  2. Verify Data Collection
    • Wait up to 1 hour for the initial data sync
    • Check that Darktrace threat detection data appears
    • Verify incident and anomaly data is visible in your dashboard
  3. Test Queries
    • Create a test query to filter by Darktrace threat detections
    • Verify incident data matches your Darktrace environment
    • Test filtering by threat level or type

​
Troubleshooting

Symptoms: Connection fails with authentication errorSolutions:
  • Verify the API token is entered correctly without extra spaces
  • Ensure the API token was copied completely from Darktrace
  • Check that the API token has not expired
  • Generate a new API token if needed and update in ThreatAware
Symptoms: Integration connects but returns permission denied errorsSolutions:
  • Verify the API token has read permissions to:
    • Threat detections and incidents
    • Security events
    • Analytics and insights
  • Review the Darktrace API Documentation for required permissions
  • Regenerate the token with appropriate permissions if needed
Symptoms: Integration fails to connect or times outSolutions:
  • Verify the Darktrace service is online and accessible
  • Check firewall rules allow outbound HTTPS access to Darktrace
  • Test connectivity to the Darktrace API endpoint
  • Contact Darktrace support if service issues persist
Symptoms: Integration shows active but no Darktrace data appearsSolutions:
  • Verify there is threat detection data in Darktrace to collect
  • Check the API token has sufficient permissions
  • Wait up to 1 hour for the initial data sync
  • Review ThreatAware integration logs for errors
  • Verify your Darktrace environment has active monitoring

​
Additional resources

Darktrace API Documentation

Official Darktrace documentation for API configuration and permissions

ThreatAware Support

Contact ThreatAware support for integration assistance

​
Best practices

Credential Management
  • Generate a dedicated API token specifically for ThreatAware
  • Store the API token securely in your organisation’s password manager
  • Rotate API tokens annually or per your security policy
  • Monitor for authentication failures in ThreatAware logs
Security Considerations
  • Only grant read permissions to the API token
  • Limit API token scope to necessary data
  • Review Darktrace audit logs periodically to monitor API usage
  • Follow your organisation’s least privilege principles