> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Darktrace XDR

> Connect ThreatAware to Darktrace to monitor AI-driven threat detection and incident response

## Overview

The Darktrace XDR integration enables ThreatAware to collect threat detection data from your Darktrace deployment, providing visibility into AI-driven security insights and incident response across your organisation.

<Info>
  **Connection Method**: API
  **Setup Time**: 15 minutes
  **Access Required**: Darktrace Administrator account
</Info>

## Data collected

The Darktrace XDR integration provides:

* Threat detections and incidents
* AI-driven security insights
* Anomalous behaviour patterns
* Security event data
* Compliance and risk metrics

## Use cases

<CardGroup cols={2}>
  <Card title="Threat Detection Monitoring" icon="triangle-exclamation">
    Track AI-driven threat detections and security incidents
  </Card>

  <Card title="Anomaly Detection" icon="eye">
    Monitor anomalous behaviour patterns in your environment
  </Card>

  <Card title="Incident Response" icon="fire">
    Correlate Darktrace insights with device inventory for faster response
  </Card>

  <Card title="Security Analytics" icon="bar-chart">
    Analyze security trends and identify patterns
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to Darktrace Console">
    Access the [Darktrace Console](https://app.darktrace.com) with an account that has administrator privileges.
  </Step>

  <Step title="Navigate to API Settings">
    In the Darktrace console:

    * Go to **Settings** > **Integrations** > **API Tokens**
    * This is where you'll create your API token
  </Step>

  <Step title="Create an API Token">
    Click **Add Token** to create a new API token for ThreatAware integration.

    * Assign a descriptive name (e.g., "ThreatAware Integration")
    * Set the permissions to **Read-only** for monitoring purposes
    * Copy the **API Token** that is generated

    <Warning>
      The API Token will only be displayed once. Copy it immediately and store it securely.
    </Warning>
  </Step>

  <Step title="Enter API Token in ThreatAware">
    In ThreatAware:

    * Navigate to **Settings** > **Integrations**
    * Search for and select **Darktrace**
    * Paste the **API Token** into the required field
  </Step>

  <Step title="Connect and Verify">
    Click **Connect** to establish the integration.

    Verify the connection status shows **Active** in ThreatAware.
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="API Token" icon="key">
    **Field Name**: Darktrace API Token
    **Type**: Password (encrypted)
    **Description**: The API token generated in Darktrace for integration access

    <Tip>
      Store this credential securely in your organisation's password manager. The API token provides access to Darktrace security data.
    </Tip>
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the Darktrace integration shows **Active** status

2. **Verify Data Collection**
   * Wait up to 1 hour for the initial data sync
   * Check that Darktrace threat detection data appears
   * Verify incident and anomaly data is visible in your dashboard

3. **Test Queries**
   * Create a test query to filter by Darktrace threat detections
   * Verify incident data matches your Darktrace environment
   * Test filtering by threat level or type

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Token" icon="triangle-exclamation">
    **Symptoms**: Connection fails with authentication error

    **Solutions**:

    * Verify the API token is entered correctly without extra spaces
    * Ensure the API token was copied completely from Darktrace
    * Check that the API token has not expired
    * Generate a new API token if needed and update in ThreatAware
  </Accordion>

  <Accordion title="Permission Errors" icon="ban">
    **Symptoms**: Integration connects but returns permission denied errors

    **Solutions**:

    * Verify the API token has read permissions to:
      * Threat detections and incidents
      * Security events
      * Analytics and insights
    * Review the [Darktrace API Documentation](https://docs.darktrace.com) for required permissions
    * Regenerate the token with appropriate permissions if needed
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the Darktrace service is online and accessible
    * Check firewall rules allow outbound HTTPS access to Darktrace
    * Test connectivity to the Darktrace API endpoint
    * Contact Darktrace support if service issues persist
  </Accordion>

  <Accordion title="No Data Appearing" icon="database">
    **Symptoms**: Integration shows active but no Darktrace data appears

    **Solutions**:

    * Verify there is threat detection data in Darktrace to collect
    * Check the API token has sufficient permissions
    * Wait up to 1 hour for the initial data sync
    * Review ThreatAware integration logs for errors
    * Verify your Darktrace environment has active monitoring
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Darktrace API Documentation" icon="book" href="https://docs.darktrace.com">
    Official Darktrace documentation for API configuration and permissions
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Generate a dedicated API token specifically for ThreatAware
  * Store the API token securely in your organisation's password manager
  * Rotate API tokens annually or per your security policy
  * Monitor for authentication failures in ThreatAware logs
</Tip>

<Tip>
  **Security Considerations**

  * Only grant read permissions to the API token
  * Limit API token scope to necessary data
  * Review Darktrace audit logs periodically to monitor API usage
  * Follow your organisation's least privilege principles
</Tip>