> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Heimdal

> Connect ThreatAware to Heimdal Security to monitor endpoint threats and security events

## Overview

The Heimdal integration enables ThreatAware to collect read-only data from your Heimdal Security platform, providing visibility into endpoint threats, security events, and device compliance.

<Info>
  **Connection Method**: API
  **Setup Time**: 10 minutes
  **Access Required**: Heimdal Administrator account
</Info>

## Data collected

The Heimdal integration provides:

* Endpoint threat data
* Security events and alerts
* Device compliance information
* API access controls

## Use cases

<CardGroup cols={2}>
  <Card title="Threat Monitoring" icon="shield-halved">
    Monitor endpoint threats detected by Heimdal
  </Card>

  <Card title="Security Events" icon="clipboard-check">
    Track security events across your infrastructure
  </Card>

  <Card title="Device Compliance" icon="eye">
    Validate device security compliance status
  </Card>

  <Card title="Incident Response" icon="file-contract">
    Generate reports on security incidents and threats
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to Heimdal Security Console">
    Access the [Heimdal Security Console](https://portal.heimdalsecurity.com) with an account that has administrator privileges.
  </Step>

  <Step title="Generate API Token">
    In the Heimdal console:

    * Navigate to **Settings** > **API Access**
    * Click **Generate API Token**
    * Set permissions to **Read-only** or monitoring permissions as required for ThreatAware
    * Copy the **API Token** once it's generated

    <Tip>
      Store this token securely. It will only be displayed once during generation.
    </Tip>
  </Step>

  <Step title="Retrieve Console URL">
    Make note of your Heimdal Security Console URL. This is typically:

    Example: `https://portal.heimdalsecurity.com`
  </Step>

  <Step title="Configure in ThreatAware">
    Complete the integration setup in ThreatAware:

    * Navigate to **Settings** > **Integrations**
    * Search for and select **Heimdal**
    * Enter the required credentials:
      * **API Token**: The token generated in Heimdal Security
      * **Heimdal Console URL**: Your Heimdal Security Console instance URL
    * Click **Connect** to establish the integration
  </Step>

  <Step title="Verify Connection">
    After connecting, verify the integration is working:

    * Check that the **Integration Status** shows as **Active**
    * Confirm that threat and security event data is appearing in ThreatAware
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="API Token" icon="key">
    **Field Name**: Heimdal API Token
    **Type**: Password (encrypted)
    **Description**: The token generated for API access in Heimdal Security

    <Tip>
      Store this credential securely in your organisation's password manager. The token is only displayed once during generation.
    </Tip>
  </Accordion>

  <Accordion title="Heimdal Console URL" icon="server">
    **Field Name**: Heimdal URL
    **Type**: String
    **Description**: The URL of your Heimdal Security Console instance

    **Format**: `https://portal.heimdalsecurity.com`
    **Example**: `https://portal.heimdalsecurity.com` or your organisation's custom Heimdal instance URL
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the Heimdal integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait 5-10 minutes for the initial data sync
   * Check for threat and security event data in ThreatAware
   * Verify device compliance information is being collected

3. **Test Queries**
   * Create a test query to filter data from Heimdal
   * Verify the threat data matches your expectations

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Token Error" icon="triangle-exclamation">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify the **API Token** is exactly as displayed in Heimdal (no extra spaces)
    * Ensure the token has not expired
    * Regenerate a new API token in Heimdal if the current one is suspect
    * Confirm your Heimdal account has administrator privileges
  </Accordion>

  <Accordion title="Permission Denied" icon="ban">
    **Symptoms**: Integration connects but fails to retrieve data

    **Solutions**:

    * Verify the API token has read permissions for threat and security event data
    * Check that the token has access to the necessary Heimdal resources
    * Review the [Heimdal API Documentation](https://docs.heimdalsecurity.com) for permission details
    * Ensure your API token has not been revoked or disabled
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the **Heimdal Console URL** is correct and accessible
    * Check firewall rules allow outbound HTTPS (443) to Heimdal servers
    * Test the URL in a browser to ensure it's reachable
    * Confirm your Heimdal Security platform is online and responsive
  </Accordion>

  <Accordion title="No Data After 10 Minutes" icon="database">
    **Symptoms**: Integration shows active but no threat data appears

    **Solutions**:

    * Verify there is threat or security event data in Heimdal to collect
    * Check that your endpoints are monitored by Heimdal
    * Confirm the API token has access to threat and security event data
    * Wait up to 15 minutes for the initial sync to complete
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Heimdal API Documentation" icon="book" href="https://docs.heimdalsecurity.com">
    Official Heimdal API documentation for detailed permissions and configuration
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Store your API token securely in your organisation's password manager
  * Regenerate API tokens annually or per your security policy
  * Monitor integration logs in ThreatAware for authentication failures
  * Keep track of token generation dates and set renewal reminders
</Tip>

<Tip>
  **Security Considerations**

  * API tokens provide access to threat and security data
  * Only share API tokens with authorised personnel
  * Review your Heimdal API activity logs periodically
  * Regenerate API tokens if they are exposed or compromised
</Tip>