Skip to main content

​
Overview

The Ivanti Security Controls integration enables ThreatAware to collect read-only data from your Ivanti server, providing visibility into endpoint protection status, security policies, and device compliance.
Connection Method: Direct API Setup Time: 20 minutes Access Required: Ivanti Administrator account Requirements: Ivanti Security Controls 2018.3 or later

​
Data collected

The Ivanti Security Controls integration provides:
  • Endpoint protection status
  • Security policy compliance
  • Device inventory
  • Threat and vulnerability information

​
Use cases

Endpoint Protection

Monitor endpoint protection status across your infrastructure

Compliance Validation

Verify security policies are applied to devices

Device Inventory

Track managed devices and their security status

Threat Detection

Monitor threats detected by Ivanti Security Controls

​
Connection requirements

Before configuring the integration, ensure the following prerequisites are met:
  1. Ivanti Version: Ivanti Security Controls 2018.3 or later is installed
  2. Admin Account: Create a new administrator account with administrative access to the Ivanti Server
  3. Network Access: Ensure Port 3121 is open and listening
  4. IP Whitelist: Contact ThreatAware to obtain the necessary IP addresses for whitelist inclusion
  5. Firewall Rules: Configure network and Windows firewall to permit these connections
  6. Public IP: The Ivanti Host must be accessible via a public IP address
Port 3121 must be open and accessible from ThreatAware. Contact your network administrator to configure firewall rules if needed.

​
Setup instructions

1

Log in to ThreatAware

Access the ThreatAware dashboard and navigate to Settings > Systems.
2

Locate Ivanti Integration

Use the search bar to find Ivanti Security Controls in the systems list.
3

Click Connect

Click Connect, and a pop-up window will appear for entering credentials.
4

Create Admin Account in Ivanti

On your Ivanti Server, create a new administrator account:
  • Log in with existing administrator credentials
  • Navigate to user management
  • Create a new admin account specifically for ThreatAware
  • Document the username and password securely
Create a dedicated service account to limit access and improve security.
5

Configure Network Access

Ensure network connectivity is configured:
  • Verify Port 3121 is open and listening on the Ivanti Host
  • Contact ThreatAware to get the IP addresses that need to be whitelisted
  • Configure your firewall (network or Windows Firewall) to allow connections from these IPs
  • Test connectivity to the Ivanti Host from ThreatAware
Network misconfiguration is a common cause of connection failures. Verify port 3121 is accessible before proceeding.
6

Input Details in ThreatAware

Enter the following information into the ThreatAware integration form:
  • Ivanti Host IP: The public IP address or hostname of your Ivanti Server
  • Admin Username: The administrator username created in Ivanti
  • Admin Password: The password for the administrator account
7

Authorize Connection

Click the Authorize button to establish the connection.
  • ThreatAware will validate the credentials and network connectivity
  • Wait for the authorization to complete
8

Verify Connection

Confirm the connection is successful:
  • Check for confirmation notifications on the ThreatAware dashboard
  • Verify the integration status shows as Active
  • Wait 5-10 minutes for the initial data sync

​
Required credentials

Field Name: Ivanti Host IP Type: String Description: The public IP address or hostname of your Ivanti ServerFormat: 192.168.1.100 or ivanti.company.com Port: 3121 (must be open and accessible)
Field Name: Admin Username Type: String Description: The administrator username for the Ivanti Server accountThis should be the dedicated admin account created for ThreatAware.
Field Name: Admin Password Type: Password (encrypted) Description: The password for the Ivanti administrator account
Store this credential securely in your organisation’s password manager.

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings > Integrations in ThreatAware
    • Confirm the Ivanti Security Controls integration shows Active status
    • Check the last sync timestamp
  2. Verify Data Collection
    • Wait 10-15 minutes for the initial data sync
    • Check for endpoint protection data in ThreatAware
    • Verify device inventory and security status are appearing
  3. Test Queries
    • Create a test query to filter devices from Ivanti
    • Verify the data matches your Ivanti console

​
Troubleshooting

Symptoms: Connection timeout or “Connection refused” errorsSolutions:
  • Verify Port 3121 is open on the Ivanti Host: netstat -an | grep 3121
  • Check firewall rules on the Ivanti Server allow incoming connections on port 3121
  • Verify Windows Firewall is configured to permit connections
  • Confirm the IP addresses from ThreatAware are whitelisted
  • Test connectivity: telnet <ivanti-ip> 3121 from a test machine
Symptoms: Integration status shows authentication failureSolutions:
  • Verify the Admin Username and Admin Password are correct
  • Ensure there are no extra spaces in the credentials
  • Confirm the admin account is active and not locked in Ivanti
  • Check that the account has administrative privileges
  • Try resetting the password in Ivanti and re-entering it
Symptoms: Connection timeout or “Host not found” errorsSolutions:
  • Verify the Ivanti Host IP is the public IP address (not internal)
  • Confirm the IP address is accessible from ThreatAware’s network
  • Check for NAT or proxy configurations that might affect routing
  • Test the IP address from a network diagnostic tool
  • Contact your network administrator if the IP is internal only
Symptoms: Integration shows active but no endpoint data appearsSolutions:
  • Verify endpoints are managed by the Ivanti Security Controls server
  • Check that the admin account has access to device data
  • Review Ivanti access logs for any permission denied errors
  • Confirm the Ivanti Server is syncing data correctly
  • Contact ThreatAware support if the issue persists

​
Additional resources

Ivanti Documentation

Official Ivanti Security Controls documentation

ThreatAware Support

Contact ThreatAware support for integration assistance

​
Best practices

Network Configuration
  • Ensure Port 3121 is open before attempting to connect
  • Whitelist ThreatAware IP addresses in all firewalls
  • Test network connectivity from the ThreatAware network to the Ivanti Host
  • Document IP addresses and whitelisting for future reference
Credential Management
  • Create a dedicated admin account for ThreatAware
  • Store credentials in your organisation’s password manager
  • Rotate passwords periodically per your security policy
  • Monitor integration logs in ThreatAware for authentication failures
Security Considerations
  • Grant only necessary administrative permissions
  • Use network segmentation to control access to the Ivanti Server
  • Review Ivanti access logs periodically
  • Follow your organisation’s least privilege principles