> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Ivanti Security Controls

> Connect ThreatAware to Ivanti Security Controls to monitor endpoint protection and compliance

## Overview

The Ivanti Security Controls integration enables ThreatAware to collect read-only data from your Ivanti server, providing visibility into endpoint protection status, security policies, and device compliance.

<Info>
  **Connection Method**: Direct API
  **Setup Time**: 20 minutes
  **Access Required**: Ivanti Administrator account
  **Requirements**: Ivanti Security Controls 2018.3 or later
</Info>

## Data collected

The Ivanti Security Controls integration provides:

* Endpoint protection status
* Security policy compliance
* Device inventory
* Threat and vulnerability information

## Use cases

<CardGroup cols={2}>
  <Card title="Endpoint Protection" icon="shield-halved">
    Monitor endpoint protection status across your infrastructure
  </Card>

  <Card title="Compliance Validation" icon="clipboard-check">
    Verify security policies are applied to devices
  </Card>

  <Card title="Device Inventory" icon="eye">
    Track managed devices and their security status
  </Card>

  <Card title="Threat Detection" icon="file-contract">
    Monitor threats detected by Ivanti Security Controls
  </Card>
</CardGroup>

## Connection requirements

Before configuring the integration, ensure the following prerequisites are met:

1. **Ivanti Version**: Ivanti Security Controls 2018.3 or later is installed
2. **Admin Account**: Create a new administrator account with administrative access to the Ivanti Server
3. **Network Access**: Ensure **Port 3121** is open and listening
4. **IP Whitelist**: Contact ThreatAware to obtain the necessary IP addresses for whitelist inclusion
5. **Firewall Rules**: Configure network and Windows firewall to permit these connections
6. **Public IP**: The Ivanti Host must be accessible via a public IP address

<Warning>
  Port 3121 must be open and accessible from ThreatAware. Contact your network administrator to configure firewall rules if needed.
</Warning>

## Setup instructions

<Steps>
  <Step title="Log in to ThreatAware">
    Access the ThreatAware dashboard and navigate to **Settings** > **Systems**.
  </Step>

  <Step title="Locate Ivanti Integration">
    Use the search bar to find **Ivanti Security Controls** in the systems list.
  </Step>

  <Step title="Click Connect">
    Click **Connect**, and a pop-up window will appear for entering credentials.
  </Step>

  <Step title="Create Admin Account in Ivanti">
    On your Ivanti Server, create a new administrator account:

    * Log in with existing administrator credentials
    * Navigate to user management
    * Create a new admin account specifically for ThreatAware
    * Document the username and password securely

    <Tip>
      Create a dedicated service account to limit access and improve security.
    </Tip>
  </Step>

  <Step title="Configure Network Access">
    Ensure network connectivity is configured:

    * Verify **Port 3121** is open and listening on the Ivanti Host
    * Contact ThreatAware to get the IP addresses that need to be whitelisted
    * Configure your firewall (network or Windows Firewall) to allow connections from these IPs
    * Test connectivity to the Ivanti Host from ThreatAware

    <Warning>
      Network misconfiguration is a common cause of connection failures. Verify port 3121 is accessible before proceeding.
    </Warning>
  </Step>

  <Step title="Input Details in ThreatAware">
    Enter the following information into the ThreatAware integration form:

    * **Ivanti Host IP**: The public IP address or hostname of your Ivanti Server
    * **Admin Username**: The administrator username created in Ivanti
    * **Admin Password**: The password for the administrator account
  </Step>

  <Step title="Authorize Connection">
    Click the **Authorize** button to establish the connection.

    * ThreatAware will validate the credentials and network connectivity
    * Wait for the authorization to complete
  </Step>

  <Step title="Verify Connection">
    Confirm the connection is successful:

    * Check for confirmation notifications on the ThreatAware dashboard
    * Verify the integration status shows as **Active**
    * Wait 5-10 minutes for the initial data sync
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Ivanti Host IP" icon="server">
    **Field Name**: Ivanti Host IP
    **Type**: String
    **Description**: The public IP address or hostname of your Ivanti Server

    **Format**: `192.168.1.100` or `ivanti.company.com`
    **Port**: 3121 (must be open and accessible)
  </Accordion>

  <Accordion title="Admin Username" icon="user">
    **Field Name**: Admin Username
    **Type**: String
    **Description**: The administrator username for the Ivanti Server account

    This should be the dedicated admin account created for ThreatAware.
  </Accordion>

  <Accordion title="Admin Password" icon="lock">
    **Field Name**: Admin Password
    **Type**: Password (encrypted)
    **Description**: The password for the Ivanti administrator account

    <Tip>
      Store this credential securely in your organisation's password manager.
    </Tip>
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the Ivanti Security Controls integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait 10-15 minutes for the initial data sync
   * Check for endpoint protection data in ThreatAware
   * Verify device inventory and security status are appearing

3. **Test Queries**
   * Create a test query to filter devices from Ivanti
   * Verify the data matches your Ivanti console

## Troubleshooting

<AccordionGroup>
  <Accordion title="Port 3121 Not Accessible" icon="triangle-exclamation">
    **Symptoms**: Connection timeout or "Connection refused" errors

    **Solutions**:

    * Verify Port 3121 is open on the Ivanti Host: `netstat -an | grep 3121`
    * Check firewall rules on the Ivanti Server allow incoming connections on port 3121
    * Verify Windows Firewall is configured to permit connections
    * Confirm the IP addresses from ThreatAware are whitelisted
    * Test connectivity: `telnet <ivanti-ip> 3121` from a test machine
  </Accordion>

  <Accordion title="Invalid Credentials" icon="ban">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify the **Admin Username** and **Admin Password** are correct
    * Ensure there are no extra spaces in the credentials
    * Confirm the admin account is active and not locked in Ivanti
    * Check that the account has administrative privileges
    * Try resetting the password in Ivanti and re-entering it
  </Accordion>

  <Accordion title="Incorrect IP Address" icon="ban">
    **Symptoms**: Connection timeout or "Host not found" errors

    **Solutions**:

    * Verify the **Ivanti Host IP** is the public IP address (not internal)
    * Confirm the IP address is accessible from ThreatAware's network
    * Check for NAT or proxy configurations that might affect routing
    * Test the IP address from a network diagnostic tool
    * Contact your network administrator if the IP is internal only
  </Accordion>

  <Accordion title="No Data After 15 Minutes" icon="database">
    **Symptoms**: Integration shows active but no endpoint data appears

    **Solutions**:

    * Verify endpoints are managed by the Ivanti Security Controls server
    * Check that the admin account has access to device data
    * Review Ivanti access logs for any permission denied errors
    * Confirm the Ivanti Server is syncing data correctly
    * Contact ThreatAware support if the issue persists
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Ivanti Documentation" icon="book" href="https://www.ivanti.com/resources">
    Official Ivanti Security Controls documentation
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Network Configuration**

  * Ensure Port 3121 is open before attempting to connect
  * Whitelist ThreatAware IP addresses in all firewalls
  * Test network connectivity from the ThreatAware network to the Ivanti Host
  * Document IP addresses and whitelisting for future reference
</Tip>

<Tip>
  **Credential Management**

  * Create a dedicated admin account for ThreatAware
  * Store credentials in your organisation's password manager
  * Rotate passwords periodically per your security policy
  * Monitor integration logs in ThreatAware for authentication failures
</Tip>

<Tip>
  **Security Considerations**

  * Grant only necessary administrative permissions
  * Use network segmentation to control access to the Ivanti Server
  * Review Ivanti access logs periodically
  * Follow your organisation's least privilege principles
</Tip>