> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting Started

> Your first 24 hours — explore data, configure Vitals, wire your first Action, save your first view

<Info>
  **Tier note:** this guide walks you through the full set of features available in the **Protect** tier (Vitals, Issues, Action Center, User & Software Inventory). If you're on **Connect** or **Discover**, some sections won't apply to your tenant yet — they're marked per-page. See your account team about upgrading.
</Info>

This guide picks up where [Onboarding](/onboarding) leaves off. You have integrations connected, devices flowing in. Now what?

## Hour 1: Walk the product

<Steps>
  <Step title="Run the in-product tour">
    Your initials → Help for this page → Restart tour. Nine screens, two minutes, every Dashboard panel explained. [Tour](/tour) covers the full content.
  </Step>

  <Step title="Open Device Explorer">
    `/device-explorer`. Look at the globe — does it match your geographic footprint? Look at the integration sync row — every integration `Now` or under 2 hours?
  </Step>

  <Step title="Open Devices and click around">
    Click into 5-10 random device rows. Use the [X-Ray](/x-ray) tab on each. Do you see data from multiple integrations? Are timestamps fresh?
  </Step>

  <Step title="Visit Issues">
    `/issues`. Sort by severity. Click into a few Critical or High Issues to understand the format. Don't act yet — just absorb.
  </Step>

  <Step title="Visit Action Center">
    `/action-center`. Likely empty on day one — that's expected. You'll create your first Action in Hour 6.
  </Step>
</Steps>

## Hours 2-4: Review the data

### Estate sanity check

The Dashboard's **Estate Summary** shows your total device count. Compare against:

* Your AD device count
* Your Endpoint Detection and Response (EDR) tool's device count
* Your Mobile Device Management (MDM) tool's device count
* Your IT spreadsheet (if any)

If Protect's count is **substantially different** from all sources, three likely causes:

| Cause                              | Fix                                                            |
| ---------------------------------- | -------------------------------------------------------------- |
| Default filter excludes Inactive   | Verify in Devices toolbar                                      |
| One source isn't syncing properly  | Check [Settings → Integrations](/settings/integrations)        |
| Matching is over-aggressive (rare) | Compare X-Ray across "duplicate" rows; contact support if real |

### Tag the estate

Open [Settings → Tags](/settings/tags). For each tag:

1. Review the Logic Engine rule
2. Check device count looks plausible
3. Open Coverage Explorer to find devices in zero tags

Common day-one tag work:

* Create regional tags if not present (`EMEA`, `NA`, `APAC`)
* Refine the `End-User` rule to exclude devices that aren't truly end-user (servers in disguise, stock devices)
* Add a `Stock` tag for devices not yet deployed (so they don't fail Vitals)

See [Tags & Logic Engine](/tags-and-logic-engine) for design patterns.

## Hours 5-8: Configure your first Vitals

Vitals are useless without configuration — they have nothing to compare against. Start with EDR.

<Steps>
  <Step title="Open Devices in Vitals view">
    `/devices` → footer toggle Vitals (not Deployment).
  </Step>

  <Step title="Find your EDR column">
    Likely CrowdStrike, Defender, or SentinelOne. Click its column header gear → Enter Configure Mode.
  </Step>

  <Step title="Set tag requirements">
    Tick `End-User`, `Server`, `VM`. Leave `BYOD` and `Stock` unticked.
  </Step>

  <Step title="Choose configuration checks">
    Start light:

    * ✓ Agent reporting in last 7 days
    * ✓ Sensor status = Online
    * (skip Prevention policy for now — add later once you understand the noise)
  </Step>

  <Step title="Exit Configure Mode">
    The column repaints. Sort it to see your gaps and the healthy population.
  </Step>

  <Step title="Spot-check 10 devices">
    Click 10 unhealthy devices in turn, open [X-Ray](/x-ray), confirm the unhealthy state has a real cause. If you find false positives, return to Configure Mode and adjust.
  </Step>
</Steps>

Repeat for one MDM (Intune or Jamf) and one identity check (Multi-Factor Authentication (MFA) enrolment).

## Hour 6-8: Save useful views

Build the queries you'll come back to:

| View name                     | Query                                                                                      |
| ----------------------------- | ------------------------------------------------------------------------------------------ |
| **End-User Without EDR**      | `tags:End-User AND system.crowdstrike.required:true AND system.crowdstrike.deployed:false` |
| **Broken CrowdStrike Agents** | `system.crowdstrike.deployed:true AND system.crowdstrike.functioning:false`                |
| **Misconfigured CrowdStrike** | `system.crowdstrike.functioning:true AND system.crowdstrike.configuredCorrectly:false`     |
| **Windows End-User devices**  | `tags:End-User AND os:Windows`                                                             |

For each: build in Devices → Save View → name → Team visibility.

## Day 2: First Action and first Scheduled Report

### Your first Action

Start small. Build a Continuous Action with email-only automation:

<Steps>
  <Step title="In Devices, build the query">
    `tags:End-User AND system.crowdstrike.required:true AND system.crowdstrike.deployed:false`
  </Step>

  <Step title="Click Create Action">
    Footer button.
  </Step>

  <Step title="Configure">
    * Name: `End-User Laptops Missing CrowdStrike`
    * Type: Continuous
    * Priority: Important
    * Owner: your SecOps team
    * Minimum time in view: 24 hours
    * Resolution: `system.crowdstrike.deployed:true AND system.crowdstrike.functioning:true AND system.crowdstrike.configuredCorrectly:true`
  </Step>

  <Step title="Automation: Email">
    Recipients: yourself + security ops shared mailbox. Subject: `Device {DeviceName} missing CrowdStrike — needs deployment`.
  </Step>

  <Step title="Save and watch">
    The Action goes live. Within the next sync cycle, devices matching the trigger will start to surface. After 24 hours of being in view, emails begin.
  </Step>
</Steps>

Validate that the emails look right before adding additional channels (tickets, webhooks).

### Your first Scheduled Report

Take the first saved view you created (e.g. "End-User Without EDR") and schedule it:

1. [Settings → Scheduled Reports](/settings/scheduled-reports) → + Create Report
2. Saved view: pick your saved view
3. Format: CSV
4. Schedule: Weekly, Monday 8am
5. Recipients: your immediate team (3-4 people max)
6. Save

The first delivery is the following Monday.

## Days 3-5: Iterate and expand

### Refine Vitals based on real data

After 48 hours of operation:

* Review the Vitals view sorted by unhealthy count
* For each integration where you see noise: tighten requirements, add grace periods, exclude transient states
* For each gap pattern (e.g. all of one office failing): create a Snapshot Action to drive a campaign

### Expand integrations

Add Phase 2 integrations:

* Vulnerability scanner (Qualys, Rapid7, Tenable)
* Patch management (System Center Configuration Manager (SCCM) via PowerShell Relay)
* Network scanning (Lansweeper, PDQ)
* ITSM (ServiceNow / Jira / Halo for ticket automation)

### Wire more Actions

Once email Actions are stable:

* Layer ServiceNow ticket creation onto the same triggers (Phase 2 of an Action)
* Build broken-agent Recovery Action (`system.crowdstrike.deployed:true AND system.crowdstrike.functioning:false` with 48-hour debounce)
* Create a Snapshot Action for any in-flight project (OS migration, decommissioning wave)

### Explore Reporting

[Reporting](/reporting) editor → click `+ New`. Build a small dashboard:

```text theme={null}
Make a dashboard with:
  - Total device count as a big metric at top
  - A donut chart of devices by OS
  - A bar chart of EDR coverage % by region
```

The AI builds it in 60-90 seconds. Iterate on what you'd want leadership to see.

## Week 1 retrospective

By the end of week 1 you should have:

* ✓ 5-10 integrations connected and syncing
* ✓ Tag taxonomy in place
* ✓ Vitals configured for EDR, MDM, encryption
* ✓ 5-10 saved views
* ✓ 2-3 Continuous Actions running
* ✓ 1-2 Scheduled Reports going out
* ✓ A starter Studio dashboard
* ✓ A clearer picture of your gaps than any single tool gave you

## Week 2-4: Maturity

| Goal                                        | How                                                        |
| ------------------------------------------- | ---------------------------------------------------------- |
| **Convert email Actions to ticket Actions** | Add ServiceNow / Halo as a second channel                  |
| **Tighten Vitals**                          | Move from base checks to policy-level configuration checks |
| **Roll out across teams**                   | Add users, create custom roles, set data filters           |
| **Define your reporting rhythm**            | Daily for SOC, weekly for managers, monthly for leadership |
| **Set MTTR targets**                        | Make the dashboard show progress over time                 |

## Common first-week questions

<AccordionGroup>
  <Accordion title="Why does my device count differ from [Tool]?">
    Three usual causes:

    1. Protect deduplicates across tools (right answer; total will look lower than the sum of all tool counts)
    2. Active vs. Inactive filter (Protect defaults to Active)
    3. The tool itself counts archived / deleted devices that Protect filters out

    Use [X-Ray](/x-ray) on a specific device to see exactly which tools see it.
  </Accordion>

  <Accordion title="How often does data refresh?">
    Hourly from every integration. Processing takes 5-30 minutes after the sync. To force a sync now, go to [Settings → Integrations](/settings/integrations) → click the integration → Sync Now.
  </Accordion>

  <Accordion title="Can I delete devices?">
    No — and that's intentional. Protect reflects reality from your tools. If a device should be gone, decommission it in the source tool; it'll drop out of Protect within the [Inactive threshold](/settings/misc).
  </Accordion>

  <Accordion title="Why is an agent showing 'Not Functioning'?">
    Protect detected that the device is active elsewhere (recent activity in other tools) but this specific agent hasn't reported in too long. This is silent-failure detection — the agent is probably broken. Investigate via [X-Ray](/x-ray).
  </Accordion>

  <Accordion title="How do I export data?">
    Build a saved view → Export from the footer (CSV / JSON / XLSX). Or schedule it as a [Scheduled Report](/scheduled-reports). For programmatic / very large exports, use the [API](/api-reference/introduction).
  </Accordion>

  <Accordion title="Can I integrate with a tool not in the list?">
    Probably — contact your account manager with the vendor name + their API documentation. Typical turnaround for a new integration is 2-4 weeks.
  </Accordion>
</AccordionGroup>

## Success metrics

| After       | Look for                                                                                                                           |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| **30 days** | All priority integrations connected; Vitals configured for top 3 controls; 2-5 Actions running; baseline reporting in place        |
| **90 days** | 90%+ healthy on key controls; MTTR under 7 days; 80%+ automation of common gaps; 5+ Studio apps; executive-level reporting cadence |

## See also

<CardGroup cols={3}>
  <Card title="Platform Overview" icon="compass" href="/platform-overview">
    The conceptual map
  </Card>

  <Card title="Tour" icon="circle-play" href="/tour">
    Restart the in-product tour
  </Card>

  <Card title="Glossary" icon="book" href="/reference/glossary">
    Every term, defined
  </Card>

  <Card title="Vitals Configuration" icon="sliders" href="/vitals-configuration">
    Setup deep-dive
  </Card>

  <Card title="Action Center" icon="bolt" href="/automation">
    Automation patterns
  </Card>

  <Card title="Troubleshooting" icon="screwdriver-wrench" href="/reference/troubleshooting">
    Common issues
  </Card>
</CardGroup>