> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform Overview

> How ThreatAware Protect collects, deduplicates, and surfaces device data — and the shape of the UI you'll work in every day

This page is the conceptual map. Read it once and the rest of the docs make sense.

## The product surface

ThreatAware Protect is a single web application at `https://<your-cloud-id>.threataware.com`. The chrome is consistent across every page.

<img src="https://mintcdn.com/threatawareltd/IwzdezxNqgZB-5I4/images/core/device-explorer-landing.png?fit=max&auto=format&n=IwzdezxNqgZB-5I4&q=85&s=4afdf25dbb83a5150198a9fdeb09a5f6" alt="ThreatAware Protect interface with top bar, left rail, integration sync timeline, and main canvas" width="1440" height="900" data-path="images/core/device-explorer-landing.png" />

### Top bar

* **Logo + product name**: `ThreatAware Protect`. On the **Device Explorer** page the version (e.g. `3.2.0`) is appended; on other pages only `Protect` is shown. The clock, theme toggle, visibility eye, notifications bell, and user menu sit to the right.
* **Breadcrumb**: e.g. `/ Settings / Tags` — click any segment to jump back up.
* **Date / time** in your locale (configurable in [Settings → Timezone](/settings/timezone)).
* **Theme toggle** — switch between dark (default) and light.
* **Visibility toggle** — show/hide sensitive fields (helpful when screen-sharing).
* **Notifications** — bell icon with badge.
* **User menu** — initials + first name. Reveals:
  * Your name, tenant role, email, team chips
  * **Sandbox Controls** (in sandbox tenants)
  * **Help for this page** (restarts the in-product tour)
  * **About** • **Install Browser Extension** ↗ • **Log Out**

### Left rail

Seven primary destinations (top section), then pinned Studio apps (middle), then **Settings** (bottom):

| Order | Section                   | Path                  |
| ----- | ------------------------- | --------------------- |
| 1     | Dashboard                 | `/dashboard`          |
| 2     | Devices                   | `/devices`            |
| 3     | User Inventory            | `/user-inventory`     |
| 4     | Software Inventory        | `/software-inventory` |
| 5     | Issues                    | `/issues`             |
| 6     | Action Center             | `/action-center`      |
| 7     | Reporting (Studio editor) | `/studio/editor`      |
| —     | *Pinned Studio apps*      | `/studio/app/<id>`    |
| —     | Settings                  | `/settings`           |

The **Device Explorer** at `/device-explorer` is the default landing route after Single Sign-On (SSO) and can be re-set in [Settings → Misc](/settings/misc). The **Network Inventory** at `/network-device-inventory` is reachable from links on Device Explorer / Dashboard but isn't a primary left-rail destination.

## Core architecture

ThreatAware Protect uses a patented **timeline-matching algorithm** to discover and track devices:

<Steps>
  <Step title="Collection">
    Protect polls every connected tool via API on a schedule (typically every hour). On-prem tools without cloud APIs are reached via the [PowerShell Relay](/powershell-relay).
  </Step>

  <Step title="Normalization">
    Each tool's data is mapped into a canonical schema — `hostName`, `metadata.serial_number`, `lastOnline`, `macAddress`, and so on. See [Reference → Query Syntax](/reference/query-syntax) for the full field list.
  </Step>

  <Step title="Matching & deduplication">
    A single physical device may report from CrowdStrike, Intune, Active Directory, and Lansweeper. The matching algorithm uses **serial number, machine name, MAC address, user association, and timeline correlation** to fuse those reports into one device record.
  </Step>

  <Step title="Enrichment & vitals">
    The unified record is enriched with derived fields (location from IP geolocation, tags from rules) and evaluated against your [Vitals](/security-monitoring) configuration.
  </Step>
</Steps>

### Data flow

| Stage                                                          | What happens                                                                              |
| -------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| **1. Your environment**                                        | Vendor consoles (CrowdStrike, Intune, AD, Jamf, Qualys, ServiceNow, …) hold the raw state |
| **2. Read-only API pull**                                      | Protect polls each vendor over HTTPS 443 with read-only credentials                       |
| **3. ThreatAware Protect** (AWS, ISO 27001 + Cyber Essentials) | Collection → Normalize → Match/Dedupe → Vitals → Issues                                   |
| **4. Surfaces**                                                | Dashboard, Devices, Issues, Action Center, Reporting                                      |

## Dashboard

<img src="https://mintcdn.com/threatawareltd/IwzdezxNqgZB-5I4/images/core/dashboard-clean.png?fit=max&auto=format&n=IwzdezxNqgZB-5I4&q=85&s=564bffdbd5811cc25034df40b45480b3" alt="Dashboard with Estate Summary, Actions Summary, Tag Coverage Map, Overall Control Health trend, and per-integration health cards" width="1440" height="900" data-path="images/core/dashboard-clean.png" />

Five panels in a fixed grid:

| Panel                      | What it shows                                                                                                                      |
| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| **Estate Summary**         | Total active device count, delta since last period                                                                                 |
| **Actions Summary**        | Two sub-tabs: **Continuous** (Total Jobs / Unresolved Devices / Success Rate) and **Snapshot** (Total Jobs / Due Soon / Progress)  |
| **Tag Coverage Map**       | Tree-map visualisation showing how devices distribute across your tags                                                             |
| **Overall Control Health** | Trend line — security posture % across all controls, with **7D / 1M / 3M / 1Y** range buttons                                      |
| **Integration Control**    | One card per integration with health %, device counts (e.g. `707/877 healthy`), and a sparkline. Tabs: **NOW / 7D / 1M / 3M / 1Y** |

Clicking any Integration Control card takes you to **Devices** filtered to that integration's slice of the estate.

The tag chips strip along the bottom (`APAC`, `BYOD`, `EMEA`, `End-User`, `Mac`, `NA`, `Server`, `Stock`, `VM` …) filters the entire dashboard to devices carrying that tag.

## Equal-treatment philosophy

ThreatAware treats every integration equally. **No tool is designated "primary" or "source of truth".**

* A device discovered in *any* connected source appears in Protect
* The matching algorithm fuses cross-tool data into one record
* Discrepancies become visible — that's the whole point

This is what lets Protect detect **silent failures** — the Endpoint Detection and Response (EDR) agent that's "installed" in the CrowdStrike console but stopped reporting weeks ago, while Intune shows the device coming online daily. See [X-Ray](/x-ray) for how to investigate.

## Three-stage Vitals

Traditional monitoring stops at "Is the agent deployed?" Vitals goes further:

<CardGroup cols={3}>
  <Card title="1. Deployment" icon="download">
    *Is the security control present on this device?* Cross-tool comparison — if AD shows a workstation but CrowdStrike doesn't, that's a deployment gap.
  </Card>

  <Card title="2. Function" icon="signal">
    *Is the control actively working and reporting?* Device online in Intune in the last 24 hours but CrowdStrike hasn't seen it for 7+ days = agent broken, not offline.
  </Card>

  <Card title="3. Configuration" icon="sliders">
    *Is the control configured per policy?* Real-time protection enabled? Prevention mode active? Tamper protection on?
  </Card>
</CardGroup>

See [Security Monitoring](/security-monitoring) for the full Vitals reference and [Tags & Logic Engine](/tags-and-logic-engine) for how to define which controls apply where.

## X-Ray transparency

Every device drill-down has an **X-Ray** tab that shows the raw, unmodified data from every connected integration that reported on that device. Last-sync timestamp per integration. Field-by-field comparison. This is your forensics tool when:

* A device looks healthy but isn't
* Two tools disagree about a field
* An auditor asks *"prove this data"*
* You're configuring a new integration and want to validate the schema

[Read the X-Ray guide →](/x-ray)

## Security & privacy by default

<Check>**Read-only API credentials** — Protect itself is read-only. Actions can trigger outbound automations with your approval.</Check>
<Check>**Encrypted in transit** (TLS 1.2+) and **at rest** (AES-256)</Check>
<Check>**ISO 27001** certified, **Cyber Essentials** certified, **GDPR** compliant</Check>
<Check>**UK data residency** by default; other regions on request</Check>
<Check>**No agents** to deploy or patch on endpoints</Check>

Full detail in [Trust & Security](/trust/security).

## Where to next?

<CardGroup cols={3}>
  <Card title="Onboarding" icon="rocket" href="/onboarding">
    Connect your first integrations
  </Card>

  <Card title="Getting Started" icon="play" href="/getting-started">
    Your first 24 hours
  </Card>

  <Card title="Glossary" icon="book" href="/reference/glossary">
    Every term Protect uses, defined
  </Card>

  <Card title="Device Management" icon="laptop" href="/device-management">
    Master the inventory and query language
  </Card>

  <Card title="Security Monitoring" icon="shield-halved" href="/security-monitoring">
    Configure Vitals
  </Card>

  <Card title="Automation" icon="bolt" href="/automation">
    Build your first Action
  </Card>
</CardGroup>