Skip to main content
Common questions that come up repeatedly in onboarding, support, and evaluation. Grouped by topic. If you don’t see your question here, check Troubleshooting for symptom-driven answers or Glossary for terminology.

​
Setup

There is no self-service signup. ThreatAware is provisioned by the ThreatAware account team. Get in touch via threataware.com or your security partner — see Onboarding.
Your tenant’s unique subdomain on *.threataware.com (e.g. https://acme.threataware.com). Provided in your welcome email at provisioning.
Connecting one OAuth integration (e.g. Microsoft Entra ID) takes about five minutes. A full first-day setup — identity + EDR + MDM + on-prem AD — usually takes 30-60 minutes plus first-sync wait time. See Onboarding for the step-by-step.
No. ThreatAware is 100% API-based. The only optional install is the PowerShell Relay — a small Windows service that lets ThreatAware query on-premises tools without inbound firewall rules.
Microsoft Entra ID if you’re a Microsoft shop — it’s OAuth, fast, and gives you cloud-device discovery plus identity in one step. Otherwise your primary EDR. See Onboarding for the recommended order.
Typically 15-60 minutes depending on estate size. Live integration cards show “Last synced N minutes ago” on the Settings → Integrations page.

​
Devices

Three usual causes:
  1. ThreatAware deduplicates across tools (right answer; the total will look lower than the sum of all tool counts)
  2. Active vs. Inactive filter (ThreatAware defaults to Active — devices not seen within the Inactive device threshold are hidden)
  3. The other tool counts archived / deleted devices that ThreatAware filters out
Use X-Ray on a specific device to see exactly which tools see it.
A device is Active if at least one connected source has seen it within the Inactive device threshold (default 30 days, configurable in Settings → Misc). Beyond that threshold it becomes Inactive and is hidden from default views, dashboard counts, and Vitals calculations.
No — and that’s intentional. ThreatAware reflects reality from your tools. If a device should be gone, decommission it in the source tool; it’ll drop out of ThreatAware within the Inactive threshold. You can also configure a Device retention policy to clean up records that have been removed from all source tools.
The matching algorithm couldn’t fuse the records. Open X-Ray on each row — if no integration overlaps, they’re genuinely different devices. If they overlap, contact support. See Troubleshooting → Devices.
Geolocation comes from public IP. VPN egress or NAT’d IPs often geolocate to the wrong country. Configure overrides in Settings → IP Locations.
An unknown or unmanaged device that someone has used to sign in to your company’s Microsoft 365 applications, found from Microsoft 365 sign-in logs. See Stealth Devices.

​
Integrations

Hourly from every integration as a default cadence. Processing adds 5-30 minutes after each sync. To force a sync immediately, go to Settings → Integrations → click the integration → Sync Now.
Possibly — contact your account manager with the vendor name and their API documentation. Typical turnaround for a new integration is a few weeks.
Credentials have been revoked or expired. Open the card → Modify → re-enter credentials or re-run the OAuth flow. See Troubleshooting → Integrations.
You have multiple tenants of the same vendor tool (e.g. two Entra ID directories). Enable Multi-Tenant on the integration so devices match across tenants — see Multi-Tenancy.
Only for on-premises tools that aren’t exposed to the internet — typically Active Directory, SCCM, and similar. Cloud SaaS integrations connect directly. See PowerShell Relay.
Read scopes only — ThreatAware never writes back to the source tools through its integrations. See the Microsoft Graph Required Permissions guide for the exact scope list.

​
Security & access

The ThreatAware platform reads from your tools through API integrations. Action Center flows can write to downstream systems you opt in to (for example, an HTTP request step that opens a ServiceNow ticket or posts to Teams), but those are explicit outbound automations you configure. See Trust & Security.
ISO 27001 and Cyber Essentials. Full details in Trust → Certifications.
Four default roles (Super Admin, Analyst, Viewer, Limited Viewer), plus custom roles. Each role’s Data Visibility can limit which devices and users it sees, by tag. See Access Control and Role Permissions.
Yes. From 3.3 you set it up yourself for Microsoft Entra ID / Azure AD, Okta and CyberArk, with optional just-in-time provisioning, or SCIM 2.0 provisioning for Azure AD and Okta. Set it up under Settings → User Management → SSO. On 3.2, only Entra ID is self-service. See Access Control.
Yes. The Audit Log permission is role-gated — Analysts see their own entries by default; Viewer and Limited Viewer see nothing. Configure in Settings → Roles. See Audit Log Events for what’s recorded.
See Trust → Architecture for the hosting and data-residency picture.
An EDR or security agent that’s deployed and looks healthy in its own console but has stopped reporting. ThreatAware detects these via cross-tool correlation. See Silent Failure.

​
Billing & licensing

Pricing is per-tenant and varies with scale and tier. Speak to your account team — there’s no public price list.
Evaluation access is arranged through the account team rather than self-service. See Quickstart.
A unified device record in the Devices grid after deduplication. Five integrations all reporting the same laptop count as one device.

​
Cross-references

Troubleshooting

Symptom-driven fixes

Glossary

A-Z terms

Onboarding

First-day setup

Trust & Security

Architecture, certifications, data handling

Support

When the docs don’t have it