> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FAQs

> Frequently asked questions across setup, devices, integrations, security, and billing

Common questions that come up repeatedly in onboarding, support, and evaluation. Grouped by topic. If you don't see your question here, check [Troubleshooting](https://docs.threataware.com/reference/troubleshooting.md) for symptom-driven answers or [Glossary](https://docs.threataware.com/reference/glossary.md) for terminology.

## Setup

> **How do I sign up for ThreatAware?**
>
> There is no self-service signup. ThreatAware is provisioned by the ThreatAware account team. Get in touch via [threataware.com](https://threataware.com) or your security partner — see [Onboarding](https://docs.threataware.com/onboarding).

> **What's my Cloud ID?**
>
> Your tenant's unique subdomain on `*.threataware.com` (e.g. `https://acme.threataware.com`). Provided in your welcome email at provisioning.

> **How long does initial setup take?**
>
> Connecting one OAuth integration (e.g. Microsoft Entra ID) takes about five minutes. A full first-day setup — identity + EDR + MDM + on-prem AD — usually takes 30-60 minutes plus first-sync wait time. See [Onboarding](https://docs.threataware.com/onboarding) for the step-by-step.

> **Do I need to install agents on endpoints?**
>
> No. ThreatAware is 100% API-based. The only optional install is the [PowerShell Relay](https://docs.threataware.com/powershell-relay.md) — a small Windows service that lets ThreatAware query on-premises tools without inbound firewall rules.

> **Which integration should I connect first?**
>
> Microsoft Entra ID if you're a Microsoft shop — it's OAuth, fast, and gives you cloud-device discovery plus identity in one step. Otherwise your primary EDR. See [Onboarding](https://docs.threataware.com/onboarding) for the recommended order.

> **How long does the first sync take?**
>
> Typically 15-60 minutes depending on estate size. Live integration cards show "Last synced N minutes ago" on the [Settings → Integrations](https://docs.threataware.com/settings/integrations.md) page.

## Devices

> **Why does my device count differ from \[other tool]?**
>
> Three usual causes:
>
> 1. ThreatAware deduplicates across tools (right answer; the total will look lower than the sum of all tool counts)
> 2. Active vs. Inactive filter (ThreatAware defaults to Active — devices not seen within the **Inactive device threshold** are hidden)
> 3. The other tool counts archived / deleted devices that ThreatAware filters out
>
> Use [X-Ray](https://docs.threataware.com/x-ray.md) on a specific device to see exactly which tools see it.

> **What's the difference between Active and Inactive?**
>
> A device is **Active** if at least one connected source has seen it within the **Inactive device threshold** (default 30 days, configurable in [Settings → Misc](https://docs.threataware.com/settings/misc.md)). Beyond that threshold it becomes **Inactive** and is hidden from default views, dashboard counts, and Vitals calculations.

> **Can I delete a device?**
>
> No — and that's intentional. ThreatAware reflects reality from your tools. If a device should be gone, decommission it in the source tool; it'll drop out of ThreatAware within the [Inactive threshold](https://docs.threataware.com/settings/misc.md). You can also configure a **Device retention policy** to clean up records that have been removed from all source tools.

> **The same device appears twice — why?**
>
> The matching algorithm couldn't fuse the records. Open [X-Ray](https://docs.threataware.com/x-ray.md) on each row — if no integration overlaps, they're genuinely different devices. If they overlap, contact support. See [Troubleshooting → Devices](https://docs.threataware.com/reference/troubleshooting.md#devices).

> **Why is a device's location wrong?**
>
> Geolocation comes from public IP. VPN egress or NAT'd IPs often geolocate to the wrong country. Configure overrides in [Settings → IP Locations](https://docs.threataware.com/settings/ip-locations.md).

> **What's a Stealth Device?**
>
> An unknown or unmanaged device that someone has used to sign in to your company's Microsoft 365 applications, found from Microsoft 365 sign-in logs. See [Stealth Devices](https://docs.threataware.com/stealth-devices.md).

## Integrations

> **How often does data refresh?**
>
> Hourly from every integration as a default cadence. Processing adds 5-30 minutes after each sync. To force a sync immediately, go to [Settings → Integrations](https://docs.threataware.com/settings/integrations.md) → click the integration → Sync Now.

> **Can I integrate with a tool that's not in the list?**
>
> Possibly — contact your account manager with the vendor name and their API documentation. Typical turnaround for a new integration is a few weeks.

> **My integration card says DISCONNECTED — what now?**
>
> Credentials have been revoked or expired. Open the card → Modify → re-enter credentials or re-run the OAuth flow. See [Troubleshooting → Integrations](https://docs.threataware.com/reference/troubleshooting.md#integrations).

> **Why does the same integration appear multiple times?**
>
> You have multiple tenants of the same vendor tool (e.g. two Entra ID directories). Enable **Multi-Tenant** on the integration so devices match across tenants — see [Multi-Tenancy](https://docs.threataware.com/multi-tenancy.md).

> **Do I need PowerShell Relay?**
>
> Only for **on-premises** tools that aren't exposed to the internet — typically Active Directory, SCCM, and similar. Cloud SaaS integrations connect directly. See [PowerShell Relay](https://docs.threataware.com/powershell-relay.md).

> **What permissions does ThreatAware need on my Microsoft tenant?**
>
> Read scopes only — ThreatAware never writes back to the source tools through its integrations. See the [Microsoft Graph Required Permissions](https://docs.threataware.com/connection-guides/microsoft-graphapi-required-permissions.md) guide for the exact scope list.

## Security & access

> **Is ThreatAware read-only against my tools?**
>
> The ThreatAware platform reads from your tools through API integrations. [Action Center](https://docs.threataware.com/automation.md) flows can write to downstream systems you opt in to (for example, an HTTP request step that opens a ServiceNow ticket or posts to Teams), but those are explicit outbound automations you configure. See [Trust & Security](https://docs.threataware.com/trust/security.md).

> **What certifications do you hold?**
>
> ISO 27001 and Cyber Essentials. Full details in [Trust → Certifications](https://docs.threataware.com/trust/certifications.md).

> **How is access controlled?**
>
> Four default roles (Super Admin, Analyst, Viewer, Limited Viewer), plus custom roles. Each role's Data Visibility can limit which devices and users it sees, by tag. See [Access Control](https://docs.threataware.com/access-control.md) and [Role Permissions](https://docs.threataware.com/reference/role-permissions.md).

> **Does ThreatAware support SSO?**
>
> Yes. From 3.3 you set it up yourself for Microsoft Entra ID / Azure AD, Okta and CyberArk, with optional just-in-time provisioning, or SCIM 2.0 provisioning for Azure AD and Okta. Set it up under **Settings → User Management → SSO**. On 3.2, only Entra ID is self-service. See [Access Control](https://docs.threataware.com/sso.md). 

> **Can I restrict who sees the audit log?**
>
> Yes. The Audit Log permission is role-gated — Analysts see their own entries by default; Viewer and Limited Viewer see nothing. Configure in [Settings → Roles](https://docs.threataware.com/settings/roles.md). See [Audit Log Events](https://docs.threataware.com/reference/audit-log-events.md) for what's recorded.

> **Where is my data stored?**
>
> See [Trust → Architecture](https://docs.threataware.com/trust/architecture.md) for the hosting and data-residency picture.

> **What's a silent failure and why should I care?**
>
> An EDR or security agent that's deployed and looks healthy in its own console but has stopped reporting. ThreatAware detects these via cross-tool correlation. See [Silent Failure](https://docs.threataware.com/silent-failure.md).

## Billing & licensing

> **How is ThreatAware priced?**
>
> Pricing is per-tenant and varies with scale and tier. Speak to your account team — there's no public price list.

> **Is there a free trial?**
>
> Evaluation access is arranged through the account team rather than self-service. See [Quickstart](https://docs.threataware.com/quickstart).

> **What counts as a device for licensing?**
>
> A unified device record in the Devices grid after deduplication. Five integrations all reporting the same laptop count as one device.

## Cross-references

> **[Troubleshooting](https://docs.threataware.com/reference/troubleshooting.md)**
>
> Symptom-driven fixes

> **[Glossary](https://docs.threataware.com/reference/glossary.md)**
>
> A-Z terms

> **[Onboarding](https://docs.threataware.com/onboarding)**
>
> First-day setup

> **[Trust & Security](https://docs.threataware.com/trust/security.md)**
>
> Architecture, certifications, data handling

> **[Support](mailto:support@threataware.com)**
>
> When the docs don't have it


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.