Glossary - ThreatAware Docs

A single page that defines every term in ThreatAware. Use Ctrl-F to find anything.

A

Term	Definition
Action	A monitored set of devices tracked through to remediation, with optional automation. Two flavours: Continuous (always-on) and Snapshot (time-bound).
Action Center	The hub at `/action-center` where you build automation flows that run against Tracked Views, with HTTP request and Send email steps (ThreatAware 3.3). See Action Center.
Active device	A device seen in at least one connected source within the Inactive device threshold (default 30 days, in Settings → Misc).
Analyst	The second of four default roles. Moderate privilege, allowing in-depth data analysis.
Audit Log	A complete record of every meaningful action taken in the platform. At Settings → Audit Log.
Automation Log	On ThreatAware 3.2, the Action Center’s record of every automation execution (email, ticket, webhook). Separate from the Audit Log. From ThreatAware 3.3, each flow run is listed under Recent runs and All runs in Action Center, with a result of Success, Partial success, Failed or Emergency stop.

C

Term	Definition
Cloud ID	Your tenant’s subdomain on `*.threataware.com`. Unique per customer. Provided at provisioning.
Command Palette	Quick navigation overlay opened with ⌘K / Ctrl+K / /. Type to filter, Enter to jump. See Keyboard Shortcuts.
Configuration check	A specific test a Vital performs (e.g. “real-time protection enabled”). Configurable per integration in Vitals Configuration.
Connect	The ThreatAware plan for asset visibility: a complete, hourly-refreshed inventory of every device. See plans.
Custom Vital	A check you build yourself as a Logic Engine flow and add to one integration’s Configured Correctly stage (Protect, ThreatAware 3.3+). Devices that fail it are flagged as issues and count against that integration’s score. See Custom Vitals.
Continuous Action	ThreatAware 3.2: an Action that runs perpetually. Devices entering the trigger query are auto-added; devices leaving are auto-removed. In 3.3, this is the Continuous option on a Tracked View. See Continuous Actions.
Coverage Explorer	Shows how much of your estate is tagged, broken down by device-name prefix, and lets you tag a prefix. Opened from Settings → Tags. See Coverage Explorer.
Cross-mapping	In multi-tenancy, the default mode where devices match across tenants of the same integration.

D

Term	Definition
Dashboard	The five-panel landing page at `/dashboard` (Estate Summary, Actions Summary, Tag Coverage Map, Overall Control Health, Integration Control).
Default View	A saved view designated as the page’s default opening view. Configurable per page via the view dropdown.
Deduplication	ThreatAware’s matching algorithm that fuses multiple tools’ reports of the same physical device into one record. See Device Management.
Deployment view	One of two modes in the Devices grid. Shows checkmark / dash for “does this tool see this device?” The other mode is Vitals view.
Device	A physical or virtual machine reported by at least one connected source.
Device Explorer	The globe-of-devices home at `/device-explorer`. See Device Explorer.
Device retention policy	How long deleted devices are kept (Settings → Misc).
Discover	The ThreatAware plan that adds security control validation: Vitals, Issues, X-Ray and the Logic Engine. Includes everything in Connect. See plans.

E

Term	Definition
EDR	Endpoint Detection and Response.
End-User Inventory	The User Inventory at `/user-inventory` (vs. platform users).
Estate Summary	Dashboard panel showing total devices.

F

Term	Definition
Functioning	A Vital state — control is deployed and reporting recent activity. Used in the live UI for non-required integrations that are working (e.g. directory services), and as a status indicator on the device detail panel. The config-drift composite is Misconfigured, not Functioning. See Vitals states.

H

Term	Definition
Healthy	A Vital state — control is deployed, functioning, and configured per your rules. See Vitals states.

I

Term	Definition
IdP	Identity Provider (Entra ID, Okta, etc.).
Inactive device	Not seen in any connected source for longer than the Inactive device threshold. Hidden from default views.
Inactive device threshold	Configurable in Settings → Misc. Default 30 days.
Integration	A connection to an external tool (EDR, MDM, IdP, etc.). Configured at Settings → Integrations.
Integration Control	Dashboard panel showing per-integration health.
Issue	A discrete, time-stamped problem detected by an integration on a specific device. See Issues.

L

Term	Definition
Last Seen	The most recent activity timestamp for a device.
Limited Viewer	Lowest-privilege default role. A common choice for the default role given to users provisioned through SSO.
Logic Engine	The visual flow builder that drives dynamic tag membership and computed columns on Discover and Protect, and Custom Vitals on Protect. Replaces the older Rule Editor. Separate from the query language.

M

Term	Definition
Matching	The process of identifying that two integrations reporting “a Windows laptop with serial X” are reporting the same physical device. Combined with deduplication.
MDM	Mobile Device Management.
MFA	Multi-Factor Authentication.
Misconfigured	The live UI’s composite badge for `required:true AND deployed:true AND functioning:true AND configuredCorrectly:false`. The config-drift state. See Vitals states.
MSP	Managed Service Provider.
MSSP	Managed Security Service Provider.
MTTR	Mean Time To Remediation. Shown in days on Continuous Action cards.
Multi-tenancy	Connecting multiple instances of the same integration (e.g. two Azure AD tenants). See Multi-Tenancy.

N

Term	Definition
Not Deployed	A Vital sub-state — control not present.
Not Functioning	A Vital state. Control is deployed but not actively working. Often a broken agent rather than a missing one. The cross-tool detection of this state is ThreatAware’s signature differentiator.
Not Healthy	A Vital state. Either Not Deployed or Not Functioning.
Not Required	A Vital state. The device’s tags don’t require this control — no expectation, no alert.
NTLM	NT LAN Manager (Microsoft authentication protocol).

O

Term	Definition
OIDC	OpenID Connect.

P

Term	Definition
PII	Personally Identifiable Information.
Pinned app	A Reporting app added to the left rail.
PowerShell Relay	The reverse-proxy mechanism that lets ThreatAware query on-premises tools without inbound firewall rules. See PowerShell Relay.
Protect	ThreatAware’s top plan. Adds Custom Vitals, Tracked Views, Action Center, User and Software Inventory, Stealth Devices and AI Advanced Reporting to everything in Discover. See plans.
PSA	Professional Services Automation (e.g. Datto Autotask PSA).

Q

Term	Definition
Query Language	ThreatAware’s unified search syntax, used in Devices, Users, Issues, the Logic Engine, and Action triggers. See Query Language.

R

Term	Definition
Read-only	ThreatAware itself is read-only — integrations use read-only credentials wherever the upstream tool supports them, and ThreatAware never writes back to vendor APIs. Actions can trigger outbound automations with your approval.
Reporting	The reporting / app-building surface inside ThreatAware at `/studio/editor`. See Reporting.
Resolution criteria	ThreatAware 3.2: in an Action, the explicit definition of “fixed” beyond just leaving the trigger query. See Action Center on ThreatAware 3.2.
RMM	Remote Monitoring and Management.
Role	A bundle of permissions. ThreatAware ships with four defaults (Super Admin, Analyst, Viewer, Limited Viewer); custom roles can be created. See Settings → Roles.

S

Term	Definition
Rule Editor	The older, query-based way to write a tag rule. The only option on Connect; on Discover and Protect it’s being replaced by the Logic Engine. Converting a tag to the Logic Engine is one-way.
SAML	Security Assertion Markup Language.
Saved View	A named, persisted combination of query + column selection + sort, visible in the view dropdown. Can be Private / Team / Everyone.
SCCM	System Center Configuration Manager (Microsoft).
Scheduled Report	A recurring email delivery of a saved view’s contents in CSV / JSON / XLSX. At Settings → Scheduled Reports.
SCIM	System for Cross-domain Identity Management. Lets your identity provider create, update and deactivate ThreatAware users automatically. Available for Azure AD and Okta from ThreatAware 3.3. See SCIM provisioning.
Schema	The canonical structure of Device Data and User Data inside ThreatAware. Editable at Settings → Schemas.
Silent failure	An EDR or security agent that’s deployed and appears healthy in its own console but stopped reporting weeks ago. ThreatAware detects this via cross-tool correlation.
Snapshot Action	ThreatAware 3.2: an Action with a fixed device list captured at creation time and a deadline. Used for projects rather than always-on hygiene. In 3.3, this is the Snapshot option on a Tracked View. See Snapshot Actions.
SSO	Single Sign-On. Self-service for Microsoft Entra ID / Azure AD, Okta and CyberArk. See Access Control.
Stealth Devices	Beta feature that finds unknown or unmanaged devices people have used to sign in to Microsoft 365 applications, from Microsoft 365 sign-in logs. Named `Unknown-{OS}-{ID}`. See Stealth Devices.
Step	One action in an Action Center flow: an HTTP request or a Send email. Steps run in order from Start of action.
Super Admin	The highest-privilege default role.
Sync	Periodic API pull from an integration.

T

Term	Definition
Tag	A label applied to devices or users via the Logic Engine. Drives Vitals scope, Tracked Views and access control.
Tag Coverage Map	Dashboard tree-map visualisation of tag distribution.
Team	A logical group of users for sharing saved views, Actions, and Reporting apps.
Tenant	A separate logical environment in a tool (e.g. multiple Azure AD directories). Distinct from a “ThreatAware tenant” which means your whole organisation’s ThreatAware instance.
Threshold	Inactive device cutoff (typically 30 days).

U

Term	Definition
Tracked View	A view whose devices ThreatAware follows over time, recording each one as it’s resolved (ThreatAware 3.3+). Runs as Continuous (no end date) or Snapshot (a fixed set of devices with a deadline). Replaces Continuous and Snapshot Actions. See Tracked Views.
UPN	UserPrincipalName — not what ThreatAware matches on (uses the `mail` attribute instead).

V

Term	Definition
Viewer	Read-only default role.
Vital	A single integration’s view of a single device’s security control state. Computed continuously. See Security Monitoring.
Vitals Configuration	The per-integration settings that decide what a Healthy / Functioning / Misconfigured state means for that control. See Vitals Configuration.
Vitals view	One of two modes in the Devices grid. Shows Healthy / Functioning / Not Healthy. The other is Deployment view.

X

Term	Definition
X-Ray	The per-device transparency view showing raw payloads from each connected integration. See X-Ray.
XDR	Extended Detection and Response.