Troubleshooting - ThreatAware

How to use this page

Find the symptom in the table for the area you’re in. Each row is Symptom → likely cause → fix. Always start with the cheapest cause first (the rows are roughly cheapest-to-most-expensive).

Integrations

Symptom	Cause	Fix
Card shows DISCONNECTED	Credentials revoked or expired	Settings → Integrations → click card → Modify → re-enter credentials
OAuth integration fails after working previously	Token expired or consent revoked	Modify → re-run OAuth flow
Last sync timestamp > 3 hours	Slow vendor API or rate-limited	Wait for next cycle; if persistent, check the integration detail page for errors
Last sync > 24 hours	Auth or permissions issue	Click Modify → Test Connection; check audit log for the error
PowerShell Relay stopped reporting	Scheduled task stopped on relay server	RDP to relay server, verify the task in Task Scheduler, review event log
Expected fields missing from X-Ray	Vendor API doesn’t expose them, or your service account lacks scopes	Grant additional read scopes; some fields are vendor-side limitations
Multiple “duplicate” integrations	You have multiple tenants of the same tool	Enable Multi-Tenant on the integration (Multi-Tenancy)
Connection wizard 4xx error	Wrong credential format (extra spaces, wrong field)	Re-type rather than paste; cross-check the Connection Guide
Connection wizard 5xx error	Vendor outage or Protect-side issue	Check vendor status page; retry; contact support if persistent

Devices

Symptom	Cause	Fix
Device count looks low	Default filter excludes Inactive	Change Active filter to All in the toolbar
Device count looks high	Inactive threshold too long	Lower the threshold in Settings → Misc
Same device appears twice	Matching algorithm couldn’t fuse them	Open X-Ray on each — if no overlap, they’re different devices; otherwise contact support
Device missing entirely	Not reported by any integration in your threshold window	Check the source tool; widen the Inactive threshold; add an integration that does see it
Last User field empty	No identity source maps to this device	Connect Entra ID / AD / Okta
Wrong user shown	Multi-user device — primary is most-recent	Audit user history in detail panel
Location says “United States” but device is in UK	VPN egress or NAT’d IP geolocates wrong	Configure Settings → IP Locations override
Vitals all grey for a device	No tags applied, so nothing required	Check tag rules in Settings → Tags
Vitals all red for a new device	Device is in scope (`required:true`) before deployment finishes	Move newly-discovered devices into a `Stock` tag where Vitals aren’t required, then promote out once baseline is done

Vitals

Symptom	Cause	Fix
”Not Functioning” for a device that’s clearly online	Source tool stopped reporting on this device	Investigate in vendor console; usually a broken agent — this is silent-failure detection working as designed
”Misconfigured” but the config looks right	Configuration check is too strict	Loosen in Vitals Configuration → column gear → Configure Mode
Healthy % dropped overnight	Sync brought in new devices that don’t meet baseline	Investigate by tag — likely a fresh deployment without controls
Vitals don’t update after fixing in source	Next sync hasn’t run yet	Force a sync in Settings → Integrations → integration → Sync Now
Field-level config check disappeared	Vendor API changed	Check the What’s New; contact support

Issues

Symptom	Cause	Fix
Same Issue listed for many devices	Systemic problem	Investigate root cause (tag misconfiguration, deployment failure) — fix once, not per-device
Issue keeps reappearing after fix	Resolution criteria too narrow on Action	In Action settings, define explicit resolution state
Severity seems wrong	Severity mapping per integration	Severity is integration-defined; if persistently incorrect, contact support

Action Center

Symptom	Cause	Fix
Action not firing	Action paused	Click into Action → Resume
Action not firing	Minimum-time-in-view not yet exceeded	Wait, or shorten threshold
Email not received	Spam filter	Whitelist `noreply@threataware.com`
Webhook automation failing	Endpoint timeout or wrong URL	Check Automation Log; verify endpoint is reachable from Protect’s egress IPs
ServiceNow tickets not created	API credentials expired or table permissions changed	Re-test the ServiceNow integration; check assignment group exists
Power Automate flow not triggering	Flow turned off or webhook URL rotated	Verify Power Automate flow is running; update webhook URL
Snapshot Action progress not moving	Resolution criteria not being met	Check if devices actually fixed; review resolution criteria
MTTR keeps growing	Devices not resolving	Investigate why fixes aren’t happening — could be missing process, not visibility

Users (platform / SSO)

Symptom	Cause	Fix
User can’t sign in	SSO mail attribute missing	Populate `mail` in Entra ID / Okta, not just UPN
SSO redirect fails	Conditional access blocking	Check your IdP conditional access rules
User sees no devices	Data filter applied to their account	Check user’s filter in Settings → Users
Auto-provisioned user has too little access	Defaults to Limited Viewer	Manually upgrade role in Settings → Users
User invited but Never Logged In	Email not received	Check spam; re-send invitation

Studio

Symptom	Cause	Fix
AI doesn’t understand the prompt	Too vague or too compound	Break into smaller, more specific prompts
Component referenced doesn’t exist	Misnamed in prompt	Use the selection / inspect tool to find the actual component
App preview shows error	AI-generated code has a bug	Open Composer, ask “fix the error in the preview”
App publishes but data missing	Permissions / data filter	Confirm the user viewing has access to the underlying device data
PDF generation times out	App has too much data / complex layout	Simplify; pre-filter the data; split into multiple pages
Pinned app missing from left rail	Visual limit on how many pinned-app icons the left rail can display	Unpin an older app

Search & Queries

Symptom	Cause	Fix
Query returns zero results	Typo in field name or value case	Use autocomplete; cross-check the schema
Query returns too many results	Missing parentheses around OR cluster	Parenthesise: `A AND (B OR C)`, not `A AND B OR C`
Time field returns 0 results	The query grammar uses `field:value` (e.g. `lastOnline:now-7d`), not `<` or `>` operators	Use composition with `AND`/`OR`/`NOT` — see Query Syntax for the verified grammar
Saved view invisible to team	View saved as Private	Re-save with Team visibility
Natural language query interprets wrong	AI heuristic	Edit the translated query before saving

Scheduled Reports

Symptom	Cause	Fix
Report not sent	Schedule paused / disabled	Settings → Scheduled Reports → confirm Active
Recipient didn’t receive email	Spam / forwarding rule	Whitelist sender; verify recipient address
Report too large	Over 25 MB attachment limit	Switch CSV format; reduce columns; split by tag
Report content blank	Saved view’s filter excludes everything	Open the saved view directly to verify it has rows
Report has stale data	Sync hadn’t completed when report ran	Move report time to later in the day

PowerShell Relay

Symptom	Cause	Fix
Certificate error	Server has invalid cert	Install valid cert, OR enable Bypass Certificate Check in the integration
401 Unauthorized	Wrong credentials	Verify; if using Default Credentials, ensure the running account has permissions
Connection timeout	Network or firewall	Confirm outbound 443 from relay server works
Scheduled task doesn’t run	Task config issue	Task Scheduler → Run task manually; check Event Viewer
Files in wrong location	Relay needs `C:\Scripts\ThreatAware\`	Move files to that exact path

Cross-references

Audit Log

Debug specific actions

Support

Escalate persistent issues