> ## Documentation Index > Fetch the complete documentation index at: https://docs.threataware.com/llms.txt > Use this file to discover all available pages before exploring further. # Troubleshooting > Symptom → cause → fix matrices for every common issue across Protect ## How to use this page Find the symptom in the table for the area you're in. Each row is `Symptom → likely cause → fix`. Always start with the cheapest cause first (the rows are roughly cheapest-to-most-expensive). ## Integrations | Symptom | Cause | Fix | | ------------------------------------------------ | -------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | Card shows DISCONNECTED | Credentials revoked or expired | [Settings → Integrations](/settings/integrations) → click card → Modify → re-enter credentials | | OAuth integration fails after working previously | Token expired or consent revoked | Modify → re-run OAuth flow | | Last sync timestamp > 3 hours | Slow vendor API or rate-limited | Wait for next cycle; if persistent, check the integration detail page for errors | | Last sync > 24 hours | Auth or permissions issue | Click Modify → Test Connection; check audit log for the error | | PowerShell Relay stopped reporting | Scheduled task stopped on relay server | RDP to relay server, verify the task in Task Scheduler, review event log | | Expected fields missing from X-Ray | Vendor API doesn't expose them, or your service account lacks scopes | Grant additional read scopes; some fields are vendor-side limitations | | Multiple "duplicate" integrations | You have multiple tenants of the same tool | Enable Multi-Tenant on the integration ([Multi-Tenancy](/multi-tenancy)) | | Connection wizard 4xx error | Wrong credential format (extra spaces, wrong field) | Re-type rather than paste; cross-check the Connection Guide | | Connection wizard 5xx error | Vendor outage or Protect-side issue | Check vendor status page; retry; contact support if persistent | ## Devices | Symptom | Cause | Fix | | ------------------------------------------------- | --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | | Device count looks low | Default filter excludes Inactive | Change Active filter to All in the toolbar | | Device count looks high | Inactive threshold too long | Lower the threshold in [Settings → Misc](/settings/misc) | | Same device appears twice | Matching algorithm couldn't fuse them | Open [X-Ray](/x-ray) on each — if no overlap, they're different devices; otherwise contact support | | Device missing entirely | Not reported by any integration in your threshold window | Check the source tool; widen the Inactive threshold; add an integration that does see it | | Last User field empty | No identity source maps to this device | Connect Entra ID / AD / Okta | | Wrong user shown | Multi-user device — primary is most-recent | Audit user history in detail panel | | Location says "United States" but device is in UK | VPN egress or NAT'd IP geolocates wrong | Configure [Settings → IP Locations](/settings/ip-locations) override | | Vitals all grey for a device | No tags applied, so nothing required | Check tag rules in [Settings → Tags](/settings/tags) | | Vitals all red for a new device | Device is in scope (`required:true`) before deployment finishes | Move newly-discovered devices into a `Stock` tag where Vitals aren't required, then promote out once baseline is done | ## Vitals | Symptom | Cause | Fix | | ---------------------------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | | "Not Functioning" for a device that's clearly online | Source tool stopped reporting on this device | Investigate in vendor console; usually a broken agent — this is silent-failure detection working as designed | | "Misconfigured" but the config looks right | Configuration check is too strict | Loosen in [Vitals Configuration](/vitals-configuration) → column gear → Configure Mode | | Healthy % dropped overnight | Sync brought in new devices that don't meet baseline | Investigate by tag — likely a fresh deployment without controls | | Vitals don't update after fixing in source | Next sync hasn't run yet | Force a sync in [Settings → Integrations](/settings/integrations) → integration → Sync Now | | Field-level config check disappeared | Vendor API changed | Check the [What's New](/whats-new); contact support | ## Issues | Symptom | Cause | Fix | | ---------------------------------- | ---------------------------------------- | -------------------------------------------------------------------------------------------- | | Same Issue listed for many devices | Systemic problem | Investigate root cause (tag misconfiguration, deployment failure) — fix once, not per-device | | Issue keeps reappearing after fix | Resolution criteria too narrow on Action | In Action settings, define explicit resolution state | | Severity seems wrong | Severity mapping per integration | Severity is integration-defined; if persistently incorrect, contact support | ## Action Center | Symptom | Cause | Fix | | ----------------------------------- | ---------------------------------------------------- | --------------------------------------------------------------------------------- | | Action not firing | Action paused | Click into Action → Resume | | Action not firing | Minimum-time-in-view not yet exceeded | Wait, or shorten threshold | | Email not received | Spam filter | Whitelist `noreply@threataware.com` | | Webhook automation failing | Endpoint timeout or wrong URL | Check Automation Log; verify endpoint is reachable from Protect's egress IPs | | ServiceNow tickets not created | API credentials expired or table permissions changed | Re-test the ServiceNow integration; check assignment group exists | | Power Automate flow not triggering | Flow turned off or webhook URL rotated | Verify Power Automate flow is running; update webhook URL | | Snapshot Action progress not moving | Resolution criteria not being met | Check if devices actually fixed; review resolution criteria | | MTTR keeps growing | Devices not resolving | Investigate why fixes aren't happening — could be missing process, not visibility | ## Users (platform / SSO) | Symptom | Cause | Fix | | ------------------------------------------- | ------------------------------------ | ------------------------------------------------------------ | | User can't sign in | SSO mail attribute missing | Populate `mail` in Entra ID / Okta, not just UPN | | SSO redirect fails | Conditional access blocking | Check your IdP conditional access rules | | User sees no devices | Data filter applied to their account | Check user's filter in [Settings → Users](/settings/users) | | Auto-provisioned user has too little access | Defaults to Limited Viewer | Manually upgrade role in [Settings → Users](/settings/users) | | User invited but Never Logged In | Email not received | Check spam; re-send invitation | ## Studio | Symptom | Cause | Fix | | ---------------------------------- | ------------------------------------------------------------------- | ----------------------------------------------------------------- | | AI doesn't understand the prompt | Too vague or too compound | Break into smaller, more specific prompts | | Component referenced doesn't exist | Misnamed in prompt | Use the selection / inspect tool to find the actual component | | App preview shows error | AI-generated code has a bug | Open Composer, ask "fix the error in the preview" | | App publishes but data missing | Permissions / data filter | Confirm the user viewing has access to the underlying device data | | PDF generation times out | App has too much data / complex layout | Simplify; pre-filter the data; split into multiple pages | | Pinned app missing from left rail | Visual limit on how many pinned-app icons the left rail can display | Unpin an older app | ## Search & Queries | Symptom | Cause | Fix | | --------------------------------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | | Query returns zero results | Typo in field name or value case | Use autocomplete; cross-check the schema | | Query returns too many results | Missing parentheses around OR cluster | Parenthesise: `A AND (B OR C)`, not `A AND B OR C` | | Time field returns 0 results | The query grammar uses `field:value` (e.g. `lastOnline:now-7d`), not `<` or `>` operators | Use composition with `AND`/`OR`/`NOT` — see [Query Syntax](/reference/query-syntax) for the verified grammar | | Saved view invisible to team | View saved as Private | Re-save with Team visibility | | Natural language query interprets wrong | AI heuristic | Edit the translated query before saving | ## Scheduled Reports | Symptom | Cause | Fix | | ------------------------------ | --------------------------------------- | ---------------------------------------------------------------------------- | | Report not sent | Schedule paused / disabled | [Settings → Scheduled Reports](/settings/scheduled-reports) → confirm Active | | Recipient didn't receive email | Spam / forwarding rule | Whitelist sender; verify recipient address | | Report too large | Over 25 MB attachment limit | Switch CSV format; reduce columns; split by tag | | Report content blank | Saved view's filter excludes everything | Open the saved view directly to verify it has rows | | Report has stale data | Sync hadn't completed when report ran | Move report time to later in the day | ## PowerShell Relay | Symptom | Cause | Fix | | -------------------------- | ------------------------------------- | -------------------------------------------------------------------------------- | | Certificate error | Server has invalid cert | Install valid cert, OR enable Bypass Certificate Check in the integration | | 401 Unauthorized | Wrong credentials | Verify; if using Default Credentials, ensure the running account has permissions | | Connection timeout | Network or firewall | Confirm outbound 443 from relay server works | | Scheduled task doesn't run | Task config issue | Task Scheduler → Run task manually; check Event Viewer | | Files in wrong location | Relay needs `C:\Scripts\ThreatAware\` | Move files to that exact path | ## Cross-references Debug specific actions Escalate persistent issues