Skip to main content
Tier: X-Ray is included in the Discover and Protect tiers. Customers on Connect see the Devices grid but not the per-device X-Ray view.

​
Why X-Ray exists

ThreatAware Protect fuses data from many sources into a single normalised device record. That’s powerful — but every now and then you need to see exactly what each tool actually reported, untouched. X-Ray is that view. For any device, X-Ray surfaces:
  • One section per connected integration that has data on this device
  • The raw, unmodified payload from that integration’s API
  • The last-updated timestamp per source
  • Field-by-field values exactly as the source returned them
This is your forensics tool when a device looks healthy in one console but isn’t actually protected, when two tools disagree about a field, or when an auditor wants source evidence.

​
When you’d open X-Ray

Investigating a broken agent

Vital shows Endpoint Detection and Response (EDR) is “Not Functioning” — X-Ray shows the last-seen timestamp from CrowdStrike was 12 days ago, while Intune saw the device this morning.

Reconciling conflicting data

Defender says the OS is Windows 11 23H2; AD says Windows 10. X-Ray shows which source wrote which value.

Auditor evidence

“Prove this device was running EDR on 2026-01-15.” X-Ray shows the historical record from the source.

Validating a new integration

Just connected ServiceNow — open X-Ray on a known device to verify the schema mapping works as expected.

​
How to open X-Ray

From the Devices grid:
1

Click any device row

The device detail panel slides in from the right.
2

Click the X-Ray tab

In the device detail header, the X-Ray tab sits alongside the device name. The detail panel switches into source-by-source mode.
3

Expand each integration section

Sections collapse by default to keep the panel scannable. Click any integration row to expand its raw payload.
4

Check Last Updated

Each section shows when that integration last refreshed for this device. Stale sections are the smoking gun for broken syncs.
X-Ray is also reachable from Settings → Schemas — the X-RAY button on each schema row shows the canonical structure Protect expects, useful when building integrations or Reporting apps.

​
Example X-Ray view

Device ACS-31-0CJDN — three integrations reporting side-by-side: Microsoft Intune (Last Updated: 08:45:00) CrowdStrike Falcon (Last Updated: 12 days ago) OnPrem Active Directory (Last Updated: 13h ago) In this example the device looks healthy in Intune (compliant, recent sync) and AD (recent logon), but CrowdStrike’s data is 12 days stale even though the agent claims to be Online. That’s exactly the silent failure Protect’s cross-tool correlation surfaces — invisible if you only check the CrowdStrike console.

​
Reading X-Ray output

A few patterns that come up constantly:

​
Privacy and X-Ray

The X-Ray view respects the same access controls as everywhere else in Protect:
  • Field-level permissions can hide sensitive integration fields from specific roles
  • Integration-level permissions can hide entire X-Ray sections (e.g. “MSP technicians can’t see the customer’s HR data fed via the ServiceNow integration”)
  • All X-Ray opens are written to the Audit Log

​
Next steps

Device Management

Where you’ll launch X-Ray from

Security Monitoring

Vitals are computed from X-Ray fields

Settings → Schemas

The canonical schemas X-Ray maps to