Skip to main content
X-Ray shows exactly what one integration reported about a device: the raw response from that tool’s API, untouched by ThreatAware. Use it when you need to see the source data behind what ThreatAware shows.
X-Ray shows each tool’s current data for a device, not its history. To show an auditor a device’s state on a past date, use a scheduled report from that date (past deliveries can be downloaded again), or the Vitals API with archiveDate.

​
When you’d open X-Ray

Investigating a broken agent

A Vital shows CrowdStrike as Not Functioning. X-Ray shows CrowdStrike’s own last_seen for the device, so you can see how long it’s been quiet.

Reconciling conflicting data

Two tools disagree about a device’s OS or owner. Open X-Ray on each tool’s record to see which one reported which value.

Auditor evidence

“Show me this device is running EDR.” X-Ray shows exactly what CrowdStrike is reporting for it now, and when that data was fetched.

Checking a new integration

You’ve just connected a tool. Open X-Ray on a device you know to check the data coming through is what you expect.

​
Open X-Ray

1

Open the device

In Devices, click a device’s name to open it.
2

Click an integration

Under Vitals, click the integration you want, such as CrowdStrike. Its record for this device opens, with its properties, its Vitals checks and when the data was last refreshed.
3

Click View in X-Ray

View in X-Ray is at the bottom of the record. The X-Ray panel opens on the right.
You can also get there from the Devices grid in Vitals mode: click the + next to a Vitals cell, then View in X-Ray. If a tool reports the device more than once, the record shows Multiple … Records with 1 of 2 arrows. X-Ray shows the record you’re on, so page through to see the others.

​
What X-Ray shows

X-Ray panel for CrowdStrike next to a device record, showing Response from Crowdstrike, the fetch time in UTC and the raw JSON response with fields such as agent_version, bios_manufacturer and device_id The panel is titled with the integration’s name and shows Response from that tool:
  • When it was fetched, in UTC
  • The raw response as JSON, with every field the tool returned, including empty (null) ones. Nested objects collapse to {…}; click to expand them
  • Readable dates beside raw timestamps, so "2026-10-13T17:19:59Z" also shows as 13/10/2026 17:19:59
Field names are the tool’s own, not ThreatAware’s. For example, CrowdStrike reports last_seen, agent_version, status and reduced_functionality_mode. Click Pin panel to keep X-Ray open while you click other integrations or devices, and × to close it.

​
Reading X-Ray output

X-Ray shows one tool at a time, so open it on a few integrations to compare them. Some patterns to look for:

​
Who can use X-Ray

Viewing X-Ray is part of the Device Inventory permissions. The default Super Admin, Analyst and Viewer roles can use it; Limited Viewer can’t. See Role permissions.
The X-RAY buttons in Settings → Schemas are something different: they show the data structure Reporting uses, not a device’s data.

​
Next steps

Devices

Open a device to get to X-Ray

Vitals Configuration

What the Vitals checks test

Silent failure

Find agents that have stopped working