> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# X-Ray

> See every raw field from every integration for any device — Protect's transparency layer

<Info>
  **Tier:** X-Ray is included in the **Discover** and **Protect** tiers. Customers on Connect see the Devices grid but not the per-device X-Ray view.
</Info>

## Why X-Ray exists

ThreatAware Protect fuses data from many sources into a single normalised device record. That's powerful — but every now and then you need to see *exactly what each tool actually reported*, untouched.

**X-Ray** is that view. For any device, X-Ray surfaces:

* One section per connected integration that has data on this device
* The **raw, unmodified payload** from that integration's API
* The **last-updated timestamp** per source
* Field-by-field values exactly as the source returned them

This is your forensics tool when a device looks healthy in one console but isn't actually protected, when two tools disagree about a field, or when an auditor wants source evidence.

## When you'd open X-Ray

<CardGroup cols={2}>
  <Card title="Investigating a broken agent" icon="bug">
    Vital shows Endpoint Detection and Response (EDR) is "Not Functioning" — X-Ray shows the last-seen timestamp from CrowdStrike was 12 days ago, while Intune saw the device this morning.
  </Card>

  <Card title="Reconciling conflicting data" icon="not-equal">
    Defender says the OS is Windows 11 23H2; AD says Windows 10. X-Ray shows which source wrote which value.
  </Card>

  <Card title="Auditor evidence" icon="clipboard-check">
    "Prove this device was running EDR on 2026-01-15." X-Ray shows the historical record from the source.
  </Card>

  <Card title="Validating a new integration" icon="vial">
    Just connected ServiceNow — open X-Ray on a known device to verify the schema mapping works as expected.
  </Card>
</CardGroup>

## How to open X-Ray

From the Devices grid:

<Steps>
  <Step title="Click any device row">
    The device detail panel slides in from the right.
  </Step>

  <Step title="Click the X-Ray tab">
    In the device detail header, the X-Ray tab sits alongside the device name. The detail panel switches into source-by-source mode.
  </Step>

  <Step title="Expand each integration section">
    Sections collapse by default to keep the panel scannable. Click any integration row to expand its raw payload.
  </Step>

  <Step title="Check Last Updated">
    Each section shows when that integration last refreshed for this device. Stale sections are the smoking gun for broken syncs.
  </Step>
</Steps>

X-Ray is also reachable from [Settings → Schemas](/settings/schemas) — the **X-RAY** button on each schema row shows the canonical structure Protect expects, useful when building integrations or [Reporting](/reporting) apps.

## Example X-Ray view

Device **ACS-31-0CJDN** — three integrations reporting side-by-side:

**Microsoft Intune** *(Last Updated: 08:45:00)*

| Field             | Value               |
| ----------------- | ------------------- |
| Compliance Status | Compliant           |
| Last Sync         | 2026-05-19 08:45:00 |
| OS Version        | Windows 11 23H2     |
| Enrollment State  | Enrolled            |
| Serial Number     | P0B2L4WDQ           |

**CrowdStrike Falcon** *(Last Updated: 12 days ago)*

| Field             | Value                          |
| ----------------- | ------------------------------ |
| Agent Version     | 7.15.16303                     |
| Last Seen         | 2026-05-07 09:12:34            |
| Prevention Policy | Standard-Workstation (Applied) |
| Sensor Status     | Online (stale)                 |

**OnPrem Active Directory** *(Last Updated: 13h ago)*

| Field          | Value               |
| -------------- | ------------------- |
| OU             | Corp/Laptops/UK     |
| Last Logon     | 2026-05-18 19:30:12 |
| Account Status | Enabled             |

In this example the device looks healthy in Intune (compliant, recent sync) and AD (recent logon), but CrowdStrike's data is 12 days stale even though the agent *claims* to be Online. That's exactly the **silent failure** Protect's cross-tool correlation surfaces — invisible if you only check the CrowdStrike console.

## Reading X-Ray output

A few patterns that come up constantly:

| Pattern                                            | What it tells you                                                      |
| -------------------------------------------------- | ---------------------------------------------------------------------- |
| All integrations recent                            | Device is genuinely active and connected                               |
| One integration significantly stale, others recent | Agent broken or permissions changed in that one tool                   |
| Identity sources recent, all security tools stale  | Device is online but security stack failing — escalate                 |
| All integrations stale                             | Device is offline (vacation, decommissioning) — verify with last logon |
| One tool reports `terminated` (VMs)                | Cloud-instance is gone — Protect marks it inactive immediately         |

## Privacy and X-Ray

The X-Ray view respects the same access controls as everywhere else in Protect:

* **Field-level permissions** can hide sensitive integration fields from specific roles
* **Integration-level permissions** can hide entire X-Ray sections (e.g. "MSP technicians can't see the customer's HR data fed via the ServiceNow integration")
* All X-Ray opens are written to the [Audit Log](/settings/audit-log)

## Next steps

<CardGroup cols={3}>
  <Card title="Device Management" icon="laptop" href="/device-management">
    Where you'll launch X-Ray from
  </Card>

  <Card title="Security Monitoring" icon="shield-halved" href="/security-monitoring">
    Vitals are computed from X-Ray fields
  </Card>

  <Card title="Settings → Schemas" icon="table" href="/settings/schemas">
    The canonical schemas X-Ray maps to
  </Card>
</CardGroup>