This guide covers everything in Protect. If you’re on Connect or Discover, some sections won’t apply yet: each page shows which plans it covers. See Compare plans.
Hour 1: Walk the product
1
Take the in-product tours
On pages that have one, such as Devices, click your initials → Help for this page for a short guided tour of that page.
2
Open Device Explorer
/device-explorer. Look at the globe — does it match your geographic footprint? Look at the integration sync row — every integration Now or under 2 hours?3
Open Devices and click around
Click into 5-10 random device rows. Do you see tiles from several integrations? Click a tile and choose View in X-Ray to see that integration’s raw data and when it was fetched. See X-Ray.
4
Visit Issues
/issues. Look at the Errors (red) first, then the Warnings (amber). Click into a few to understand the format. Don’t act yet — just absorb.5
Visit Action Center
/action-center. Likely empty on day one, which is expected. You’ll build your first flow on Day 2.Hours 2-4: Review the data
Estate sanity check
The Dashboard’s Estate Summary shows your total device count. Compare against:- Your AD device count
- Your Endpoint Detection and Response (EDR) tool’s device count
- Your Mobile Device Management (MDM) tool’s device count
- Your IT spreadsheet (if any)
Tag the estate
Open Settings → Tags. For each tag:- Review the Logic Engine rule
- Check device count looks plausible
- Open Coverage Explorer to find devices with no tags
- Create regional tags if not present (
EMEA,NA,APAC) - Refine the
End-Userrule to exclude devices that aren’t truly end-user (servers in disguise, stock devices) - Add a
Stocktag for devices not yet deployed (so they don’t fail Vitals)
Hours 5-8: Configure your first Vitals
Vitals are useless without configuration — they have nothing to compare against. Start with EDR.1
Open Devices in Vitals view
Go to Devices and click Vitals in the toolbar at the bottom of the screen.
2
Open your EDR's Vitals
Find your EDR column, such as CrowdStrike or Defender, and click the red Vitals icon in its header. Then click Enter Configure Mode at the bottom of the Scope panel.
3
Set which devices need it
Drag
End-User, Server and VM into Required, and leave BYOD and Stock in Excluded.4
Choose the checks
Start light: leave Deployed and Functioning on, and turn on only the configuration checks you’re confident about. You can add more once you understand the results.
5
Exit Configure Mode
Click Exit Configure Mode. The Vitals panel shows how many devices pass each stage.
6
Spot-check 10 devices
Use the View N not… links to look at failing devices, and open a few in X-Ray to confirm each one has a real cause. If you find false positives, go back to Configure Mode and adjust.
Hour 6-8: Save useful views
Build the queries you’ll come back to:
For each: build the query in Devices, click the save icon next to Custom * in the bottom toolbar, name it, and choose Only me or Everyone. See Saving a view.
Day 2: First Tracked View and first Scheduled Report
Your first Tracked View and flow
Start small: track one gap, and have Action Center email you about it.1
In Devices, build the query
tags:End-User AND system.crowdstrike.required:true AND system.crowdstrike.deployed:false2
Click Track View
In the toolbar at the bottom of the screen. ThreatAware now records devices as they enter and leave this view. See Tracked Views.
3
Build an email flow
In Action Center, click New flow and add a Send email step addressed to yourself and your security operations mailbox. In Triggers, choose your tracked view under Trigger from, then publish.
4
Check, then widen
Check the emails look right and go to the right people before you add HTTP request steps that create tickets or post to Teams or Slack.
Still on ThreatAware 3.2? Build a Continuous Action instead
Still on ThreatAware 3.2? Build a Continuous Action instead
1
In Devices, build the query
tags:End-User AND system.crowdstrike.required:true AND system.crowdstrike.deployed:false2
Click Create Action
Footer button.
3
Configure
- Name:
End-User Laptops Missing CrowdStrike - Type: Continuous
- Priority: Important
- Owner: your SecOps team
- Minimum time in view: 24 hours
- Resolution:
system.crowdstrike.deployed:true AND system.crowdstrike.functioning:true AND system.crowdstrike.configuredCorrectly:true
4
Automation: Email
Recipients: yourself + security ops shared mailbox. Subject:
Device {DeviceName} missing CrowdStrike — needs deployment.5
Save and watch
The Action goes live. Within the next sync cycle, devices matching the trigger will start to surface. After 24 hours of being in view, emails begin.
Your first Scheduled Report
Take the first saved view you created (e.g. “End-User Without EDR”) and schedule it:- Settings → Scheduled Reports → + Create Report
- Name: pick your saved view (the report takes its name)
- Format: CSV
- Frequency: Weekly, then choose Monday and 8am
- Recipients: your immediate team (3-4 people max)
- Save
Days 3-5: Iterate and expand
Refine Vitals based on real data
After 48 hours of operation:- Review the Vitals view sorted by unhealthy count
- For each integration where you see noise: change which tags are Required or Excluded, switch the Validation Strategy (for example to Deployment Only while an agent is still rolling out), or turn off monitoring for a noisy check. See Vitals Configuration.
- For each gap pattern (e.g. all of one office failing): track a view of those devices to drive a campaign
Expand integrations
Add Phase 2 integrations:- Vulnerability scanner (Qualys, Rapid7, Tenable)
- Patch management (System Center Configuration Manager (SCCM) via PowerShell Relay)
- Network scanning (Lansweeper)
- IT service management (ServiceNow, Halo Service Desk)
Wire more automation
Once your email flows are stable:- Raise tickets from your flows: see Create ServiceNow tickets, or add an HTTP request step for other tools
- Track a view of broken agents (
system.crowdstrike.deployed:true AND system.crowdstrike.functioning:false) and build a flow for it - Track a view for any in-flight project, such as an OS migration or a decommissioning wave
Explore Reporting
Open Reporting, switch to Build, and click + New. Build a small dashboard:Week 1 retrospective
By the end of week 1 you should have:- ✓ 5-10 integrations connected and syncing
- ✓ Tag taxonomy in place
- ✓ Vitals configured for EDR, MDM, encryption
- ✓ 5-10 saved views
- ✓ 2-3 Tracked Views and Action Center flows running
- ✓ 1-2 Scheduled Reports going out
- ✓ A starter Reporting dashboard
- ✓ A clearer picture of your gaps than any single tool gave you
Week 2-4: Maturity
Common first-week questions
Why does my device count differ from [Tool]?
Why does my device count differ from [Tool]?
Three usual causes:
- ThreatAware deduplicates across tools (right answer; total will look lower than the sum of all tool counts)
- Active vs. Inactive filter (ThreatAware defaults to Active)
- The tool itself counts archived / deleted devices that ThreatAware filters out
How often does data refresh?
How often does data refresh?
Hourly from every integration. Processing takes 5-30 minutes after the sync. To sync now, go to Settings → Integrations and click the refresh button next to Last synced on the integration.
Can I delete devices?
Can I delete devices?
No — and that’s intentional. ThreatAware reflects reality from your tools. If a device should be gone, decommission it in the source tool; it’ll drop out of ThreatAware within the Inactive threshold.
Why is an agent showing 'Not Functioning'?
Why is an agent showing 'Not Functioning'?
ThreatAware detected that the device is active elsewhere (recent activity in other tools) but this specific agent hasn’t reported in too long. This is silent-failure detection — the agent is probably broken. Investigate with X-Ray.
How do I export data?
How do I export data?
Click Export in the bottom toolbar of Devices and choose CSV or Excel. Or save the view and schedule it as a Scheduled Report, which can also send JSON. For programmatic / very large exports, use the API.
Can I integrate with a tool not in the list?
Can I integrate with a tool not in the list?
Probably — contact your account manager with the vendor name + their API documentation. Typical turnaround for a new integration is 2-4 weeks.
Success metrics
See also
Platform Overview
The conceptual map
Set up your tenant
The setup checklist
Glossary
Every term, defined
Vitals Configuration
Setup deep-dive
Action Center
Automation patterns
Troubleshooting
Common issues