> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Your first month

> What to do after setup: check the data, tag the estate, configure Vitals, save views, track your first gap and schedule your first report

> [!NOTE]
>
> This guide covers everything in **Protect**. If you're on **Connect** or **Discover**, some sections won't apply yet: each page shows which plans it covers. See [Compare plans](https://threataware.com/solutions/comparison).

This guide picks up where [Set up your tenant](https://docs.threataware.com/setup.md) leaves off. You have integrations connected, devices flowing in. Now what?

## Hour 1: Walk the product

**1. Take the in-product tours**

On pages that have one, such as Devices, click your initials → **Help for this page** for a short guided tour of that page.

**2. Open Device Explorer**

`/device-explorer`. Look at the globe — does it match your geographic footprint? Look at the integration sync row — every integration `Now` or under 2 hours?

**3. Open Devices and click around**

Click into 5-10 random device rows. Do you see tiles from several integrations? Click a tile and choose **View in X-Ray** to see that integration's raw data and when it was fetched. See [X-Ray](https://docs.threataware.com/x-ray.md).

**4. Visit Issues**

`/issues`. Look at the Errors (red) first, then the Warnings (amber). Click into a few to understand the format. Don't act yet — just absorb.

**5. Visit Action Center**

`/action-center`. Likely empty on day one, which is expected. You'll build your first flow on Day 2.

## Hours 2-4: Review the data

### Estate sanity check

The Dashboard's **Estate Summary** shows your total device count. Compare against:

* Your AD device count
* Your Endpoint Detection and Response (EDR) tool's device count
* Your Mobile Device Management (MDM) tool's device count
* Your IT spreadsheet (if any)

If ThreatAware's count is **substantially different** from all sources, three likely causes:

| Cause | Fix |
| - | - |
| Default filter excludes Inactive | Check the status menu beside the Devices search bar (it starts on **Active**) |
| One source isn't syncing properly | Check [Settings → Integrations](https://docs.threataware.com/settings/integrations.md) |
| Matching is over-aggressive (rare) | Compare X-Ray across "duplicate" rows; contact support if real |

### Tag the estate

Open [Settings → Tags](https://docs.threataware.com/settings/tags.md). For each tag:

1. Review the Logic Engine rule
2. Check device count looks plausible
3. Open [Coverage Explorer](https://docs.threataware.com/coverage-explorer.md) to find devices with no tags

Common day-one tag work:

* Create regional tags if not present (`EMEA`, `NA`, `APAC`)
* Refine the `End-User` rule to exclude devices that aren't truly end-user (servers in disguise, stock devices)
* Add a `Stock` tag for devices not yet deployed (so they don't fail Vitals)

See [Tags](https://docs.threataware.com/tags.md) for design patterns.

## Hours 5-8: Configure your first Vitals

Vitals are useless without configuration — they have nothing to compare against. Start with EDR.

**1. Open Devices in Vitals view**

Go to **Devices** and click **Vitals** in the toolbar at the bottom of the screen.

**2. Open your EDR's Vitals**

Find your EDR column, such as CrowdStrike or Defender, and click the red Vitals icon in its header. Then click **Enter Configure Mode** at the bottom of the Scope panel.

**3. Set which devices need it**

Drag `End-User`, `Server` and `VM` into **Required**, and leave `BYOD` and `Stock` in **Excluded**.

**4. Choose the checks**

Start light: leave **Deployed** and **Functioning** on, and turn on only the configuration checks you're confident about. You can add more once you understand the results.

**5. Exit Configure Mode**

Click **Exit Configure Mode**. The Vitals panel shows how many devices pass each stage.

**6. Spot-check 10 devices**

Use the **View N not…** links to look at failing devices, and open a few in [X-Ray](https://docs.threataware.com/x-ray.md) to confirm each one has a real cause. If you find false positives, go back to Configure Mode and adjust.

Repeat for one MDM (Intune or Jamf) and one identity check (Multi-Factor Authentication (MFA) enrolment).

## Hour 6-8: Save useful views

Build the queries you'll come back to:

| View name | Query |
| - | - |
| **End-User Without EDR** | `tags:End-User AND system.crowdstrike.required:true AND system.crowdstrike.deployed:false` |
| **Broken CrowdStrike Agents** | `system.crowdstrike.deployed:true AND system.crowdstrike.functioning:false` |
| **Misconfigured CrowdStrike** | `system.crowdstrike.functioning:true AND system.crowdstrike.configuredCorrectly:false` |
| **Windows End-User devices** | `tags:End-User AND os:Windows` |

For each: build the query in Devices, click the save icon next to **Custom \*** in the bottom toolbar, name it, and choose **Only me** or **Everyone**. See [Saving a view](https://docs.threataware.com/device-management.md#saving-a-view).

## Day 2: First Tracked View and first Scheduled Report

### Your first Tracked View and flow

Start small: track one gap, and have Action Center email you about it.

**1. In Devices, build the query**

`tags:End-User AND system.crowdstrike.required:true AND system.crowdstrike.deployed:false`

**2. Click Track View**

In the toolbar at the bottom of the screen. ThreatAware now records devices as they enter and leave this view. See [Tracked Views](https://docs.threataware.com/tracked-views.md).

**3. Build an email flow**

In [Action Center](https://docs.threataware.com/automation.md), click **New flow** and add a **Send email** step addressed to yourself and your security operations mailbox. In **Triggers**, choose your tracked view under **Trigger from**, then publish.

**4. Check, then widen**

Check the emails look right and go to the right people before you add HTTP request steps that create tickets or post to Teams or Slack.

> **Still on ThreatAware 3.2? Build a Continuous Action instead**
>
> **1. In Devices, build the query**
>
> `tags:End-User AND system.crowdstrike.required:true AND system.crowdstrike.deployed:false`
>
> **2. Click Create Action**
>
> Footer button.
>
> **3. Configure**
>
> * Name: `End-User Laptops Missing CrowdStrike`
> * Type: Continuous
> * Priority: Important
> * Owner: your SecOps team
> * Minimum time in view: 24 hours
> * Resolution: `system.crowdstrike.deployed:true AND system.crowdstrike.functioning:true AND system.crowdstrike.configuredCorrectly:true`
>
> **4. Automation: Email**
>
> Recipients: yourself + security ops shared mailbox. Subject: `Device {DeviceName} missing CrowdStrike — needs deployment`.
>
> **5. Save and watch**
>
> The Action goes live. Within the next sync cycle, devices matching the trigger will start to surface. After 24 hours of being in view, emails begin.
>
> Validate that the emails look right before adding additional channels (tickets, webhooks).

### Your first Scheduled Report

Take the first saved view you created (e.g. "End-User Without EDR") and schedule it:

1. [Settings → Scheduled Reports](https://docs.threataware.com/settings/scheduled-reports.md) → **+ Create Report**
2. Name: pick your saved view (the report takes its name)
3. Format: CSV
4. Frequency: Weekly, then choose Monday and 8am
5. Recipients: your immediate team (3-4 people max)
6. Save

The first delivery is the following Monday.

## Days 3-5: Iterate and expand

### Refine Vitals based on real data

After 48 hours of operation:

* Review the Vitals view sorted by unhealthy count
* For each integration where you see noise: change which tags are **Required** or **Excluded**, switch the **Validation Strategy** (for example to **Deployment Only** while an agent is still rolling out), or turn off monitoring for a noisy check. See [Vitals Configuration](https://docs.threataware.com/vitals-configuration.md).
* For each gap pattern (e.g. all of one office failing): track a view of those devices to drive a campaign

### Expand integrations

Add Phase 2 integrations:

* Vulnerability scanner (Qualys, Rapid7, Tenable)
* Patch management (System Center Configuration Manager (SCCM) via [PowerShell Relay](https://docs.threataware.com/powershell-relay.md))
* Network scanning (Lansweeper)
* IT service management (ServiceNow, Halo Service Desk)

### Wire more automation

Once your email flows are stable:

* Raise tickets from your flows: see [Create ServiceNow tickets](https://docs.threataware.com/automation-servicenow.md), or add an **HTTP request** step for other tools
* Track a view of broken agents (`system.crowdstrike.deployed:true AND system.crowdstrike.functioning:false`) and build a flow for it
* Track a view for any in-flight project, such as an OS migration or a decommissioning wave

### Explore Reporting

Open [Reporting](https://docs.threataware.com/reporting.md), switch to **Build**, and click **+ New**. Build a small dashboard:

```text theme={null}
Make a dashboard with:
  - Total device count as a big metric at top
  - A donut chart of devices by OS
  - A bar chart of EDR coverage % by region
```

The AI builds it in 60-90 seconds. Iterate on what you'd want leadership to see.

## Week 1 retrospective

By the end of week 1 you should have:

* ✓ 5-10 integrations connected and syncing
* ✓ Tag taxonomy in place
* ✓ Vitals configured for EDR, MDM, encryption
* ✓ 5-10 saved views
* ✓ 2-3 Tracked Views and Action Center flows running
* ✓ 1-2 Scheduled Reports going out
* ✓ A starter Reporting dashboard
* ✓ A clearer picture of your gaps than any single tool gave you

## Week 2-4: Maturity

| Goal | How |
| - | - |
| **Move from emails to tickets** | Add ticket steps to your flows, for example [ServiceNow](https://docs.threataware.com/automation-servicenow.md) |
| **Tighten Vitals** | Move from base checks to policy-level configuration checks |
| **Roll out across teams** | Add users, and create custom roles that limit what each team sees |
| **Define your reporting rhythm** | Daily for SOC, weekly for managers, monthly for leadership |
| **Set MTTR targets** | Make the dashboard show progress over time |

## Common first-week questions

> **Why does my device count differ from \[Tool]?**
>
> Three usual causes:
>
> 1. ThreatAware deduplicates across tools (right answer; total will look lower than the sum of all tool counts)
> 2. Active vs. Inactive filter (ThreatAware defaults to Active)
> 3. The tool itself counts archived / deleted devices that ThreatAware filters out
>
> Use [X-Ray](https://docs.threataware.com/x-ray.md) on a specific device to see exactly which tools see it.

> **How often does data refresh?**
>
> Hourly from every integration. Processing takes 5-30 minutes after the sync. To sync now, go to [Settings → Integrations](https://docs.threataware.com/settings/integrations.md) and click the refresh button next to **Last synced** on the integration.

> **Can I delete devices?**
>
> No — and that's intentional. ThreatAware reflects reality from your tools. If a device should be gone, decommission it in the source tool; it'll drop out of ThreatAware within the [Inactive threshold](https://docs.threataware.com/settings/misc.md).

> **Why is an agent showing 'Not Functioning'?**
>
> ThreatAware detected that the device is active elsewhere (recent activity in other tools) but this specific agent hasn't reported in too long. This is silent-failure detection — the agent is probably broken. Investigate with [X-Ray](https://docs.threataware.com/x-ray.md).

> **How do I export data?**
>
> Click **Export** in the bottom toolbar of Devices and choose CSV or Excel. Or save the view and schedule it as a [Scheduled Report](https://docs.threataware.com/scheduled-reports.md), which can also send JSON. For programmatic / very large exports, use the [API](https://docs.threataware.com/api-reference/overview.md).

> **Can I integrate with a tool not in the list?**
>
> Probably — contact your account manager with the vendor name + their API documentation. Typical turnaround for a new integration is 2-4 weeks.

## Success metrics

| After | Look for |
| - | - |
| **30 days** | All priority integrations connected; Vitals configured for top 3 controls; 2-5 Tracked Views with flows running; baseline reporting in place |
| **90 days** | 90%+ healthy on key controls; MTTR under 7 days; 80%+ automation of common gaps; 5+ Reporting apps; executive-level reporting cadence |

## See also

> **[Platform Overview](https://docs.threataware.com/overview.md)**
>
> The conceptual map

> **[Set up your tenant](https://docs.threataware.com/setup.md)**
>
> The setup checklist

> **[Glossary](https://docs.threataware.com/reference/glossary.md)**
>
> Every term, defined

> **[Vitals Configuration](https://docs.threataware.com/vitals-configuration.md)**
>
> Setup deep-dive

> **[Action Center](https://docs.threataware.com/automation.md)**
>
> Automation patterns

> **[Troubleshooting](https://docs.threataware.com/reference/troubleshooting.md)**
>
> Common issues


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.