ThreatAware

LAST UPDATED: Aug 13, 2026

Overview

ThreatAware is a cyber asset attack surface management (CAASM) platform that consolidates device, user, and alert data from an organization's connected security and IT tools into a single unified inventory. It correlates each asset across the tools deployed to it, surfacing per-tool identifiers, security-control coverage, and configuration gaps.

ThreatAware is available for use in:

D3 ASOC

V12.7.0+, V14.0.0+, V14.5.0+

Category

Security Optimization Platform

Deployment Options

Option I, Option II, Option III, Option IV

Connection

Gather the following information to connect D3 to ThreatAware.

Parameter

Description

Example

Server URL

The base URL of your ThreatAware portal, where {cloudId} is the subdomain of your portal URL: https://{cloudId}.threataware.com.

https://sandbox.threataware.com

API Key

The API key generated in the ThreatAware portal under Settings > API. The key is shown only once at creation and must be copied and stored securely.

tali*****1a0b

API Version

Specifies the ThreatAware public API version used in the endpoint URL path. The default version is v1. Supported versions: v1.

v1

Permission Requirements

Each endpoint in the ThreatAware API requires a certain permission scope. The following are required scopes for the commands in this integration:

Command

Required Permissions

Test Connection

Requires a valid ThreatAware API key. Not enumerated further in API documentation.

Get Users

Requires a ThreatAware API key with read access to user data. Not enumerated further in API documentation.

Get Inventory

Requires a ThreatAware API key with read access to inventory data. Not enumerated further in API documentation.

Get Devices

Requires a ThreatAware API key with read access to device data. Not enumerated further in API documentation.

Get Systems

Requires a ThreatAware API key with read access to vitals data. Not enumerated further in API documentation.

Configuring ThreatAware to Work with D3

Complete the following steps in the vendor environment before configuring the D3 connection:

  1. Log in to the ThreatAware portal at https://{cloudId}.threataware.com.

  2. Identify the Cloud ID from the portal address — it is the subdomain (for example, sandbox in https://sandbox.threataware.com). Use it to build the Server URL: https://{cloudId}.threataware.com.

  3. In the portal, open Settings, then click API (per vendor documentation: Settings > API).

  4. Click Generate Key and complete the form as desired. The key is displayed only once — copy it immediately and store it securely.

  5. Enter the Server URL and API Key in the D3 connection form.

Configuring D3 to Work with ThreatAware

  1. Log in to D3.

  2. See Adding a Connection for instructions on how to find the integration within D3 and fill out the generic integration connection parameters.

  3. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.

    1. Configure the integration-specific parameters as documented in the Connection parameter table above.

  4. Test the connection.

    1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.

    2. Click OK to close the alert window.

    3. Click + Add to create and add the configured connection.

Commands

ThreatAware includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the ThreatAware API, refer to the ThreatAware API reference.

READER NOTE
Certain permissions are required for each command. Refer to the Permission Requirements and Configuring ThreatAware to Work with D3 sections for details.

Get Users

Retrieves the end-user records aggregated from the connected integrations in the ThreatAware portal, including identity details, last login activity, and recently used devices.

Input

Input Parameter

Required/Optional

Description

Example

Filter

Optional

Filters the users by their current state. Valid values are all, active, inactive, and deleted. By default, the value is all, which returns users in every state.

all

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Get Users failed.

Status Code

The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ThreatAware portal. Refer to the HTTP Status Code Registry for details.

Status Code: 403.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Invalid request — missing required parameter.

Error Sample Data
Get Users failed.
Status Code: [actual HTTP code]
Message: [error message from API response]

Get Inventory

Retrieves the device inventory data collected for a specified connected integration, including per-integration device attributes such as operating system, patch state, IP addresses, and the integration's own record identifiers.

Input

Input Parameter

Required/Optional

Description

Example

System Name

Required

The identifier of the connected integration whose inventory to retrieve. Use the Get Systems command to retrieve connected system identifiers, or find them in the ThreatAware portal under Settings > Connections.

crowdstrike

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Get Inventory failed.

Status Code

The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ThreatAware portal. Refer to the HTTP Status Code Registry for details.

Status Code: 403.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Invalid request — missing required parameter.

Error Sample Data
Get Inventory failed.
Status Code: [actual HTTP code]
Message: [error message from API response]

Get Devices

Retrieves the devices in the ThreatAware environment, including hardware metadata, last logged-in user, network addresses, the security tools deployed to each device, and the connected systems reporting on it.

Input

Input Parameter

Required/Optional

Description

Example

Filter

Optional

Filters the devices by state. Valid values are all, active, inactive, and deleted. Leave the field empty to return every device, including unmanaged assets that no connected system reports. all returns only devices in a managed state; active returns those online within the threshold and inactive those offline longer than the threshold.

active

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Get Devices failed.

Status Code

The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ThreatAware portal. Refer to the HTTP Status Code Registry for details.

Status Code: 403.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Invalid request — missing required parameter.

Error Sample Data
Get Devices failed.
Status Code: [actual HTTP code]
Message: [error message from API response]

Get Systems

Retrieves the integrations connected to the ThreatAware portal, with each system's key, display name, and agent or compliance vitals such as deployed and functioning agent counts.

Input

Input Parameter

Required/Optional

Description

Example

Archive Date

Optional

The date for which to retrieve archived vitals data. By default, the value is empty, and current data is returned. Archived data is only available for dates on which a snapshot was taken.

2024-08-19T00:00:00

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Get Systems failed.

Status Code

The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ThreatAware portal. Refer to the HTTP Status Code Registry for details.

Status Code: 403.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Invalid request — missing required parameter.

Error Sample Data
Get Systems failed.
Status Code: [actual HTTP code]
Message: [error message from API response]

Test Connection

Performs a health check on the integration connection. A periodic health check can be scheduled by selecting Connection Health Check when editing the integration connection.

Input

N/A

Output

Output Type

Description

Return Data Type

Return Data

Indicates one of the possible command execution states: Successful or Failed.
The Failed state can be triggered by any of the following errors:
A connection issue with the integration
The API returned an error message
No response from the API
More details about an error can be viewed in the Error tab.

String

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Test Connection failed. Failed to check the connector.

Status Code

The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ThreatAware portal. Refer to the HTTP Status Code Registry for details.

Status Code: 403.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: You must have a valid support account to call this API.

Error Sample Data
Test Connection failed. Failed to check the connector.
Status Code: [actual HTTP code]
Message: [error message from API response]