LAST UPDATED: Aug 13, 2026
Overview
ThreatAware is a cyber asset attack surface management (CAASM) platform that consolidates device, user, and alert data from an organization's connected security and IT tools into a single unified inventory. It correlates each asset across the tools deployed to it, surfacing per-tool identifiers, security-control coverage, and configuration gaps.
ThreatAware is available for use in:
|
D3 ASOC |
V12.7.0+, V14.0.0+, V14.5.0+ |
|
Category |
Security Optimization Platform |
|
Deployment Options |
Option I, Option II, Option III, Option IV |
Connection
Gather the following information to connect D3 to ThreatAware.
|
Parameter |
Description |
Example |
|---|---|---|
|
Server URL |
The base URL of your ThreatAware portal, where {cloudId} is the subdomain of your portal URL: https://{cloudId}.threataware.com. |
|
|
API Key |
The API key generated in the ThreatAware portal under Settings > API. The key is shown only once at creation and must be copied and stored securely. |
tali*****1a0b |
|
API Version |
Specifies the ThreatAware public API version used in the endpoint URL path. The default version is v1. Supported versions: v1. |
|
Permission Requirements
Each endpoint in the ThreatAware API requires a certain permission scope. The following are required scopes for the commands in this integration:
|
Command |
Required Permissions |
|---|---|
|
Test Connection |
Requires a valid ThreatAware API key. Not enumerated further in API documentation. |
|
Get Users |
Requires a ThreatAware API key with read access to user data. Not enumerated further in API documentation. |
|
Get Inventory |
Requires a ThreatAware API key with read access to inventory data. Not enumerated further in API documentation. |
|
Get Devices |
Requires a ThreatAware API key with read access to device data. Not enumerated further in API documentation. |
|
Get Systems |
Requires a ThreatAware API key with read access to vitals data. Not enumerated further in API documentation. |
Configuring ThreatAware to Work with D3
Complete the following steps in the vendor environment before configuring the D3 connection:
-
Log in to the ThreatAware portal at https://{cloudId}.threataware.com.
-
Identify the Cloud ID from the portal address — it is the subdomain (for example, sandbox in https://sandbox.threataware.com). Use it to build the Server URL: https://{cloudId}.threataware.com.
-
In the portal, open Settings, then click API (per vendor documentation: Settings > API).
-
Click Generate Key and complete the form as desired. The key is displayed only once — copy it immediately and store it securely.
-
Enter the Server URL and API Key in the D3 connection form.
Configuring D3 to Work with ThreatAware
-
Log in to D3.
-
See Adding a Connection for instructions on how to find the integration within D3 and fill out the generic integration connection parameters.
-
System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
-
Configure the integration-specific parameters as documented in the Connection parameter table above.
-
-
Test the connection.
-
Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.
-
Click OK to close the alert window.
-
Click + Add to create and add the configured connection.
-
Commands
ThreatAware includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.
Integration API Note
For more information about the ThreatAware API, refer to the ThreatAware API reference.
|
READER NOTE
|
Get Users
Retrieves the end-user records aggregated from the connected integrations in the ThreatAware portal, including identity details, last login activity, and recently used devices.
Input
|
Input Parameter |
Required/Optional |
Description |
Example |
|---|---|---|---|
|
Filter |
Optional |
Filters the users by their current state. Valid values are all, active, inactive, and deleted. By default, the value is all, which returns users in every state. |
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data displays Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
|
Parts in Error |
Description |
Example |
|---|---|---|
|
Failure Indicator |
Indicates the command failure that happened at a specific input and/or API call. |
Get Users failed. |
|
Status Code |
The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ThreatAware portal. Refer to the HTTP Status Code Registry for details. |
Status Code: 403. |
|
Message |
The raw data or captured key error message from the integration API server about the API request failure. |
Message: Invalid request — missing required parameter. |
|
Error Sample Data
|
Get Inventory
Retrieves the device inventory data collected for a specified connected integration, including per-integration device attributes such as operating system, patch state, IP addresses, and the integration's own record identifiers.
Input
|
Input Parameter |
Required/Optional |
Description |
Example |
|---|---|---|---|
|
System Name |
Required |
The identifier of the connected integration whose inventory to retrieve. Use the Get Systems command to retrieve connected system identifiers, or find them in the ThreatAware portal under Settings > Connections. |
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data displays Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
|
Parts in Error |
Description |
Example |
|---|---|---|
|
Failure Indicator |
Indicates the command failure that happened at a specific input and/or API call. |
Get Inventory failed. |
|
Status Code |
The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ThreatAware portal. Refer to the HTTP Status Code Registry for details. |
Status Code: 403. |
|
Message |
The raw data or captured key error message from the integration API server about the API request failure. |
Message: Invalid request — missing required parameter. |
|
Error Sample Data
|
Get Devices
Retrieves the devices in the ThreatAware environment, including hardware metadata, last logged-in user, network addresses, the security tools deployed to each device, and the connected systems reporting on it.
Input
|
Input Parameter |
Required/Optional |
Description |
Example |
|---|---|---|---|
|
Filter |
Optional |
Filters the devices by state. Valid values are all, active, inactive, and deleted. Leave the field empty to return every device, including unmanaged assets that no connected system reports. all returns only devices in a managed state; active returns those online within the threshold and inactive those offline longer than the threshold. |
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data displays Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
|
Parts in Error |
Description |
Example |
|---|---|---|
|
Failure Indicator |
Indicates the command failure that happened at a specific input and/or API call. |
Get Devices failed. |
|
Status Code |
The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ThreatAware portal. Refer to the HTTP Status Code Registry for details. |
Status Code: 403. |
|
Message |
The raw data or captured key error message from the integration API server about the API request failure. |
Message: Invalid request — missing required parameter. |
|
Error Sample Data
|
Get Systems
Retrieves the integrations connected to the ThreatAware portal, with each system's key, display name, and agent or compliance vitals such as deployed and functioning agent counts.
Input
|
Input Parameter |
Required/Optional |
Description |
Example |
|---|---|---|---|
|
Archive Date |
Optional |
The date for which to retrieve archived vitals data. By default, the value is empty, and current data is returned. Archived data is only available for dates on which a snapshot was taken. |
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data displays Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
|
Parts in Error |
Description |
Example |
|---|---|---|
|
Failure Indicator |
Indicates the command failure that happened at a specific input and/or API call. |
Get Systems failed. |
|
Status Code |
The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ThreatAware portal. Refer to the HTTP Status Code Registry for details. |
Status Code: 403. |
|
Message |
The raw data or captured key error message from the integration API server about the API request failure. |
Message: Invalid request — missing required parameter. |
|
Error Sample Data
|
Test Connection
Performs a health check on the integration connection. A periodic health check can be scheduled by selecting Connection Health Check when editing the integration connection.
Input
N/A
Output
|
Output Type |
Description |
Return Data Type |
|---|---|---|
|
Return Data |
Indicates one of the possible command execution states: Successful or Failed.
|
String |
Error Handling
If the Return Data displays Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
|
Parts in Error |
Description |
Example |
|---|---|---|
|
Failure Indicator |
Indicates the command failure that happened at a specific input and/or API call. |
Test Connection failed. Failed to check the connector. |
|
Status Code |
The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the ThreatAware portal. Refer to the HTTP Status Code Registry for details. |
Status Code: 403. |
|
Message |
The raw data or captured key error message from the integration API server about the API request failure. |
Message: You must have a valid support account to call this API. |
|
Error Sample Data
|