> This is part 1 of 3 of the full documentation (pages 1–100 of 233).
> The content is paginated: fetch every part to see all of it.
> Next part: https://docs.threatdefence.com/llms-full.txt/1
> Page index: https://docs.threatdefence.com/llms.txt

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
This site has an agentic ask interface you may use to query the documentation dynamically by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.threatdefence.com/index.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

---

# TD Docs

<h2 align="center">ThreatDefence Documentation</h2>

<table data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th><th data-hidden data-card-cover data-type="image">Cover image</th></tr></thead><tbody><tr><td><i class="fa-play">:play:</i></td><td>Getting Started</td><td>Quick start with our platform and services: product breakdown, deployment, FAQ, and support.</td><td><a href="/getting-started/quick-start">Quick Start</a></td><td></td></tr><tr><td><i class="fa-wrench">:wrench:</i></td><td>Platform Management</td><td>Manage users, MFA, portal access, dashboards, and reports.</td><td><a href="/platform-management/platform-overview">Overview</a></td><td></td></tr><tr><td><i class="fa-laptop">:laptop:</i></td><td>Endpoint Agent</td><td>Requirements, release notes, and deployment steps.</td><td><a href="/endpoint-agent/prerequisites">Prerequisites</a></td><td></td></tr><tr><td><i class="fa-mailbox">:mailbox:</i></td><td>Microsoft 365</td><td>Entra ID and Microsoft 365 monitoring, Graph API, Purview, Defender.</td><td><a href="/microsoft-365/prerequisites">Prerequisites</a></td><td></td></tr><tr><td><i class="fa-server">:server:</i></td><td>Appliances</td><td>Deployment and management of TD sensors (NDR, Syslog forwarders, deception honeypots).</td><td><a href="/appliances/network-sensor/overview">Overview</a></td><td></td></tr><tr><td><i class="fa-plug">:plug:</i></td><td>SIEM Integrations</td><td>Integrate log sources such as EDR, email security, and firewalls.</td><td><a href="/siem-integrations/siem-integrations">Overview</a></td><td></td></tr><tr><td><i class="fa-starfighter">:starfighter:</i></td><td>Attack Surface Management</td><td>Dark web monitoring, impersonating domains, external scanning, and ASM.</td><td><a href="/attack-surface-management/attack-surface-management">Overview</a></td><td></td></tr><tr><td><i class="fa-user-police-tie">:user-police-tie:</i></td><td>Security Operations</td><td>24/7 SOC, incident response, and detection playbooks.</td><td><a href="/security-operations/security-operations">TD SecOps</a></td><td></td></tr><tr><td><i class="fa-book-open" style="color:$primary;">:book-open:</i></td><td>SOC Analyst Guide</td><td>Everyday analyst tasks, platform navigation, threat hunting and alert triage.</td><td><a href="/soc-analyst-guide/quickstart">Quickstart</a></td><td></td></tr><tr><td><i class="fa-heart">:heart:</i></td><td>Legal and Compliance</td><td>Compliance programs, agreements, and privacy policies.</td><td><a href="/legal-and-compliance/compliance">Compliance</a></td><td></td></tr></tbody></table>


# Quick Start

Welcome to ThreatDefence! This quick start will help you get up and running with the platform in just a few steps.

Our recommended path for new customers is:

1. **Install the Endpoint Agent** to capture endpoint telemetry;
2. **Connect your email (365, Google);**
3. **Deploy Network Sensor(NDR)**, if applicable;
4. **Access the Analyst Console** to view alerts, dashboards, and reports;
5. Expand your visibility with **SIEM integrations**, **Monitoring Sensors** and **Attack Surface Management;**
6. Attend monthly or quaterly **security posture review** meetings.

***

## Quick Start Navigator

| Step                          | Description                                                                                                                       | Next Steps                                                                                                                                             |
| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Install Endpoint Agent**    | Deploy the lightweight agent on Windows, Mac, or Linux endpoints. Provides telemetry, forensic artifacts and containment actions. | [Install Endpoint Agent](/endpoint-agent/prerequisites)                                                                                                |
| **Connect Email**             | Integrate Microsoft 365 or other email services to gain visibility into accounts, email, Defender and Purview logs.               | [Set up Microsoft 365](/microsoft-365/prerequisites) [Google](https://docs.threatdefence.com/siem-integrations/software-as-a-service/google-workspace) |
| **Access Analyst Console**    | Log into the Analyst Console to review detections, alerts and dashboards.                                                         | [Go to Analyst Console](https://console.threatdefence.io)                                                                                              |
| **Access Customer Portal**    | Log into the Customer Console to manage integrations and get reports.                                                             | [Go to Customer Portal](https://portal.threatdefence.io)                                                                                               |
| **SIEM Integrations**         | Connect additional log sources such as EDR, firewalls, SaaS, and cloud platforms.                                                 | [SIEM Integrations](/siem-integrations/siem-integrations)                                                                                              |
| **NDR Sensors**               | Deploy physical or virtual sensors for advanced visibility and detections.                                                        | [Network Sensors](/appliances/network-sensor/overview)                                                                                                 |
| **Attack Surface Management** | Monitor your external perimeter, look-alike domains, dark web leaks, and vulnerabilities.                                         | [Attack Surface Management](/attack-surface-management/attack-surface-management)                                                                      |

***


# Onboarding

A comprehensive SIEM/SOC onboarding directly translates to tangible business benefits by mitigating cyber risk. Ensuring broad data source coverage, from endpoints to cloud platforms, eliminates visibility gaps where threats can hide, directly reducing the likelihood of a successful breach. This proactive visibility enables faster threat detection and response, minimising potential operational downtime, financial loss and reputational damage.

The initial Discovery Meeting aligns stakeholders on service scope, priorities and technical requirements. The Technical Onboarding phase follows, deploying agents and configuring all necessary log sources and integrations. This ensures validated data ingestion and functional alert pipelines.

Subsequently, the Operational Onboarding stage commences with the SOC assuming 24/7 monitoring responsibilities. It includes joint simulation exercises to validate incident response workflows. Customers are then introduced to dashboards, scorecards and regular governance reviews. The phase involves tuning detection rules and transitioning to steady-state operations backed by SLAs. By the end of the process, customers are fully operational with secure telemetry and clear escalation paths. This establishes a firm foundation for ongoing improvements to the security posture.


# Onboarding Process

A **guided onboarding process** designed to ensure a smooth transition into our platform and SOC services. This process is supported by our technical specialists and SOC analysts, and is structured into three key stages:

***

## 1. [Discovery Meeting](/getting-started/guided-onboarding/discovery-form)

* Conducted with customer stakeholders (technical, operational, and business).
* Establishes the **scope of services**, key priorities, and success criteria.
* Defines log sources, endpoint coverage and any compliance or reporting requirements.
* Confirms escalation contacts, governance expectations and reporting cadence.

***

## 2. [Technical Onboarding](/getting-started/guided-onboarding/technical-integrations)

* Deployment of ThreatDefence **endpoint agents, sensors, and integrations**.
* Configuration of cloud and SaaS log sources (e.g., Microsoft 365, AWS, Azure, GCP).
* Setup of delegated access (e.g., Azure Lighthouse for Sentinel environments).
* Validation of data ingestion, alert pipelines, and security telemetry.

***

## 3. [Operational Onboarding](/getting-started/guided-onboarding/security-operations)

* SOC assumes **24x7 monitoring and triage** responsibilities.
* Joint simulation exercises to validate **incident declaration and escalation workflows**.
* Customers are introduced to **reporting dashboards, scorecards, and governance reviews**.
* Regular touchpoints with the SOC team to review findings and provide feedback.
* Tuning of detection rules, dashboards, and automations.
* Transition to steady-state operations, backed by SLAs and the Operations Manual.

***

By the end of the guided onboarding process, customers are fully integrated into the ThreatDefence ecosystem, with:

* Secure telemetry ingestion and validated monitoring coverage
* Clear escalation paths and incident management workflows
* Regular reporting and governance established
* A baseline for ongoing improvements in detection, response, and security posture

***

For more details or to schedule your onboarding sessions, please contact your ThreatDefence account manager.


# Technical Integrations

Following the Discovery Meeting, the next step in onboarding is the technical enablement of log and telemetry sources. This phase ensures ThreatDefence has the visibility required to deliver effective monitoring, detection, and response.

The shared objective is to achieve at least 80% coverage across your environment, focusing on critical assets, identity systems, cloud platforms, and endpoints.

Why Coverage Matters:

* Reduce blind spots – attackers thrive where monitoring is weak; coverage closes those gaps.
* Improve detection accuracy – more context allows AI models and analysts to separate true threats from noise.
* Accelerate investigations – correlated data enables rapid reconstruction of attack chains and timelines.

***

## 1. Data Source Inventory

We work with your team to identify and prioritize sources across:

* Cloud and SaaS – Microsoft 365, Salesforce, AWS CloudTrail, Azure Activity Logs, Google Workspace
* Network Infrastructure – firewalls, VPNs, proxies, routers, and switches
* Endpoints and Servers – Windows Event Logs, Linux/Mac logs, EDR/AV telemetry
* Identity and Access – Active Directory, Azure AD, MFA, SSO/IAM platforms
* Applications and Databases – web servers, databases, and custom application logs

## 2. Integration Methods

ThreatDefence supports multiple integration approaches to suit your environment:

* Syslog (TCP/UDP, TLS)
* API-based ingestion (RESTful APIs, cloud connectors)
* Agent-based collection (lightweight endpoint agents)
* Native cloud integrations (AWS S3, Azure Event Hubs)

## 3. Validation and Confirmation

Once sources are integrated, ThreatDefence engineers:

* Verify data fidelity, timeliness, and volume
* Confirm parsing, normalization, and enrichment
* Validate dashboards, detections, and alert routing


# Security Operations

Once technical onboarding is complete and data sources are integrated, the next step is operational onboarding. This stage ensures that ThreatDefence and your internal teams are aligned on workflows, escalation paths, SLAs, and responsibilities. The goal is to establish a seamless hybrid SOC model from day one.

Objectives:

* Align detection, escalation, and response processes between ThreatDefence and your internal teams.
* Validate operational readiness through simulations and testing.
* Formalize governance, reporting, and service cadence.

***

## Key Activities

### 1. Security Operations

* Confirm notificaiton and escalation emails / contacts.
* Review the Security Operations and Incident Management Lifecycle.
* Start 24/7 Security Operations.

### 2. SLA and Operations Manual Alignment

* Confirm processes documented in the ThreatDefence Operations Manual.
* Document escalation contact orders.
* Provide training to customer escalation contacts on how to engage with ThreatDefence SOC.
* Review containment procedures.

### 4. Governance Setup

* Schedule regular reports.
* Establish monthly operational reviews to discuss incidents, SLA adherence, and tuning opportunities.

***

## Outcome

This phase ensures the SOC service is not just technically connected, but operationally ready. Both ThreatDefence and your internal teams will have clear roles, responsibilities, and communication channels, enabling faster response and improved collaboration during incidents.


# Discovery Form

{% embed url="<https://www.cognitoforms.com/ThreatDefence1/Discovery>" %}


# SIEM HVT Asset Tagging

High-Value Target (HVT) assets are those whose compromise could result in a severe business impact, such as operational downtime, data breach, or financial loss. Examples include key personnel like the CFO or system administrators, critical servers, and devices with privileged access.

Tagging these assets enables you to proactively search for and generate alerts on all related activity. You can easily isolate these critical events in your SIEM using a query like `tags:hvt*` alongside other relevant tags.

To enable this functionality, please download the template below, populate it with your HVTs, and return it to your account manager.

{% file src="/files/f73GbhbN1QE83cV1aXpm" %}


# Getting Help

ThreatDefence provides multiple ways to get help when you need support with the platform or SOC services. This page outlines the available options and how to raise requests effectively.

***

## Check the FAQ

Before raising a request, check our [FAQ section](/getting-started/frequently-asked-questions) for quick answers to common questions about:

* Platform access and authentication issues
* Endpoint agent installation
* SIEM integration problems
* Alerts and triage
* Reporting and dashboards.

***

## Contacting Support and Raising Service Requests

If your issue is not resolved via the FAQ, you can raise a request with the ThreatDefence Support team.

### How to Raise a Request:

Service Requests can be raised through the Service Desk by sending an email to [support@threatdefence.com.](mailto:support@threatdefence.com)

When raising a request, please include as much information as possible to assist triage, such as:

* **Description of the issue**
* **Impact on services** (full outage, partial impairment, degraded performance, etc.)
* **Date and time** the issue was first observed
* **Error messages or logs**, if available
* **Contact details** of the person raising the request.

### Ticket Reference

* Once logged, a **unique ticket number** will be issued.
* Customers should use this ticket number for **all further communications** regarding the incident.
* Ticket progress and updates will be available in the **Service Desk portal**.

***

## Reporting Cyber Incidents

For immediate assistance with **critical cyber security incidents**, contact our **24/7 SOC team** on the escalation phone number provided in your **Operations Manual**.

***


# FAQ

This section provides answers to common questions and guidance on core features of the ThreatDefence SecOps platform.

***

## Contents

* [General Questions](/getting-started/frequently-asked-questions/general-questions)
* [Alerts and Escalations](/getting-started/frequently-asked-questions/alerts-and-escalations)
* [Tenant Management (MSP Features)](/getting-started/frequently-asked-questions/tenant-management-msp-features)
* [Endpoint Agent](/getting-started/frequently-asked-questions/endpoint-agent)
* [Microsoft 365 Monitoring](/getting-started/frequently-asked-questions/microsoft-365-monitoring)


# General Questions

## Table of Contents

* [General Questions](#general-questions)
  * [Table of Contents](#table-of-contents)
  * [What is your pricing model?](#what-is-your-pricing-model)
  * [What subscription tiers are available?](#what-subscription-tiers-are-available)
  * [Data sovereignty – where does my data go?](#data-sovereignty--where-does-my-data-go)
  * [What data can I onboard immediately?](#what-data-can-i-onboard-immediately)
  * [How long does it take to onboard my business?](#how-long-does-it-take-to-onboard-my-business)
  * [Can I get a trial or proof of concept?](#can-i-get-a-trial-or-proof-of-concept)
  * [Can the platform be white-labelled for MSPs?](#can-the-platform-be-white-labelled-for-msps)
  * [How do I access the platform?](#how-do-i-access-the-platform)
  * [What are my responsibilities as a user?](#what-are-my-responsibilities-as-a-user)
    * [SaaS SecOps Platform](#saas-secops-platform)
    * [Platform + SOC Service](#platform--soc-service)

***

## What is your pricing model?

Our standard pricing model for MSPs and commercial customers is **per user, per month**.\
For large Enterprise or ICS/OT deployments, please contact your account manager for a tailored model.

***

## What subscription tiers are available?

Two subscription tiers are available:

* **TD Complete Tier** – Includes full 24×7 SOC services.
* **Platform-Only Tier** – Use the platform to build and run your own SOC capability.

***

## Data sovereignty – where does my data go?

For Australian customers, all data remains **onshore in Australia** and will not leave the country.

***

## What data can I onboard immediately?

We support a wide range of log sources. Most customers begin with:

* ThreatDefence endpoint agents
* Microsoft 365 or Google Workspace logs
* AV/EDR telemetry

These sources typically provide **90–100% coverage** for small to medium organisations.

***

## How long does it take to onboard my business?

* Cloud and syslog integrations can be onboarded in **minutes**.
* The ThreatDefence endpoint agent supports automation, allowing deployment to **hundreds of endpoints almost instantly**.

***

## Can I get a trial or proof of concept?

Yes. We offer a **30-day trial** so you can experience the platform before committing.\
Please contact <sales@threatdefence.com> for details.

***

## Can the platform be white-labelled for MSPs?

Yes. White-labelling is available for larger deployments.\
Please speak with your account manager to confirm if your organisation qualifies.

***

## What are my responsibilities as a user?

Active engagement with the platform increases awareness and reduces business risk. While our SOC triages alerts and performs threat hunting, tenants also have responsibilities depending on their subscription model.

### SaaS SecOps Platform

You are responsible for the **daily triage of alerts**.\
For a medium-risk organisation, we recommend at minimum:

* Reviewing the **Security Detections Dashboard** daily (0900 and 1700).
* Monitoring and actioning **email alerts**, particularly for high-severity events.

### Platform + SOC Service

Our SOC manages the full alert lifecycle. Your responsibilities are limited to:

* **Responding** to escalations sent via email from the SOC.
* Ensuring at least one representative attends the **monthly 15–30 minute review meeting**.

Here is the corrected version with improved grammar, spelling, flow, and professional tone:

## **What Integrations are Supported?**

By default, most common tools and platforms are supported, including cloud providers, SaaS, PaaS, and on-premises systems. We effectively support "everything." If a new, previously unseen data source requires a plugin, our R\&D team can develop it within one or more days, depending on complexity.

## **What Ingestion Methods are Supported?**

We support almost all common methods, such as APIs, webhooks, syslogs, agents, collectors, and sensors. If a specific method does not exist, for example, for a legacy mainframe system from the 1980s, our R\&D team can build a solution.

## **What is the Typical Onboarding Effort?**

For an organization with 500 users, achieving more than adequate coverage typically takes 1–3 hours. For example:

* Deploying endpoint agents to high-value targets or all endpoints: 1–5 hours (Windows engineer).
* Deploying an NDR sensor: 15 minutes (network engineer).
* Connecting major cloud providers: \~15 minutes.
* Adding major data sources (e.g., enabling syslog on a firewall or creating an API key): \~15 minutes each.

## **Do You Provide an Attack Storyline?**

Yes. The forensic record for timeline reconstruction is natively preserved within the platform.

## **Can We Pivot from One Signal (e.g., Email) to Other Assets (e.g., Endpoints, Firewalls)?**

Yes. Alerts perform this pivoting by default. For manual threat hunting, this capability is available via easy-to-use dashboard filtering and pinning.

## **What Detections are Included Out-of-the-Box?**

The platform includes approximately 2,000+ live use cases covering all common technologies. For example, for AWS you can onboard CloudTrail, CIS benchmarking, inventory, and services like S3 for automated detection and benchmarking. New use cases can be added at any time.

**What Response Actions are Supported?** We support isolation, ticketing, orchestration, and any other methods required for your specific environment. For example:

* For Microsoft 365: We require lock permissions to lock user accounts.
* For endpoints: Any command (e.g., route deletion, process termination) can be used to isolate a device.
* For firewalls: API or a script.

## **What Integration Capabilities with Existing Tools are Supported?**

Any tool can be integrated via our dedicated backend workflows, including custom integrations if required. The most common integrations are with EDR systems, firewalls, and content filters for automated response actions.

## **What is the Data Retention Policy?**

By default, we retain data in hot storage for 2 months for the top five largest data sources. Data can be retained indefinitely in a restorable archive if required. Assessments (dark web, scanning, etc.) and detections (alerts) are kept indefinitely.

## **How Do You Deal with Alert Noise Reduction?**

Our detection engineering team fine-tunes rules based on post-hunting reviews. We also use automated tools and an AI assistant that adjusts alerts based on historical context (e.g., "Tom from IT runs weekly scans"). End users can also create whitelists directly via the portal with just a few clicks.

## **Can I Have Role-Based Access Control (RBAC)?**

Yes. We support granular access controls. For example:

* A user can be restricted to a single endpoint.
* A tenant can only access its own data.
* An MSP can access all its tenants.
* A distributor account can view MSP-level data.

## **How Does Licensing Work?**

By default, licensing is based on the average number of successfully logged-in users. This can be calculated using the average of endpoint and email users, for instance. We also support volume-based ingestion licensing, which is applicable to ISPs and hosting providers.

## **What Are the Deployment Options?**

* **SaaS:** Instant enablement with some components, such as NDR sensors and collectors, will be deployed on-site.
* **On-Premises "SaaS":** This requires on-premises hardware. Its maintenance can be resource-intensive and is typically suitable for extreme-risk environments or large MSPs.

<br>


# Exporting Data

This article demonstrates how to export data from a visualisation in ThreatDefence

## Step 1. Open the desired dashboard

Open your dashboard, set the time range, set any filters you may need(i.e. dest:port:445 and source.ip: 10.10.10.10 AND user.name:john) hover over the target panel, click the three dots in the top right corner, and select "Inspect":

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-1f10a0879bcf5b6e4196148cf1ce47acc7d16638%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

***

## Step 2. Select your export method

Select formatted CSV and a file will be downloaded.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-b2876225c4a9b1149887d4160090444595869972%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

***


# Alerts and Escalations

***

## What are Security Detections?

**Security Detections** are alerts raised when potential risks, cyber threats, or suspicious events are identified.\
They include detections generated by the ThreatDefence SecOps platform (based on predefined use cases) as well as alerts ingested from your integrated log sources.

***

## What are Escalations?

An **Escalation** is created when our SOC team identifies an event that requires your attention or non-immediate action.\
Escalations are tracked until resolved, and if no response is received, our team will follow up with your designated contacts.

***

## What are Incidents?

**Incidents** are high-severity security events declared by the SOC team that typically require an immediate response.\
For incidents, the SOC follows the agreed escalation path (for example, direct phone calls to your team) to ensure rapid containment and resolution.

***

## Minimum Customer Effort (SOC Service – TD Complete)

As a SOC subscriber, our team continuously monitors and triages your detections.\
The **minimum effort expected from you is to respond to Notifications**.

Recommended involvement can be aligned to the following **operations awareness maturity levels**:

* **L1 (Minimum):** Respond to escalations raised by the SOC team.
* **L2 (Intermediate):** Review the Security Detections dashboard daily or monitor email alerts generated from detections.
* **L3 (Advanced):** Conduct a one-hour monthly threat hunt across critical areas such as O365 access, network flows, endpoint activity, CIS benchmarking, privileged user access, and emerging threats.

***

## Who Manages Alert Definitions?

All use cases and detection correlations are created, managed, and continuously updated by the ThreatDefence SecOps team.

***

## Can I Create Custom Alerts?

Yes.

* A **custom alerting GUI** is available for partners who meet specific commitments.
* Alternatively, you can request new alerts by contacting [**support@threatdefence.com**](mailto:support@threatdefence.com).

***

## How Many Alerts Should I Expect?

As a guideline:

* An organization with **\~500 users** and **15+ onboarded data sources** (e.g., email, endpoints, servers, dark web, vulnerability scans) can expect **30–50 alerts per month**.
* These will typically result in **2–3 Escalations** requiring IT team action.

***

## Can We Create Playbooks?

Yes, but this is best suited for **MSSPs with a dedicated detection engineering team**.\
Playbook creation requires input from SOC experts to ensure quality.

➡️ Contact your platform account manager for a review of your requirements and advice on available options.


# Tenant Management

***

## Is the platform multi-tenant?

Yes. The platform is fully multi-tenant, with all tools supporting multiple tenants and providing strict data segregation between them.

## Do we need to use different web interfaces for each tenant?

No. All tenant data is visible in the same UI. By default, you can view all tenants together and drill down into any specific tenant as needed.

## Can I grant access so one of my team members can only access a subset of tenants?

Yes. Granular permissions can be applied to restrict access so that users can only see a defined subset of tenants.


# Endpoint Agent

## What is the function of the endpoint agent?

The agent collects advanced telemetry from your endpoints to enable cyber threat detection and facilitate incident response. It provides complete visibility into endpoints, recording forensic-like evidence such as network connections, logins, processes, user actions, downloaded files, and much more. The agent can also be used to execute interactive threat-hunting queries and perform various incident response actions.

## What Operating Systems are Supported?

Check Agent Deployment Prerequisites /endpoint-agent/prerequisites.md

## How can we verify if an agent is online and reporting?

In the Analyst Console, under the endpoint menu, two dashboards are available:

* **Inventory of Agents**: conducts regular checks to confirm if agents are live and reporting.

## How do you remove an agent from the Console?

You must uninstall the agent directly from the endpoint.

## Can I run EDR and the visibility agent at the same time?

Yes, they can co-exist on the same endpoint. Just ensure that your EDR is not blocking the installation of the agent.


# NDR (Network Sensor)

## How can I see all NDR alerts?

Many options:

* On the main Security Detections dashboard, under Data Source drop down menu, choose Network Sensor or Network Intrusion;
* OR click on the NDR section in the pie chart:

  <figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-a19992c9758ddaf1ac3540d9b3b83757a09acbb1%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>
* Under Main menu/My SOC/Alerts\&Detections/Network Behavior and Network Intrusion dashboards.

## How can I see all network traffic events (not alerts)

Under main menu/Network. Network traffic flows contains all traffic metadata for full assurance, so breaches will be recorded even if not detected and includes all business traffic. The other dashboards contain data for individual traffic types:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-ab89ace36fc0ccd0299ab8ba714fc81b06d99b99%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

## How to inspect incoming traffic only?

In the top right corner, click on inbound to see all inbound traffic:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-f986d9958a2838348b8b0dc71a92063808c8301f%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

## How to see all anomalies and attacks?

Under main menu/Network/network Intrusion Detection, All network Intrusion Events. This module only records suspicious activity. To see all attacks from the outside, click on inbound under the Network Direction pie chart. To see what ports/services attract hackers, refer to the Destination Ports table that lists the count of unique incoming source IP's.


# Microsoft 365 Monitoring

## What level of Microsoft 365 (MS365) license do I need to integrate into your platform?

Any MS365 licensing tier is supported - we do not require you to have Premium E5 or P1/P2 licenses from Microsoft. Our platform will automatically adjust and extract the available security events information based on your licensing tier.

## For how long do you keep our MS365 data?

We retain MS365 data for three months.

## What MS365 applications are supported?

We monitor user activity across all MS365 applications, including Entra ID, Exchange Online, SharePoint, OneDrive, and MS Teams.

## ​​How long does it take for my Microsoft logs to appear on your platform?

The logs will start loading onto the dashboards within 30-60 minutes after the integration has been added.


# Overview

## Platform Introduction

ThreatDefence delivers an end-to-end cybersecurity suite that combines SIEM, Network Detection and Response (NDR), Endpoint Visibility, Threat Intelligence, and Vulnerability Management into a single integrated **SecOps platform**.

The platform is implemented as a fully supported SaaS service, designed to provide comprehensive enterprise coverage. It integrates all available security data, including:

* **Internal data sources** such as endpoints, servers, and network telemetry.
* **External data sources** including cloud workloads, SaaS applications, and third-party services.
* **Threat intelligence feeds** covering Dark Web breaches, compromised credentials, external vulnerabilities, and supply chain risks.

The platform is delivered as a cloud-hosted service, with lightweight data collection sensors deployed within customer environments.

***

### Platform Architecture

At a high level, the platform architecture can be represented as follows:

![ThreatDefence Platform Overview Diagram](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-9f5db8d647e7c40694f6d27231faf9e40a581fa8%2Fplatform-overview.png?alt=media)

***

### Core Components

* **Cloud SIEM / SecOps Platform** – Centralized analytics, dashboards, and automation.
* **Endpoint Visibility and DFIR Agents** – Comprehensive telemetry from workstations and servers, with forensic capabilities.
* **Network Detection and Response Sensors** – Passive network monitoring for threats and anomalies.
* **Syslog Collectors** – Secure log forwarding and aggregation from diverse infrastructure.
* **Cloud, API, and Syslog Integrations** – Native integrations with Microsoft 365, AWS, GCP, security tools, and SaaS platforms.

## Why Onboard Data Sources

**Onboard Data Sources - Unlock Your SOC's Full Potential**

**Why does onboarding more data sources matter?** Every log, event, and alert from your environment is a piece of the puzzle. The more pieces you provide, the clearer the picture your ThreatDefence platform can build. Onboarding data is the single most important step to transforming your SOC from reactive to proactive.

We support 1000's of data sources to provide a complete coverage over all corners of the orgnisation.

Think of it this way: You can't stop a threat you can't see. Complete visibility is your greatest asset.

***

**How Data Onboarding Benefits Your Business & SOC**

Providing comprehensive data doesn't just help our system—it directly enhances your security team's efficiency and effectiveness, delivering a faster return on your investment.

| **If You Onboard...**                                    | **Your SIEM Gains...**                                                      | **Your SOC Team Gains The Power To...**                                                                                     |
| -------------------------------------------------------- | --------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| **Firewalls & Proxies**                                  | Network context, policy violation alerts, and east-west traffic visibility. | **Answer:** "What internal system is trying to talk to a malicious domain?" and block it at the source.                     |
| **Endpoint Data (EDR/Agents)**                           | Process creation, file changes, and user activity on critical assets.       | **Answer:** "What happened on this server before the alert?" and reconstruct the attack timeline in minutes, not days.      |
| **Identity Services (e.g., Active Directory, Azure AD)** | User logins, privilege escalations, and group membership changes.           | **Answer:** "Was this a legitimate user or a compromised account?" and stop credential-based attacks immediately.           |
| **Cloud Platforms (AWS, Azure, GCP)**                    | Configuration changes, API calls, and security group modifications.         | **Answer:** "Did someone just change a security group to expose our database?" and reverse malicious changes automatically. |
| **Network Sensors (NDR)**                                | Deep protocol analysis and decoded traffic for every connection.            | **Answer:** "What data was exfiltrated and where did it go?" with definitive proof for incident reports.                    |
| **Vulnerability Scanners**                               | A live map of software weaknesses and misconfigurations.                    | **Prioritize patching** on the most exploitable vulnerabilities that are actively being targeted.                           |


# Platform Components

It's an all-in-one SecOps platform with a built-in enterprise-grade SIEM and 50+ integrated bespoke tools such as NDR, CIS benchmarking, dark web monitoring and EASM.

The goal is to provide complete visibility across the network, endpoints, and cloud environments through automated data collection and correlation while achieving at least 80% environment coverage.

Advanced AI capabilities assist with threat detection, automate triage and enable natural language interactions for faster investigations. The integrated SOAR engine executes automated response actions like endpoint isolation and account locking directly from alerts.

Outcome is a continuous compliance monitoring with real-time dashboards and automated reporting for major frameworks.

The platform offers both fully-managed SOC services and self-service options to match your operational needs. All tools are delivered through a unified interface that eliminates tool sprawl and reduces operational overhead.

Built-in threat intelligence enriches every alert with context from global feeds and dark web sources. Deployment options include SaaS, hybrid, and on-premises configurations to meet various requirements. This approach ensures enterprise-grade security that's accessible to organisations of any size or maturity level.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-8f68e3fb9affd1aecbd8d6665abd8e70a498732d%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-3340f68616ed3dada3d14b12fea00de900548e74%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>


# Next-Generation SIEM

#### **AI-Powered SIEM: The Intelligent Core of Your Security Operations**

The SIEM (Security Information and Event Management) is the central nervous system of your security infrastructure, powered by advanced AI to provide deep visibility, automated correlation, and intelligent analysis across your entire digital environment. It goes beyond traditional log collection by transforming raw data into actionable insights, enabling proactive threat detection, rapid investigation, and automated response—all within a single, scalable platform.

***

**Key Features & Benefits**

**1. Unified Data Ingestion and Correlation**

* Collects and normalizes data from every source—cloud, on-prem, network, endpoints, applications, and identity systems—into a single, cohesive data lake.
* AI-driven correlation engine automatically links related events across sources to identify multi-stage attacks that isolated tools would miss.
* **Benefit:** Eliminate visibility gaps and silos, providing a holistic view of your security posture and threats.

**2. Real-Time Alerting with AI Prioritization**

* Applies machine learning to analyze alert context, severity, and relevance, automatically suppressing false positives and prioritizing genuine threats.
* **Benefit:** Reduce alert fatigue by up to 70% and ensure analysts focus only on high-risk incidents.

**3. Automated Threat Detection and Hunting**

* Leverages built-in rules, behavioral analytics, and threat intelligence to detect known and unknown threats in real time.
* Proactively hunts for indicators of compromise (IOCs) and anomalous patterns across historical and live data.
* **Benefit:** Stay ahead of attackers by identifying threats before they cause damage.

**4. Seamless Integration with SecOps Tools**

* Natively integrates with EDR, NDR, vulnerability scanners, ticketing systems (e.g., Jira, ServiceNow), and communication tools (e.g., Slack, Teams).
* **Benefit:** Orchestrate and automate response actions without switching contexts or platforms.

**5. Scalable and compliant Data Management**

* Stores and indexes data for fast retrieval, with customizable retention policies to meet regulatory requirements (e.g., GDPR, HIPAA, ISO 27001).
* **Benefit:** Ensure audit readiness and long-term forensic capabilities without infrastructure overhead.

***

**Use Cases**

* **SOC Teams:** Detect, investigate, and respond to threats rapidly with centralized visibility and AI-assisted analysis.
* **Compliance Officers:** Generate detailed reports for audits and demonstrate adherence to security frameworks.
* IT Administrators: Troubleshoot system issues, monitor user activity, and maintain operational health.
* **Executives:** Gain high-level insights into organizational risk and security performance via dashboards and summaries.

***

**How It Works**

1. **Collect:** Ingest logs and events from all data sources across your environment.
2. **Normalize:** Standardize data into a common format for consistent analysis.
3. **Correlate:** AI engine identifies patterns and links events to uncover threats.
4. **Alert:** Generate prioritized alerts with context and recommended actions.
5. **Act:** Automate responses or empower analysts to resolve incidents quickly.
6. **Retain:** Store data for compliance, hunting, and retrospective analysis.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-e7faea021b2bffc2f055a2c2af5fe59494008d44%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-a38c573bda94861cf37e22cb1d8aeed92d682f5d%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-396bf585427ec763fb38d418ca130c8ac7f5a38b%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>


# Endpoint Agent

ThreatDefence’s DFIR Endpoint Agent provides deep, real-time visibility into endpoint activity, delivering the critical data needed for rapid detection, investigation, and response. Deployed on critical assets, this lightweight agent captures comprehensive system behavior, enabling security teams to quickly uncover malicious activity, understand attack scope, and take decisive action.

**Business Benefits:**

1. **Accelerates Threat Investigation and Response,** by providing immediate, granular visibility into endpoint activity, reducing mean time to detect (MTTD) and mean time to respond (MTTR).
2. **Enables Proactive Threat Hunting,** by offering a rich dataset of historical and real-time endpoint events, empowering analysts to uncover hidden threats.
3. **Delivers Comprehensive Forensic Evidence,** maintaining a detailed, tamper-resistant record of all system activity for post-incident analysis, regulatory compliance, and legal proceedings.
4. **Strengthens Zero-Trust Security Posture,** by continuously monitoring and validating endpoint integrity, enabling immediate enforcement actions when malicious activity is detected.
5. **Simplifies Security Operations,** by unifying endpoint monitoring, investigation, and response within a single agent and console, reducing tool sprawl and operational overhead.

***

**How It Works: Deep Endpoint Visibility**

1. **Lightweight Data Collection:** The agent silently monitors endpoint activity with minimal performance impact, capturing process creation, network connections, file changes, registry modifications, and authentication events.
2. **Real-Time Analysis:** Correlates endpoint events with other security data (e.g., network, cloud) to provide context and identify threats.
3. **Automated Response:** Integrates with SOAR playbooks to automatically contain threats, such as isolating endpoints or terminating malicious processes.
4. **Centralized Management:** All endpoint data is streamed to the ThreatDefence platform for unified analysis, reporting, and action.

***

**What It Captures**

* Process execution and parent-child relationships
* Network connections (inbound and outbound)
* File creation, modification, and deletion
* Registry changes and system configuration modifications
* User logins and authentication events
* DLL loading and module interactions

***

**Use Cases**

* **Ransomware Detection:** Identify encryption activity and terminate malicious processes before critical data is compromised.
* **Insider Threat Investigation:** Monitor user actions to detect data theft, policy violations, or unauthorized access.
* **Incident Response:** Conduct forensic analysis to determine attack origin, scope, and impact.
* **Compliance Auditing:** Generate detailed reports of endpoint activity for regulatory requirements (e.g., PCI DSS, HIPAA).
* **Threat Hunting:** Proactively search for indicators of compromise (IOCs) and advanced persistent threats (APTs).

***

**Why It Matters**

Endpoints are a primary target for attackers, yet many organizations lack the visibility needed to detect and respond to threats quickly. ThreatDefence’s DFIR Endpoint Agent closes this gap by providing deep, continuous insight into endpoint activity. This ensures your team can identify malicious behavior, respond with precision, and maintain a robust security posture across your entire environment.


# Network Sensors(NDR)

Complete Internal Network Visibility, Threat Detection, and Automated Response

ThreatDefence's Network Detection and Response (NDR) module provides deep, continuous monitoring of all internal network traffic, delivering real-time threat detection and automated response capabilities. By analyzing east-west and north-south traffic patterns, our NDR identifies malicious activity that other security tools miss from lateral movement and data exfiltration to zero-day attacks and compromised devices, giving you complete visibility into what's happening inside your network.

**How It Works: Continuous Network Protection**

**Passive Traffic Analysis:** Our sensors passively monitor all network traffic through SPAN ports or network taps, providing full visibility without impacting network performance or requiring agent installation.

**Behavioral Analytics:** Advanced machine learning establishes normal behavior baselines for every device and user on your network, immediately flagging anomalies and suspicious patterns that indicate potential threats.

**Protocol Analysis:** Deep packet inspection decodes and analyzes dozens of common protocols (HTTP, DNS, SSL/TLS, RDP, SMB) to identify malicious activity hidden within legitimate traffic.

**Automated Response:** Integrated SOAR playbooks enable immediate containment actions, such as blocking malicious IPs, isolating compromised devices, or disabling suspicious user accounts directly from alerts.

***

**Key Benefits**

* **Agentless Deployment** Gain immediate visibility without installing software on endpoints. Our sensors connect seamlessly to existing network infrastructure.
* **Complete Internal Visibility** Monitor all network traffic, including unmanaged IoT devices, operational technology, and shadow IT that other security tools can't see.
* **Advanced Threat Detection** Identify sophisticated attacks that bypass traditional security tools, including insider threats, lateral movement, and data exfiltration.
* **Encrypted Traffic Analysis** Gain insights into encrypted communications without decryption, identifying malicious patterns in SSL/TLS traffic through certificate and behavioral analysis.

***

**What It Detects**

* Lateral movement and unauthorized access attempts between internal systems
* Data exfiltration and unusual data transfers to external destinations
* Command and control (C2) communications and beaconing activity
* Ransomware and malware propagation across the network
* Suspicious protocol usage and policy violations
* Compromised devices and insider threat activity

***

**Use Cases**

**Ransomware Containment:** Detect and automatically contain ransomware spread by isolating infected endpoints before encryption begins.

**Insider Threat Detection:** Identify unauthorized data access and exfiltration attempts by malicious insiders or compromised accounts.

**Incident Investigation:** Conduct comprehensive forensic analysis using full packet capture and flow data to understand attack scope and impact.

**IoT and OT Security:** Monitor and secure unmanaged devices, industrial control systems, and operational technology that can't run traditional security agents.

**Compliance Auditing:** Generate detailed network activity reports for regulatory requirements like PCI DSS, HIPAA, and NIST frameworks.

***

**Why It Matters**

Traditional security tools focus on perimeter defense and known threats, leaving your internal network vulnerable to sophisticated attacks that have bypassed initial defenses. ThreatDefence NDR provides the critical internal visibility needed to detect, investigate, and respond to threats operating inside your environment. By combining behavioral analytics, automated response, and comprehensive network monitoring, we ensure you can identify and stop attacks that would otherwise remain undetected for months.

**See everything happening inside your network and stop threats before they cause damage.**

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-3c44e6a4ed332ebd41f6bbcbff168d016d358dab%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-7403abb2ee6d89c0bb96011aa7728010f0ffabbc%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>


# Attack Surface Management

**Fully Automated Discovery, Mapping, and Risk Analysis**

ThreatDefence’s External Attack Surface Management (EASM) module provides continuous, automated discovery and analysis of your internet-facing assets, without requiring any input, configuration, or effort from your team. From forgotten cloud buckets and exposed APIs to unknown subsidiaries and third-party risk, our EASM delivers a real-time, always-updated view of what attackers can see and exploit.

***

**How It Works: Fully Autonomous Protection**

1. **Autonomous Discovery:**\
   Our system automatically identifies all assets tied to your organization, domains, subdomains, IP blocks, cloud instances, web applications, and exposed services, using advanced reconnaissance and correlation techniques.
2. **Continuous Monitoring:**\
   Your external footprint is continuously rescanned for changes, such as new services, misconfigurations, or unknown assets appearing online.
3. **Risk Prioritization:**\
   Each asset is analyzed for vulnerabilities, misconfigurations, and exposure context. Risks are scored based on severity, exploitability, and business impact.
4. **Actionable Insights:**\
   Findings are delivered clearly and concisely within the ThreatDefence portal, with guided steps for remediation and built-in ticketing for easy assignment.

***

**Key Benefits**

* **Zero Effort Required**\
  No setup, no configuration, no maintenance. The EASM module begins delivering value from day one.
* **Complete Visibility**\
  See all internet-facing assets, even ones you didn’t know existed, like shadow IT, legacy systems, or misconfigured cloud storage.
* **Proactive Risk Reduction**\
  Identify and remediate high-risk exposures, open ports, outdated software, weak certificates, before attackers can exploit them.
* **Third-Party and Supply Chain Monitoring**\
  Gain visibility into the external footprint of your vendors and partners, highlighting risks that could impact your organization.

***

**What It Finds**

* Unknown or unmanaged domains and subdomains
* Exposed databases, storage buckets, and backup servers
* Outdated software and vulnerable services
* Misconfigured APIs, authentication endpoints, and cloud services
* Expired or weak SSL/TLS certificates
* Open ports and services (e.g., RDP, SMB, SSH) accessible from the internet
* Leaked credentials or sensitive data publicly exposed

Some example findings of imminent risks:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-41963c35e92b0662f11b6c4dccd0ccf123402a46%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

* A contractor saved a configuration file containing AWS API secrets and active Gmail credentials in a temporary folder on an internet-exposed asset. The security module detected the exposure and alerted within minutes;
* Open to the internet SQL admin portal such as phmyadmin;
* Azure subdomain takeover;
* SQL backups saved on internet exposed servers.

***

**Use Cases**

* **Preventing Data Breaches:** Find and secure exposed storage and databases before they are discovered and exploited.
* **Avoiding Compliance Violations:** Identify publicly accessible assets containing sensitive or regulated data.
* **Mergers & Acquisitions Due Diligence:** Quickly assess the external security posture of acquired companies or partners.
* **Continuous Pentest Readiness:** Maintain a hardened external footprint between formal penetration tests.

***

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-9d4de725618879710341680d10e7b5f1cf4e26ee%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

**Why It Matters**

Traditional security tools only protect what you know about. ThreatDefence EASM finds what you don’t. By automatically discovering, classifying, and evaluating every internet-facing asset, we help you eliminate blind spots, reduce your attack surface, and stay ahead of attackers, with no manual effort required.


# Brand Impersonation (DNS)

Domain Protection & Phishing Prevention

#### **Domain Protection & Phishing Prevention**

The LookAlike domain module proactively defends your organization against brand impersonation and phishing attacks by identifying and neutralizing malicious lookalike domains before they can be used against your employees or customers. Using advanced AI algorithms, the system continuously monitors domain registrations worldwide to detect potential threats targeting your digital identity, providing a critical layer of defense against one of the most common attack vectors.

**Business Benefits:**

1. **Prevents Phishing Attacks** by identifying malicious domains before they're used in campaigns targeting your organization.
2. **Protects Brand Reputation** by quickly detecting and removing impersonating domains that damage customer trust.
3. **Reduces Financial Risk** associated with business email compromise, credential theft, and fraud originating from lookalike domains.
4. **Saves Manual Effort** by automating the tedious process of monitoring domain registrations across global registries.
5. **Enhances Security Posture** by addressing a critical attack vector that traditional security tools often miss.

***

**How It Works: Proactive Domain Monitoring**

1. **AI-Powered Domain Generation:** Advanced algorithms automatically generate hundreds of potential lookalike domains based on your corporate domains, considering common impersonation techniques like character substitution, typosquatting, and different TLDs.
2. **Global Domain Registry Scanning:** The system continuously scans global domain registries in real-time to identify which of the generated lookalike domains have been registered.
3. **Threat Scoring & Analysis:** Each detected domain is analyzed and scored based on factors like registration date, registrar reputation, and similarity to your legitimate domains.
4. **Automated Takedown Proposals:** For high-risk domains, the system automatically generates takedown requests and provides you with the necessary evidence and procedures to initiate removal.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-3484e61f16229b9bb8a2a498c80165ae3d14479a%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

***

**What It Discovers**

* Typosquatting domains (e.g., your-comapny.com instead of your-company.com)
* Character substitution domains (e.g., your-company.com with zero instead of 'o')
* Different TLD variations (e.g., .net, .org instead of your .com domain)
* International domain name (IDN) homograph attacks
* Recently registered domains targeting your brand
* Domains using your brand name with additional words (e.g., yourcompany-login.com)

***

**Use Cases**

* **Proactive Phishing Defense:** Identify and neutralize malicious domains before phishing campaigns are launched.
* **Brand Protection:** Protect your organization's reputation by quickly removing impersonating domains.
* **Merger & Acquisition Security:** Extend domain monitoring to newly acquired companies and subsidiaries.
* **Executive Protection:** Special monitoring for domains targeting key executives and leadership.
* **Compliance Requirements:** Demonstrate due diligence in protecting customer data from phishing threats.

***

**Why It Matters**

Phishing remains one of the most successful attack methods because it exploits human psychology rather than technical vulnerabilities. Traditional security tools can only react after an attack begins, but ThreatDefence's Domain Protection takes a proactive approach by identifying threats at the source—before they're ever used in attacks. By automatically detecting lookalike domains and streamlining the takedown process, we help you stay ahead of attackers and protect what matters most: your people, your data, and your reputation.

**Stop phishing attacks before they start by protecting your digital identity at the domain level.**


# SIEM Integrations

## API Integrations (TD API)

ThreatDefence SecOps Platform simplifies the complex task of managing security threats from various tools by integrating seamlessly with a wide range of external systems. Our platform is designed to ingest security events data and threat detections from third-party tools, making it a central hub for your Security Operations. We support Antivirus, Endpoint Detection and Response (EDR) systems, email and web security gateways, and more.

By leveraging API integrations, ThreatDefence streamlines the process of gathering and analyzing security data from various sources. This approach not only enhances the efficiency of security operations but also significantly improves the ability to detect and respond to sophisticated cyber threats.

Some examples of popular API integrations include AWS, Azure EventHub, CrowdStrike, Microsoft Defender and SentinelOne.

***

## Syslog Integrations (TD Syslog)

We also support ingestion of standard syslog logs (firewalls, etc.)

All you need to do is set up a small virtual sensor within your environment. The sensor can aggregate syslog logs from multiple sources, and ship them to us is a secure and reliable way. The same sensor can be used to gather logs from multiple devices, or even from different customers or deployments.

***

## Microsoft Entra ID / 365 Monitoring

As part of our SecOps product suite we support Microsoft 365 monitoring capability.

A major benefit is its compatibility across all Microsoft licensing tiers - we do not require premium P1/P2 licenses as a prerequisite for our solution to work.

Our platform offers comprehensive monitoring of user login sessions, activities on SharePoint and OneDrive, as well as Exchange Online events, among others. This allows for a detailed oversight of user interactions and system changes within the 365 environment.

Furthermore, we have incorporated a suite of predefined use cases and correlations designed to streamline the threat detection process within the MS 365 suite. This feature simplifies identifying potential security issues, making it easier for organizations to maintain a secure and efficient operational posture.

***


# Analyst Console

The Analyst Console is the main SIEM interface available to all eligible subscriptions. Tailored for security analysts, threat hunters, and incident responders, It provides access to your entire array of security event data and features a variety of dashboards and visualizations.

To access the console, navigate to [https://console.threatdefence.io](https://console.threatdefence.io/) and log in with your email and password.

Here are some examples of the information available via the Analyst Console:

* **Real-Time Threat Monitoring**: Observe live data streams of security events across your network, enabling immediate identification and investigation of suspicious activities.
* **Incident Management**: Track and manage security alerts and incidents from detection through resolution. This includes the ability to assign incidents, document response actions, and close incidents upon resolution.
* **Advanced Analytics**: Utilize sophisticated analytics tools to dissect and analyze security events. This can help identify trends, patterns, and anomalies within your security data, facilitating proactive threat hunting.
* **Dashboards**: Access dashboards that provide a detailed insights into your security events and posture. These dashboards can be tailored to highlight key metrics and data points relevant to your specific security concerns.
* **Search and Investigation Tools**: Employ powerful search capabilities and investigation tools to delve into historical security data. This enabled in-depth analysis of historical events and helps uncover the root cause of security breaches.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-9cb5d4222afff52caaacd0350b17b85987ffc060%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>


# Customer Portal

Our Customer portal is crafted to provide you with real-time and historical reports on your Security Operations, encompassing detections, actions executed by the SOC team, escalations, open security incidents, and threat notifications.

To access the portal, simply navigate to [https://portal.threatdefence.io](https://portal.threatdefence.io/) and log in with your email and password.

Here are some examples of the information available via the Customer Portal:

* **Real-time Alerts**: Immediate notifications about potential threats detected within your environment.
* **Incident Reports**: Detailed analyses of confirmed security incidents, including detected threats, affected systems, and remediation steps.
* **SOC Team Activities**: Logs of actions taken by the Security Operations Center team in response to detected threats and security incidents.
* **Escalation Tracking**: Information on the escalation process for high-severity incidents, including timelines and response strategies.
* **Management Reports**: Periodic reports detailing your organization's security posture and metrics.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-031735b32145d658bdaab1a9af58f5d5dbea86ec%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-f9388cfce499272ce719f9336eaaca3fb4ec83e0%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-f462eff9bc05787feaa9d09b710f374d6b791ba2%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>


# SecOps AI


# AI Alert Escalator

*Automated Alert Correlation & Escalation System*

It enhances SOC efficiency by automatically filtering, correlating and escalating only high-confidence security incidents. This workflow analyses alert patterns, removes noise and duplicates and surfaces genuine multi-stage attacks, enabling security teams to focus exclusively on meaningful threats that require human intervention.

**Business Benefits:**<br>

* **Eliminates Alert Fatigue & Noise:** Filters out 80%+ of non-critical alerts and false positives by correlating events and applying intelligent thresholds, allowing analysts to focus on real threats.
* **Accelerates Threat Detection:** Identifies sophisticated multi-stage attack chains that single alerts might miss, reducing mean time to detect (MTTD) by 65% through automated correlation.
* **Prevents Duplicate Work & Maintains Context:** Automatically checks for existing incidents and enriches ongoing investigations with related alerts, eliminating redundant tickets and preserving full attack chain visibility.
* **Enables Consistent, Objective Escalation:** Uses AI-powered confidence scoring to make escalation decisions data-driven and consistent, removing human bias and variability.
* **Scales Security Operations Efficiently:** Handles the initial correlation and prioritisation of thousands of daily alerts, allowing human analysts to concentrate on high-value investigation and response activities.

**How It Works: Intelligent Correlation & Escalation**

* **Continuous Alert Collection & Normalization:** Every 10 minutes, the system aggregates alerts from all sources and extracts key fields (timestamp, entity, alert type, attack stage), standardizing data for analysis.
* **Multi-Tenant Segmentation & Temporal Correlation:** Alerts are grouped by customer for data isolation, then analyzed for clusters occurring in close succession. Only groups with 3+ related alerts proceed.
* **AI-Powered Pattern Recognition:** Evaluates clusters for multi-stage attack patterns, requiring distinct stages that affect the same entity with logical progression.
* **Confidence-Based Decision Making:** Each potential incident receives a score and is escalated as a confirmed threat.
* **Incident Management & Notification:** High-confidence cases create or enrich existing incidents, then generate clear, actionable notifications to designated communication channels.

**Use Cases:**

* **High-Volume SOC Environments:** Manages alert storms by automatically surfacing only correlated, high-confidence incidents.
* **Managed Security Service Providers (MSSPs):** Maintains strict tenant separation while efficiently prioritizing threats across multiple customers.
* **Resource-Constrained Security Teams:** Acts as a force multiplier by handling initial correlation and filtering.
* **Complex Attack Investigations:** Identifies and connects related alerts that span multiple systems and timeframes.
* **Compliance & Reporting:** Provides auditable, data-driven records of escalation decisions and threat patterns.

**Why It Matters**\
Modern security environments generate overwhelming alert volumes, causing critical threats to be lost in the noise while teams waste time on false positives and duplicates. This workflow solves this by applying intelligent correlation, pattern recognition and confidence-based scoring to ensure that every analyst’s attention is directed toward genuine, multi-stage attacks. This transforms alert management from reactive triage into proactive threat intelligence, ensuring faster, more accurate responses to the attacks that truly matter.

<div align="center"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-677bd44c544e53588a2153ec0b750bed236de7a1%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure></div>


# AI Analyst

ThreatDefence’s AI Analyst serves as your automated security operations specialist, working 24/7 to monitor, analyze, and respond to threats across your entire digital environment. By combining advanced machine learning with deep security expertise, it provides continuous protection, reduces operational workload, and enhances your team’s ability to detect and neutralize sophisticated attacks.

**Business Benefits:**

1. **Provides 24/7 security coverage** without human intervention, ensuring continuous threat monitoring and response regardless of time or staffing.
2. **Reduces operational costs** by automating routine analysis and response tasks, allowing your team to focus on strategic initiatives.
3. **Improves detection accuracy** through advanced behavioral analysis and correlation across multiple data sources, minimizing false positives.
4. **Accelerates incident response** by automatically executing pre-approved containment actions within seconds of threat detection.
5. **Enhances security consistency** by applying standardized analysis and response procedures across all alerts and incidents.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-d4a1214befe9d1e3f1023ff28023f275fe54f13b%2Funknown.png?alt=media" alt=""><figcaption></figcaption></figure>

***

**How It Works: Automated Security Operations**

1. **Continuous Monitoring:** Analyzes incoming security data from all integrated sources (SIEM, EDR, network, cloud) in real-time.
2. **Intelligent Correlation:** Connects related events across systems and time to identify complex attack patterns that might escape manual detection.
3. **Automated Triage:** Evaluates and prioritizes alerts based on severity, context, and potential business impact.
4. **Instant Response:** Executes pre-approved playbooks for containment, notification, and remediation without human intervention.

***

**What It Delivers**

* Real-time threat detection and alerting
* Automated incident investigation and evidence collection
* Immediate containment actions for critical threats
* Detailed incident summaries with root cause analysis
* Continuous learning and adaptation to new threat patterns

***

**Use Cases**

* **24/7 Security Operations:** Maintain continuous protection outside business hours and during staffing gaps.
* **High-Volume Alert Processing:** Manage large alert volumes without additional human resources.
* **Rapid Threat Response:** Automatically contain threats like ransomware or compromised accounts within seconds.
* **Threat Hunting Support:** Identify subtle attack patterns through continuous analysis of historical and real-time data.
* **Compliance Reporting:** Generate detailed security reports and maintain audit trails automatically.

***

**Why It Matters**

Traditional security operations struggle with alert volume, staffing limitations, and the need for continuous coverage. ThreatDefence's AI Analyst addresses these challenges by providing an always-available, consistently accurate security expert that never fatigues. This ensures that your organization maintains enterprise-grade security protection regardless of team size, time constraints, or evolving threat landscapes, ultimately providing stronger protection at lower operational cost.


# AI Triage Assistant

ThreatDefence’s AI Triage Assistant enhances analyst efficiency by providing instant, AI-powered context and recommendations for every security alert. This integrated tool automatically summarizes complex threats in plain language, prioritizes risks based on real-time analysis, and suggests next-step actions, enabling faster and more accurate decision-making across the security team.

**Business Benefits:**

1. **Reduces alert fatigue and mental overload** by distilling complex security events into clear, concise summaries with actionable recommendations.
2. **Accelerates mean time to respond (MTTR)** by providing analysts with immediate context and guided next steps, minimizing investigation time.
3. **Improves consistency and accuracy** in response actions by offering data-driven recommendations that reduce human error.
4. **Enables junior analysts to perform at a senior level** by providing expert-level insights and guidance directly within the workflow.
5. **Scales security operations efficiently** by handling initial alert assessment, allowing human analysts to focus on critical threats and complex investigations.

***

**How It Works: Intelligent Alert Enrichment**

1. **Real-Time Alert Analysis:** As alerts are generated, the AI Assistant immediately evaluates them against historical data, current threat intelligence, and behavioral baselines.
2. **Plain-Language Summarization:** Translates technical alert details into concise, business-friendly explanations that highlight the what, why, and so what of each event.
3. **Contextual Enrichment:** Correlates the alert with related activity across endpoints, users, and networks to provide a comprehensive view of the threat.
4. **Actionable Recommendations:** Suggests specific next steps, such as escalating, dismissing, or launching an automated response playbook.

***

**What It Provides**

* Clear, concise alert explanations in plain language
* Confidence scoring indicating likelihood of true positive
* Related events and contextual evidence from across the environment
* Specific recommended actions with direct integration to response tools
* One-click access to deeper investigation through Hunt functionality

***

**Use Cases**

* **Rapid Alert Assessment:** Junior analysts can quickly understand and action alerts without senior intervention
* **Complex Threat Analysis:** Senior analysts receive enriched context to accelerate investigation of sophisticated attacks
* **Shift Handovers:** Consistent alert understanding and documentation across team rotations
* **Training and Development:** New team members learn threat patterns and response protocols through AI-guided examples
* **High-Volume Periods:** Maintain response quality and speed during alert storms or limited staffing

***

**Why It Matters**

The increasing volume and complexity of security alerts often overwhelms even experienced analysts, leading to delayed responses and missed threats. ThreatDefence's AI Triage Assistant addresses this challenge by providing instant expertise and context for every alert, ensuring consistent evaluation and appropriate response regardless of analyst experience level or workload pressures. This transforms alert triage from a manual, time-intensive process into an efficient, AI-guided workflow that enhances both speed and accuracy across your security operations.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-f6d4de835129d7d73b83adbb60056d904e438227%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>


# AI Chatbot

#### **AI Chatbot for Security Operations**

ThreatDefence’s AI Chatbot transforms how your team interacts with security data by providing a natural language interface for real-time investigation, threat hunting, and response. Accessible directly within the platform, it allows users to ask questions in plain English and receive instant, actionable answers, turning complex data analysis into a simple conversation and dramatically accelerating security operations.

**Business Benefits:**

1. **Democratizes Security Data,** enabling non-technical stakeholders to gain insights and perform investigations without writing complex queries or relying on specialized analysts.
2. **Accelerates Investigation and Response,** by providing immediate answers to critical security questions, reducing mean time to detect (MTTD) and mean time to respond (MTTR).
3. **Enables Proactive Threat Hunting,** by allowing users to easily explore data, ask iterative questions, and uncover hidden threats that may evade automated detection.
4. **Improves Operational Efficiency,** by automating routine queries, report generation, and data retrieval, freeing security staff to focus on high-value tasks.
5. **Enhances Collaboration and Training,** by providing an intuitive interface that helps junior analysts perform at a senior level and facilitates knowledge sharing across teams.

***

**How It Works: Conversational Security Intelligence**

1. **Natural Language Processing (NLP):** Interprets user questions in plain English, such as “Show me all failed logins for the CEO in the last 48 hours.”
2. **Real-Time Data Querying:** Executes complex searches across integrated data sources (SIEM, EDR, cloud, network) to retrieve relevant information.
3. **Contextual Understanding:** Recognizes intent, entities, and relationships to provide accurate, context-aware responses.
4. **Action Integration:** Allows users to execute response actions, such as isolating endpoints or escalating incidents, directly through chat commands.

***

**What It Can Do**

* Answer questions about alerts, incidents, and security posture
* Generate custom reports on demand (e.g., “Give me a weekly threat summary”)
* Initiate threat hunts based on natural language prompts
* Provide guidance on next steps for investigation or response
* Execute pre-approved actions via integrated SOAR playbooks

***

**Use Cases**

* **Executive Reporting:** Enable leaders to ask high-level questions about risk posture, incident trends, or compliance status without technical jargon.
* **Alert Triage:** Allow analysts to quickly gather context around an alert by asking, “What else did this user do today?”
* **Threat Hunting:** Empower hunters to explore data conversationally, e.g., “Find all machines that contacted this malicious domain.”
* **Incident Response:** Speed up investigations with commands like, “Isolate this endpoint and block the associated IP address.”
* **Training and Onboarding:** Help new analysts learn the environment by allowing them to ask questions like, “How do I investigate a phishing alert?”

***

**Why It Matters**

Traditional security tools often require deep technical expertise, creating bottlenecks and slowing down critical response times. ThreatDefence’s AI Chatbot breaks down these barriers by making security data accessible and actionable for everyone, from executives to junior analysts. By enabling natural language interaction with your entire security infrastructure, it ensures faster decisions, smoother collaboration, and a more resilient security posture.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-9300df82d7f5f17b1d2cbbb86869d75177d5093a%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>


# User Management

This article describes how to manage users, and their permissions on the ThreatDefence platform.

## 1. Adding & Editing Users

To add or edit users, login to the customer portal and navigate to "My Tenants" then Click on "Users" as below:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-8baf2a777cde47e1489492bd78f5eb337a9241ea%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Note: You will need be an Admin within your MSP or Tenant, or have the 'IAM Admin' permission assigned to you user, to be able to see and manage other users.
{% endhint %}

To add a new user, click the "ADD" button in the upper right-hand corner, as highlighted below:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-68749dd3c40fb0bd8f8785b777afa3a630be59be%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

After clicking "ADD" you'll be able to enter the required fields to create a user:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-ad91bf0d0aed3105a5ef58a97a797d8a41d4bdae%2Faddnewuser_demo.jpg?alt=media" alt="" width="366"><figcaption></figcaption></figure>

To edit a user, click on the edit icon circled in the image below:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-12e682870b010a12b1937a6fd34c1eec978e3525%2FScreenshot%202025-10-28%20at%201.53.51%E2%80%AFpm.png?alt=media" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
See below for explanations on Demo Data, Admin & User Types.
{% endhint %}

***

## 2. User Roles & Permissions

#### Enabled

The "Enabled" toggle switch controls the state of the users account.

#### Demo Data

The "Enable Demo Data" toggle will allow users access to a demo tenancy called "acme" this contains sanitised data that can be visualised in our console dashboards.

#### Access Level

**Admin:**\
Admins have full access to the MSP/Tenancy (depending on the “User Type” described below)

**SOC:**\
SOC users have access focused on monitoring, incident response, and security-related functions within the environment.

**Analyst:**\
Analysts have access tailored to investigation, triage, and reviewing alerts or logs relevant to security operations.

**Custom:**\
If required for your use case, users can be given access to only specific areas by assigning the below permissions.

#### User Permissions

<table><thead><tr><th width="197.9453125"></th><th>Admin</th><th>SOC</th><th>Analyst</th></tr></thead><tbody><tr><td>App</td><td>Read Write Delete</td><td>Read Write Delete</td><td>Read Write Delete</td></tr><tr><td><p>Alert Center</p><p>(Alert Listing / Triage / Esc)</p></td><td><strong>✓ ✓ ✓</strong></td><td><strong>✓ ✓ ✓</strong></td><td><strong>✓ ✓ ✓</strong></td></tr><tr><td>Portal Report Summaries</td><td><strong>✓ ✓ ✓</strong></td><td><strong>✓ ✓ ✓</strong></td><td><strong>✓ ✓ ✓</strong></td></tr><tr><td><p>ConfigDB</p><p>(Report Scheduling / Notifications)</p></td><td><strong>✓ ✓ ✓</strong></td><td><strong>✓</strong></td><td><strong>✓</strong></td></tr><tr><td>Console / Data Access</td><td><strong>✓</strong></td><td><strong>✓</strong></td><td><strong>✓</strong></td></tr><tr><td>Integration Onboarding / Management</td><td><strong>✓ ✓ ✓</strong></td><td><strong>✓</strong></td><td><strong>✓</strong></td></tr><tr><td>User Isolation</td><td><strong>✓ ✓ ✓</strong></td><td><strong>✓ ✓ ✓</strong></td><td><strong>✓</strong></td></tr><tr><td>NDR</td><td><strong>✓ ✓ ✓</strong></td><td><strong>✓</strong></td><td><strong>✓</strong></td></tr><tr><td>IAM / User and Tenant Management</td><td><strong>✓ ✓ ✓</strong></td><td><strong>✓</strong></td><td><strong>✓</strong></td></tr><tr><td>Endpoint Isolation</td><td><strong>✓ ✓ ✓</strong></td><td><strong>✓ ✓ ✓</strong></td><td><strong>✓</strong></td></tr></tbody></table>

#### User Type

MSP User: An MSP User will have access to all tenants under the MSP, so if your MSP has 3 tenants, an MSP user will be able to access data from all 3 tenants based on their assigned permissions.

Tenant User: A tenant user will only be able to access and manage data for tenants that are explicitly defined against their user. So if an MSP has tenants, X, Y & Z and said user is only defined with access to tenant X, they will not be able to see or manage data from tenants Y & Z

## 3. Resetting Passwords & MFA

To reset a users password or MFA, click on the edit icon for their user and select the relevant option from the "Reset Options"

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-1f2aa359cdb1a16a161410266c62e7ebf125248f%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

***

## Having Trouble?

If you're having any issues with user management, please open a request via the support portal, or email our support email at "<support@threatdefence.com>" and our team will assist you.


# Data Export

Data can be exported from the ThreatDefence platform in two ways. Either as small formatted selections as either CSV JSON from dashboard visualisations, or as large json dumps of raw, optionally filte

### Scoped Exports

From any dashboard, identify the visualisation that holds the data you're looking to export.

Select "Inspect" from the three dots on the top right of the visualisation.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-dca70a37140b901865f80ddd9e8060c6b2188c3d%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Then choose either Download CSV and select either "Formatted CSV" for formatted exports, or "Raw CSV" for unformatted exports.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-f32b8ee445db612139ee47f05daa3dccf26034ff%2FScreenshot%202026-01-19%20at%202.46.46%E2%80%AFPM.png?alt=media" alt=""><figcaption></figcaption></figure>

### Large Exports

In the event of an audit or a requirement for more data than a dashboard offers, an entire index can be exported with an optional filter over the documents.

Access portal.threatdefence.io, and go to "My Tenants > Data Export".

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-cd91b84b238f29a769839fee428b13f509a5bc81%2FScreenshot%202026-01-21%20at%2011.41.10%E2%80%AFAM.png?alt=media" alt=""><figcaption></figcaption></figure>

From this screen, select the index pattern for export from "Select Index", and optionally enter a query into the "Enter DB query" field. Queries can be determined in Console to determine the filtering (e.g. limiting to a single host: `source.ip: 192.168.0.1`).

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-d5fe3e2a98f701303ae21389f6055992877ae1cf%2FScreenshot%202026-01-21%20at%2011.43.07%E2%80%AFAM.png?alt=media" alt=""><figcaption></figcaption></figure>

After the export completes, which may take a while depending on the scale of data selected, the download will be available as a .jsonl.gzip. This file can be opened by most desktop applications that can handle zip files.

***

## Having Trouble?

If you're experiencing any issues with user management, please open a request via the support portal, or email our support email at "<support@threatdefence.com>" and our team will assist you.


# Managing Integrations

This article covers how to add, update & remove integrations from the ThreatDefence Platform.

## 1. Navigating to the Management Page for Integrations

To manage integrations on the ThreatDefence platform, login to the Customer Portal and Navigate to "Deployment" on the left-hand navigation pane, then click on "Integrations"

{% hint style="info" %}
Please note: Your account must have the ability to manage integrations to be able to see this page, contact the administrator of your tenant, or our support team to assist with any access issues.
{% endhint %}

Below is an example of what you would see if you have some integrations deployed:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-af2585f24a1e23a74ed58a1df25ff64fd0799d95%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

***

## 2. Adding an Integration

To add an integration to your tenant, hover over the 'ADD' button in the upper right-hand corner of the page and select your desired integration from the drop-down list:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-2fc9aff1157904f13afe2b6fbfca8dd64432b336%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Specific integration information can be found here in our knowledge base: <https://docs.threatdefence.com/siem-integrations/siem-integrations>
{% endhint %}

***

## 3. Updating an integration

To update or edit an integration, click on the edit icon as below, you will see that any existing values will be censored out as "\*\*\*\*\*", you will need to re-enter all the required values to save your changes.

Edit button shown below:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-017fb88131d9876dec1da534a1e156ded9a471a3%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

After clicking this, you will see a varying amount of input fields based upon how many are required for that integration, for example, below is the Okta integration:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-21dd1a4e6f1233c2f5731c794f62f0039af9ddf3%2Fimage.png?alt=media" alt="" width="375"><figcaption></figcaption></figure>

***

## 4. Removing an integration

To remove an integration on ThreatDefence, click the 'Trash Can' icon on the relevant integration as below:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-d8b3a986c696ece6922fc18d06dd13149ba55e23%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Please note that removing an integration does **NOT** remove your data from the ThreatDefence platform.
{% endhint %}

***

## 5. Having Trouble?

If you're having any issues, don't hesitate to reach out to our support team, you can raise a support request via our Support Portal, or by emailing "<support@threatdefence.com>".


# Public API

ThreatDefence provides a public REST API that allows customers and partners to programmatically access key platform data. This enables seamless integration with external systems, automation workflows, and custom reporting. Support for interactive actions and additional capabilities will be introduced in future releases.

### Authentication

All API requests are authenticated using an API key. Each request must include a valid API key with the appropriate permissions to ensure secure access to ThreatDefence resources.

### API Key Generation

To get started, navigate to API Keys in the ThreatDefence platform and create a new API key with relevant permissions for the target APIs.

Keep your API key secure and avoid sharing it publicly, as it provides access to your tenant’s data.

### Usage

ThreatDefence exposes it's APIs through a number of scoped public endpoints.

#### Alert Center

All alert interactions and lifecycle events, including escalations, notifications, and triage.

Permission Requirements: `Alert Center`

[Swagger docs](https://portal.threatdefence.io/docs/ac/index.html#/)

#### Agent Interactions

Endpoint Agent information and state, including version, last seen, and OS information.

Permission Requirements: `Endpoint Isolation`

[Swagger docs](https://portal.threatdefence.io/docs/agents)

***

## Having Trouble?

If you're having any issues with user management, please open a request via the support portal, or email our support email at "<support@threatdefence.com>" and our team will assist you.


# Data Source Management and Review


# Tenant Inventory

### Overview <a href="#overview" id="overview"></a>

Every tenant within the ThreatDefence SecOps platform relies on a set of onboarded **data sources** to provide security visibility. These data sources feed logs and telemetry into the platform, enabling monitoring, detection, and incident response. They can originate from **ThreatDefence native sensors**, **cloud and SaaS integrations**, or **third-party tools via API and syslog**.

The **Tenant Inventory** view offers a consolidated picture of which sources are active for a tenant (or across multiple tenants for an MSP). This helps security teams confirm coverage, validate integrations, and identify gaps before they impact detection.

Navigating to Tenant Inventory:

1. In the **TD Analyst Console**, click the **hamburger menu** in the top-left corner.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-5897876748f4d1eca9b545cdaafbc7a490fe1e80%2FScreenshot%202026-01-21%20at%203.33.21%E2%80%AFPM.png?alt=media" alt=""><figcaption></figcaption></figure>

2. Select **My SOC** from the menu.

   Under **SOC Interactions and Monitoring**, click **Tenant Inventory**.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-7c61a480eaeb58b59371a09eb03129e9c7a7e443%2FScreenshot%202026-01-21%20at%203.48.42%E2%80%AFPM.png?alt=media" alt=""><figcaption></figcaption></figure>

You should now see this page.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-10327a3cfc40b554f1f59a84bc00eb7a85e96889%2FScreenshot%202026-01-21%20at%204.09.33%E2%80%AFPM.png?alt=media" alt=""><figcaption></figcaption></figure>


# Data Source Monitoring

Navigating to Tenant Inventory:

1. In the **TD Analyst Console**, click the **hamburger menu** in the top-left corner.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-09e84e846351e10856910a5a0c8f2fe879e5987c%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

2. Select **My SOC** from the menu.

Under **SOC Interactions and Monitoring**, click **Data Source Monitoring**.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-df1d11bcde2e2642a17d6ee3f9834d23c14c1a31%2FScreenshot%202026-01-21%20at%204.16.14%E2%80%AFPM.png?alt=media" alt=""><figcaption></figcaption></figure>

You should now see this page.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-52ed9c899f7698413d2427807e7e2c50d7bb4173%2FScreenshot%202026-01-21%20at%204.26.29%E2%80%AFPM.png?alt=media" alt=""><figcaption></figcaption></figure>


# Reporting

PDF and high-level reports are available through the customer portal. Navigate to the Reports section to view and export documents as PDF files.

Please note that custom reports are also supported. If you require a report focused on specific items or metrics, please contact your account manager to discuss your requirements.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-543d576f03f9189387e900bce974c783b2c23f4e%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>


# On Demand Reporting

To generate reports manually:

* Log in to the customer portal
* Choose the report you wish to export
* Select reporting period, or a custom date:

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-9bcb1c7e1c29ce6536c1431067393362c76e8b52%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

* Generate an initial summary with AI. Click **Edit** if you require changes, click **Save**, and then click **Export** to generate a PDF.


# Automated Report Scheduler

Reports can be scheduled to be emailed at regular intervals. To access the report scheduler, please navigate to Customer Portal/My Tenants/Report Scheduling:

* Set the recipient email address in the "To:" section. It is recommended that this be a security distribution group, or you can specify multiple recipients.
* Set the email interval by selecting report names to be emailed under the Weekly or Monthly section and click confirm.
* To disable all report emails, click reset to default or delete the recipients.

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-bf201dbb86bed916987b015c6f99bdca457d2137%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>


# Alerting


# Email Alerts


# Webhook


# PagerDuty


# HaloPSA


# OpsGenie


# SysAid

## Before you start

* You must use your SysAid account credentials and not SSO credentials to generate an access token. You can find them by going to your user profile in SysAid.
* Authentication is **limited to one SysAid account at a time** - the generated access token will only be able to access data from that specific account.

***

## Step 1: Create a SysAid Application Authentication

1. **SysAid Application**
   * A SysAid application is required for the alerter.
     * Please make sure you have a working SysAid application beforehand.
   * Please refer to [SysAid Getting Starter Guide](https://documentation.sysaid.com/docs/getting-started-guide) as needed.
2. **Create application key**
   * Navigate to the Developer Documentation for [SysAid public API](https://developers.sysaid.com/reference)
     * Navigate to [Create Application Key](https://developers.sysaid.com/reference/createapplicationkey) section.
     * Fill in the ***userName*** and ***password*** for your ***SysAid Account Credentials*** and ***applicationName*** of the already created ***SysAid Application***.

       ![SysAid Credentials](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-1148671bf18fe00efbee71b1261ea6d91881b27c%2Fsysaid-image1.png?alt=media)
     * Fill in the ***tokenLifetime*** as necessary, though default (24 Hrs) is sufficient.
     * Make sure to fill the ***Header*** and the ***URL*** with the ***x-sysaid-accountid***, which is your SysAid Account ID.

       ![SysAid Account ID fill in](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-e239c74b891304babe501cb22640618f572efb11%2Fsysaid-image2.png?alt=media)
   * Make sure to note down the response **clientId**, **clientSecret** and the **applicationName** for further use.

     ![Application Authentication Credentials](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-887405a32a9afa35bff0a356a8f8beb225f3c0dc%2Fsysaid-image3.png?alt=media)

***

## Step 2: Gather Service Record Details

1. **Service Record Type - Incidents**
   * The service records of type ***Incidents*** are created with each alert.
   * The default ***Incident*** type Service Record ***Template*** is used, if you need to change that, please note the ***templateId*** need to be used.
   * Please note the following data related to the above ***templateId***,
     * ***requestUser***
     * ***assignedGroup***
     * ***primaryCategory***
     * ***secondaryCategory***
     * ***secondaryCategory***
     * ***thirdLevelCategory***
2. **Alternative Method**
   * Alternatively, you can send an existing Incident type Service Record ***ID*** to be used as the template.

***

## Deliverables

Please email to <support@threatdefence.com>:

1. **Application Credentials**:
   * Please make sure the following credentials are noted in the email.
     * x-sysaid-accountid
     * applicationName
     * clientId
     * clientSecret
2. **Incident Service Record Details**:
   * Please make sure you include the details or a valid service record ID
   * If including the details,
     * requestUser
     * assignedGroup
     * templateId
     * primaryCategory
     * secondaryCategory
     * secondaryCategory
     * thirdLevelCategory
   * If including a valid Incident Service Record ID,
     * The ID of the service record.


# Jira

## Step 1: Generate Credentials

1. **Generate API Token**

   * Go to Atlassian API Token Management
     * Click ***Create Token***
     * Label it (e.g., “Alert Integration”) and copy the token

   ![Create API Token](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-3ed2fc36394ccdd891579570e20528e3a2e23198%2Fjira-image1.jpg?alt=media)

   * Note down the ***admin email address*** and ***Jira base URL*** (e.g., <https://your-domain.atlassian.net>)
2. **Assign Necessary Permission Scopes**

   * Go to ***Select App***
     * Select ***Jira*** app

   ![Select JIRA App](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-376fa6b132f5bdd6fe942618bd2e1d5b070af5de%2Fjira-image2.jpg?alt=media)

   * Go to ***Select Scopes***
     * Select ***write:jira-work***

   ![Assign Permission Scopes](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-b82e5cca54192d3e31c2c547ca395300dbc371fe%2Fjira-image3.jpg?alt=media)

   * Review the settings

***

## Step 2: Define JIRA Issue Ticket Fields

1. **Each alert will be converted into a Jira issue with the following fields**

   | Field        | Description                                                                      |
   | ------------ | -------------------------------------------------------------------------------- |
   | project      | Key or ID of the Jira project (e.g., "OPS", "ALERTS" or "10034", "2000")         |
   | issuetype    | Key or ID of type of issue (e.g., "Bug", "Task", "Incident" or "10040", "10000") |
   | reporter     | Atlassian account ID of the reporter (not email)                                 |
   | labels       | Optional: tags like "automated", "alert", "monitoring"                           |
   | customfields | Optional: map alert metadata to custom Jira fields                               |

   * Please use the following to gather more info about the custom fields, if necessary:
     * [Get custom field IDs for Jira](https://confluence.atlassian.com/jirakb/get-custom-field-ids-for-jira-and-jira-service-management-744522503.html)
     * Please note down the ***Custom Field Name*** and the ***text value*** that should be assigned to the custom field.

***

## Deliverables

Please email the following to <support@threatdefence.com>:

1. **API Credentials**
   * Please make sure the following credentials are noted in the email.
     * JIRA\_EMAIL : admin email address
     * JIRA\_API\_TOKEN : generated API token
     * JIRA\_BASE\_URL : Jira base URL noted above
2. **Jira issue ticket fields**
   * Please note the fields needs to be set for the Jira issue ticket
     * project
     * issuetype
     * reporter
     * labels
     * customfields (names & values)


# Twilio

## Step 1: Twilio Account Setup & Credentials

1. **Create a Twilio Account**

* Visit [Twilio Sign Up](https://www.twilio.com/try-twilio) and register.
* Verify your email and log in to the Twilio Console.
  * Purchase a suitable plan and a **Twilio phone number**.

2. **Obtain API Credentials**

* In the Twilio Console, find your **Account SID** and **Auth Token** under Account Info.

  ![Obtain API Credentials](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-73d2cd4ab4370a3c7c3b6e659ccdd2a6fe7a6e72%2Ftwilio-image1.png?alt=media)
* Purchase a Twilio phone number for outbound calls.

***

## Step 2: Information Needed for Outbound Call Alerts

Provide the following details to enable automated outbound call alerts:

| **Field**    | **Description**                                         | **Example**                |
| ------------ | ------------------------------------------------------- | -------------------------- |
| Account SID  | Your Twilio Account SID                                 | `ACxx`                     |
| Auth Token   | Your Twilio Auth Token                                  | `xx`                       |
| Phone Number | Twilio phone number used for outbound calls             | `+1234567890`              |
| Recipients   | Comma-separated list of phone numbers to receive alerts | `+1987654321, +1098765432` |
| Message Text | Custom message to be delivered during the call          | `Alert: Action Required`   |

***

## Deliverables

Please email the to <support@threatdefence.com>:

1. **Twilio Credentials**

* Account SID
* Auth Token
* Twilio Phone Number

2. **Alert Configuration**

* Recipients
* Message Text
* Enabled
* Time Window
* Severity

***


# MSP Management

MSP Defaults

Tenant Management


# Prerequisites

## Network and System Requirements

The ThreatDefence agent requires outbound connectivity to several hosts over **TCP port 443**. These connectivity requirements are detailed in the **Customer Portal**.

***

## Supported Platforms

* **Processor**: x86\_64 processor and operating system.

***

## Supported Operating Systems

#### Windows

* Windows 11
* Windows 10
* Windows Server 2016
* Windows Server 2019
* Windows Server 2022
* Windows Server 2025.

#### Linux

* Debian 11 or later
* Ubuntu 18.04 or later
* Red Hat Enterprise Linux (RHEL) 7 or later
* Oracle Linux 7 or later
* Amazon Linux 2 or later
* SUSE Linux Enterprise Server (SLES) 15.3 or later.

#### MacOS

* macOS 13 (Ventura) or later.


# Installation Guides


# Mac OS MDM

## TD Endpoint Agent for macOS — MDM Deployment

Deploy the TD Endpoint Agent to macOS devices via any MDM using two configuration profiles and one install script.

### Artifacts

<table><thead><tr><th width="401.99609375">Artifact</th><th>Delivered via</th><th>Purpose</th></tr></thead><tbody><tr><td><p><code>TDAgent-FDA-PPPC.mobileconfig</code></p><div data-gb-custom-block data-tag="file" data-src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-fcc8becb817270b567ba0d01d98fc27b142e991e%2FTDAgent-FDA-PPPC.mobileconfig?alt=media"></div></td><td>MDM custom profile</td><td>Full Disk Access for the agent</td></tr><tr><td><p><code>TDAgent-ActivationCode.mobileconfig</code></p><div data-gb-custom-block data-tag="file" data-src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-5eebba3e367e8bc2f961eb26a4828d367072e5b7%2FTDAgent-ActivationCode.mobileconfig?alt=media"></div></td><td>MDM custom profile</td><td>Activation code as a managed preference</td></tr><tr><td><code>TD_Endpoint_MacOS_Silicon.dmg</code></td><td>Script / command</td><td>Installer app</td></tr></tbody></table>

### Order

1. Push the FDA profile.
2. Push the activation-code profile. **Important:** before uploading, open `TDAgent-ActivationCode.mobileconfig` in a text editor and replace `REPLACE_WITH_ACTIVATION_CODE` with the tenant's activation code.
3. Run the install script.

Confirm both profiles landed (`sudo profiles show`) before installing. No profile

* no code passed to the script = installer exits `2`.

### Install script

MDM stages the DMG on the device; script mounts, installs, copies the app to `/Applications`, cleans up. Set `DMG` to the staged path.

```bash
#!/bin/bash
# Run as root.
set -uo pipefail

DMG="/tmp/TD_Endpoint_MacOS_Silicon.dmg"   # match the MDM's file destination
ACTIVATION_CODE=""   # empty -> uses the managed-preference profile
AUTO_UPDATE=""       # "no" to disable auto-update; empty = enabled

if [ -x /opt/TDAgent/tdcli/tdcli.bin ]; then
    /opt/TDAgent/tdcli/tdcli.bin version 2>/dev/null || true
    exit 0
fi

[ -s "$DMG" ] || { echo "ERROR: DMG not found at $DMG" >&2; exit 20; }

MP=$(hdiutil attach -nobrowse -noverify -readonly "$DMG" \
       | awk -F'\t' '/\/Volumes\//{print $NF}' | tail -1)
[ -z "$MP" ] && { echo "ERROR: failed to mount DMG" >&2; exit 21; }
trap 'hdiutil detach "$MP" -quiet 2>/dev/null || true' EXIT

APP=$(find "$MP" -maxdepth 1 -name "*.app" -print -quit)
BIN="$APP/Contents/MacOS/TDAgentInstaller"
[ -x "$BIN" ] || { echo "ERROR: TDAgentInstaller not found at $BIN" >&2; exit 22; }

ARGS=(--headless)
[ -n "$ACTIVATION_CODE" ] && ARGS+=(--activation-code "$ACTIVATION_CODE")
[ -n "$AUTO_UPDATE" ]     && ARGS+=(--auto-update "$AUTO_UPDATE")
"$BIN" "${ARGS[@]}"
RC=$?
echo "TDAgentInstaller exit code: $RC"

if [ "$RC" -eq 0 ]; then
    DEST="/Applications/$(basename "$APP")"
    rm -rf "$DEST"
    ditto "$APP" "$DEST"
fi
exit $RC
```

### Exit codes

| Code  | Meaning                                          |
| ----- | ------------------------------------------------ |
| 0     | Installed (or already installed)                 |
| 1     | Not root                                         |
| 2     | No activation code found                         |
| 3     | Installer payload missing from bundle            |
| 4     | Install reported success but agent binary absent |
| 20    | (script) DMG not found                           |
| 21    | (script) DMG failed to mount                     |
| 22    | (script) installer binary not found              |
| other | From the underlying installer                    |

### Verify

```bash
sudo /opt/TDAgent/tdcli/tdcli.bin version
sudo launchctl list | grep -E 'com.tdagent|com.threatdefence|com.velocidex'

# Logs should start populating here. If not, check that the Full Disk Access profile has been added.
tail -f /var/log/tdagent/tdagent_events.json
```

### Notes

* Idempotent: re-run exits 0 without reinstalling.
* Auto-update: default on. Disable at install with `--auto-update no`, or later with `tdcli.bin disable-autoupgrade`.
* Uninstall: `sudo /opt/TDAgent/tdcli/tdcli.bin uninstall`.
* Logs: `/var/log/tdagent/`.
* Test on one Mac before scoping to the fleet.


# Mac Agent

**Install the TD Endpoint Agent on macOS**

This guide covers installing the agent on a single Mac, either with the **TD Endpoint Installer** app (recommended) or from the **Terminal**.

### Requirements

* Apple Silicon Mac (arm64), macOS 13 or later for the installer app
* An administrator account on the Mac
* Your activation code from the ThreatDefence portal
* Network requirements mentioned in the portal

***

### Method 1 — TD Endpoint Installer app (recommended)

#### Install

1. Open the DMG (`TD_Endpoint_Installer_<version>.dmg`).

<div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-3f07621c928a3ab48f3ebddbc7860dc473db9540%2FScreenshot%202026-07-20%20at%202.28.11%E2%80%AFPM.png?alt=media" alt="" width="375"><figcaption></figcaption></figure></div>

2. Drag **TD Endpoint Installer** into the Applications folder.\
   ![](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-39f2251949c40eb0d46986012ad5eab7c2734bf2%2FScreenshot%202026-07-20%20at%202.27.34%E2%80%AFPM.png?alt=media)
3. Launch the **TD Endpoint Installer** from Applications.
4. Paste your activation code into the field.<br>

   <div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-1cadee97a092d5c0e381fc20676168e663936d4b%2FScreenshot%202026-07-20%20at%202.29.43%E2%80%AFPM.png?alt=media" alt="" width="375"><figcaption></figcaption></figure></div>
5. Leave **Enable automatic updates (recommended)** ticked unless this Mac must stay on a pinned agent version (untick to disable the 6-hourly self-update; it can be re-enabled later with `sudo /opt/TDAgent/tdcli/tdcli.bin enable-autoupgrade`).
6. Click **Install Agent** and enter your administrator password when macOS prompts (*"TD Endpoint Installer wants to make changes"*).
7. Wait 1–2 minutes while the agent installs.

<div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-a6101f1fc9ee17b516fc43dffa8e6a7fb12a926b%2FScreenshot%202026-07-20%20at%202.32.40%E2%80%AFPM.png?alt=media" alt="" width="375"><figcaption></figcaption></figure></div>

#### Grant Full Disk Access to TDES

Near the end of the install, a dialogue appears: **"TD Endpoint Agent — Permissions Required"**.

1. Click **Open System Settings** — the Full Disk Access page opens.

<div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-f88b4899c35cceeb95b25450ce2d1e3e59849b66%2FScreenshot%202026-07-20%20at%202.52.02%E2%80%AFPM.png?alt=media" alt="" width="563"><figcaption></figcaption></figure></div>

2. Enable the toggle for the entry named **TDES**.

* If **TDES** is not listed yet, wait a few seconds and reopen the page, or add `/Library/Application Support/TDAgent/TDES.app` with the **+** button.

<div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-89ca55d3d30132e7610157b82405b909461da3d8%2FScreenshot%202026-07-20%20at%202.52.21%E2%80%AFPM.png?alt=media" alt="" width="563"><figcaption></figcaption></figure></div>

This step authorises the agent's security monitor. Without it the agent runs, but endpoint telemetry is not collected.

#### After installation

Reopen the app at any time. When the agent is installed, it shows **"TDAgent Installed"** with the agent version, plus:

<div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-16600813cdddcc7a12dc2662a68069db74430bb2%2FScreenshot%202026-07-20%20at%202.34.18%E2%80%AFPM.png?alt=media" alt="" width="375"><figcaption></figcaption></figure></div>

* **Export Logs…** — packs `/var/log/tdagent/` into `<hostname>_tdmacagent.tar.gz` at a location you choose (asks for the admin password). Attach this file to support requests.
* **Uninstall** — removes the agent from the Mac (asks for confirmation and the admin password).

#### If the installation fails

The app shows **"Agent installation failed, please contact support and attach the exported logs"** along with the installer output.

1. Click **Get Log Files** and save `<hostname>_tdmacagent.tar.gz`.
2. Send the archive to support.
3. **Try Again** returns to the activation-code screen once the cause is resolved (typical causes: wrong/expired activation code, no network path to the activation server).

***

### Method 2 — Terminal (.run installer)

For administrators who prefer the command line:

```bash
sudo ./TD_Endpoint_MacOS.run install --activation_code <ACTIVATION_CODE>
```

<div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-8c992ba8196488a95654bd2e5eccc2cb755d8f73%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure></div>

* The activation code may be a bare key or `host:key` form.
* Auto-updates are enabled by default; add `--auto_update no` to disable.
* The same **TDES Full Disk Access** prompt appears at the end — enable the **TDES** toggle as described above.
* Re-running the installer on an existing install performs a snapshot-protected in-place upgrade (automatic rollback on failure).

#### Uninstall (Terminal)

```bash
sudo /opt/TDAgent/tdcli/tdcli.bin uninstall

```

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-f4e6104fa836c4349de3bf8eb2fe756d8390190e%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

#### Auto-updates

Control it via the **Enable automatic updates** checkbox at install time, or later per machine with:

```bash
sudo /opt/TDAgent/tdcli/tdcli.bin disable-autoupgrade
sudo /opt/TDAgent/tdcli/tdcli.bin enable-autoupgrade
```

***

### Verifying the installation

```bash
# All agent services registered with launchd:
sudo launchctl list | grep -E 'com.tdagent|com.threatdefence|com.velocidex'
```

```bash
# Agent version (JSON):
sudo /opt/TDAgent/tdcli/tdcli.bin version
```

Expected services: `com.tdagent.tls`, `com.tdagent.wazuh`, `com.tdagent.tdcli`, `com.threatdefence.tdes`, `com.tdagent.cron`, `com.velocidex.velociraptor`.


# Windows Agent

> **Note:**\
> Please check [Prerequisites and System Requirements](/endpoint-agent/prerequisites) before proceeding.

## Standard Installation (Windows GUI)

1. [Log in to the Customer Portal](https://portal.threatdefence.io/deployment/endpoint-agent) and select your tenant from the dropdown list.\
   Your **Activation Code** will be displayed.
2. Select **Windows**, then click **Generate Download Link** followed by **Click Here to Download**.

   ![Generate Download Link](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-1ab6b8964eb7b127bbb55389b44f3f79677a978c%2Fgendllink_6.png?alt=media)
3. After the installer downloads, double-click it to launch the setup wizard. Enter your **Activation Code** from the portal and click **Next**.

   ![MSI Activation](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-5fa33039065353946c2db0c848996cd8b9f5acac%2Factivate_6.png?alt=media)

   ![MSI Activation Check](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-cc793282563947315ba17eb09795a14564a83faa%2Factivate_check_6.png?alt=media)
4. Review the Sysinternals End-User License Agreement (EULA).\
   Tick the checkbox to accept, then click **Next**.

   ![MSI Install Sysinternals](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-4d60ae7db45429d670a990fcf646a63936f0b08b%2Fsysinternals.png?alt=media)

> **Note:**\
> Sysinternals are Microsoft tools used to enhance endpoint telemetry. ThreatDefence recommends accepting the EULA.
>
> More information:\
> • [Sysmon | Microsoft Learn](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon)\
> • [Autoruns | Microsoft Learn](https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns)

5. (Optional) You may see an advanced option to override the Sysinternals download source. Leave this blank unless required, then click **Next**.

   ![MSI Sysinternals Redist](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-978d01c9f63ed71dd12f99332b90b7080e636807%2Fsysinternals_redist.png?alt=media)

> **Note::**\
> For restricted/offline networks, see **Advanced Windows Install**:\
> `/docs/Deployment/Endpoint Agent/Install Guides/AdvancedWindowsInstall.md`

6. Click **Install** to begin.

   ![MSI Ready To Install](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-7efbf65f2c17c6224a66246cc8921af5de122a13%2Fready_to_install.png?alt=media)
7. When installation completes, click **Finish**.

   ![MSI Install Wizard Completion](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-d27e33e3bed6bc33718392a98564cca2e412514d%2Fcomplete_6.png?alt=media)

***

## Silent / Command-Line Installation

For unattended or scripted deployments, use `msiexec`:

```
msiexec.exe /i TD_Endpoint.msi /qn ACTIVATION_CODE=xxx SYSINTERNALS_ACCEPT_EULA=Yes
```

#### Command Line Install Options:

| Argument                   | Required | Description                                                                                                                                                                                  | Examples                                                                                                               | Default |
| -------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ------- |
| ACTIVATION\_CODE           | Y        | Unique activation code, distributed on portal                                                                                                                                                |                                                                                                                        | N/A     |
| SYSINTERNALS\_ACCEPT\_EULA | N        | Accepts the Sysinternals software license terms available [here](https://learn.microsoft.com/en-us/sysinternals/license-terms).                                                              | SYSINTERNALS\_ACCEPT\_EULA=Yes                                                                                         | No      |
| REDIST                     | N        | URL or Local directory path to pre-downloaded Sysinternals binaries. For use in restricted networks. See our article, [Redist Override](#advanced-installation-group-policy), for more info. | <p>REDIST=<a href="http://web01.mycompany.com/td"><http://web01.mycompany.com/td></a><br>REDIST=C:\windows\temp\td</p> | N/A     |
| AUTOUPDATE                 | N        | Disable the automatic updater.                                                                                                                                                               | `AUTOUPDATE=False`                                                                                                     | True    |

### Uninstalling Windows Agent

1. Go to **“Apps & Features"** or **"Add/Remove Programs”**.
2. Type **“TD\_Endpoint”**, choose TD\_Endpoint and click **“Uninstall”**.

![uninstall](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-e4ff8290247a6ca7be53254674fb14ff55798fb6%2Funinstall_6.png?alt=media)

### Advanced Installation - Group Policy

For enterprise deployments, see our article on [MSI Transform files](/endpoint-agent/installation-guides/deploying-via-intune)

### Advanced Uninstall - Command Line / Silent

1. Open PowerShell by pressing `Windows Key + X` and select `Windows PowerShell (Admin)`.

![Windows PowerShell](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-de0e5017fedf061708bd21a5ee63f8c95a17aa08%2FAdvancedUninstall_1.png?alt=media)

2. Retrieve the application's `IdentifyingNumber` by entering `Get-WmiObject Win32_Product`

![Retrieve the Application Key](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-fa806fffe4c279f262bf1495b4c928185b09bab8%2FAdvancedUninstall_2.png?alt=media)

3. Uninstall the application using the following command, replacing `IdentifyingNumber` with that retrieved in the previous step:

```powershell
msiexec.exe /x "<IdentifyingNumber>" /qn
```

Ensure you enclose the **IdentifyingNumber** with double quotes. e.g.

```powershell
msiexec.exe /x "{3357A676-12AA-42AB-ADF3-A3DC3E0EA726}" /qn
```

![Uninstall the Application](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-3c80449ef76a1a80903109a0cb89cc51466f82fc%2FAdvancedUninstall_3.png?alt=media)

TD\_Endpoint agent will now be uninstalled from your system.

### Post-Installation Configuration Options

tdcli.exe is located in `C:\Program Files\TDagent\tdcli\tdcli.exe` and accepts several command-line options to modify existing installations:

| Argument             | Description                                                                                                                                   | Example                                                 |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
| upgrade-sysinternals | Upgrades sysmon to the latest available at <https://live.sysinternals.com/>. `Note: Will be overridden by REDIST path if set during install.` | C:\Program Files\TDagent\tdcli.exe upgrade-sysinternals |
| disable-sysinternals | Uninstalls and disables Sysinternals binaries.                                                                                                | C:\Program Files\TDagent\tdcli.exe disable-sysinternals |
| enable-sysinternals  | Installs and enables Sysinternals binaries.                                                                                                   | C:\Program Files\TDagent\tdcli.exe enable-sysinternals  |


# Deploying via MS Intune

## Deployment via Microsoft Intune MDM

ThreatDefence supports deployment of the Endpoint Agent via **Microsoft Intune**.\
This method is recommended for enterprise environments where agents need to be deployed and managed at scale.

For background information, refer to Microsoft’s official documentation on [Line-of-Business application deployment](https://learn.microsoft.com/en-us/mem/intune/apps/lob-apps-windows).

***

### Step-by-Step Guide

1. **Open Intune Admin Center**

   * Navigate to the **Microsoft Intune admin center**.
   * From the left-hand navigation bar, select **Apps > All apps**.

   ![Figure 1](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-30d9b68117f5ae779cb4f4a5523756e71b6a322e%2F1.png?alt=media)
2. **Add a New Application**

   * Press **+ Add**.
   * Select **Line-of-business app**.

   ![Figure 2](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-50015acf87419c70c3869317d82092f03e5549df%2F2.png?alt=media)
3. **Select App Package File**

   * Upload the ThreatDefence Endpoint Agent MSI file available in the [Customer Portal](https://portal.threatdefence.io/deployment/endpoint-agent).

   ![Figure 3](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-58e0ad4c840cabc846d57392e02a565025a0983d%2F3.png?alt=media)\
   ![Figure 4](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-d5b6eeebdbca3f57f9d6812c3d5a87c8560b3cd2%2F4.png?alt=media)
4. **Configure App Information**
   * Set the **Publisher** field.
   * Populate the **Command-line arguments** as if calling `msiexec.exe` directly.\
     Example:

( `/qn ACTIVATION_CODE=... SYSINTERNALS_ACCEPT_EULA=Yes`).

![Figure 5](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-2c1599c31ae08159bbdd751528adee35c150b5d4%2F5.png?alt=media)

5. Configure assignments or select **+ All users** and **+ All devices** to deploy globally.

![Figure 6](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-77a5185cfc0b5efedd4f2b2b8a21f07c6fa1fd79%2F6.png?alt=media)

6. Confirm the details, set a description, press **Create**.

![Figure 7](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-0eae0300f675c2544b28cf54babb58d18d30be67%2F7.png?alt=media)

7. After pressing create no further action is required.

![Figure 8](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-07a271ae0e4a72cb9ead3f0d0129a1486ae43c74%2F8.png?alt=media)

8. Navigating back to Apps from the left navigation bar now shows an item for our deployment.

![Figure 9](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-9655af149d70572afd1d7a5e37884e3611fdd148%2F9.png?alt=media)

No further action is required, endpoints will automatically download and install the uploaded software.


# Linux Agent

> **Note:**\
> Please check [Prerequisites and System Requirements](/endpoint-agent/prerequisites) before proceeding.

***

## Installation Steps

1. [Log in to the Customer Portal](https://portal.threatdefence.io/deployment/endpoint-agent) and select your tenant from the dropdown menu.\
   Your **Activation Code** will be displayed.
2. Choose your **Linux distribution**, then click **Generate Download Link**.

   ![Generate Download Link](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-1ab6b8964eb7b127bbb55389b44f3f79677a978c%2Fgendllink_6.png?alt=media)
3. Once the link is generated, either:

   * Click **Click Here to Download** to download the installer, or
   * Copy one of the **Install Scripts** from the panel that appears.

   ![Install Scripts](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-804dea68c1aa2aab2d8c31707951a2594f1fe459%2Flinux_installscripts.png?alt=media)
4. Transfer the downloaded installer to your Linux system (if downloaded), or run the commands from the **Install Scripts** panel.\
   For manual installation, run in your terminal:

```
chmod 755 TD_Endpoint.run
sudo ./TD_Endpoint.run install --activation_code ***your Activation Code***
```

5. The installer should complete, and provide output to your terminal.![Linux install done](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-b752b0166f6132a842430d9bced63311655e5f4f%2Fdone.png?alt=media)

### Advanced Options

#### Disable auto updates on installation:

```
chmod 755 TD_Endpoint.run
sudo ./TD_Endpoint.run install --activation_code ***your Activation Code*** --auto_update No
```

#### Use an explicit http proxy on installation:

```
chmod 755 TD_Endpoint.run
sudo https_proxy="http://PROXY_IP:PROXY_PORT" ./TD_Endpoint.run install --activation_code ***your Activation Code*** --proxy http://PROXY_IP:PROXY_PORT
```

#### Change auto update options after installation

**Enable:**

```
sudo /opt/TDAgent/tdcli/tdcli.bin enable-autoupgrade
```

#### Disable:

```
sudo /opt/TDAgent/tdcli/tdcli.bin disable-autoupgrade
```

### Uninstalling Linux Agent

Open your terminal and run the command: `sudo /opt/TDAgent/tdcli/tdcli.bin uninstall-all`

![Linux install uninstall](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-f51f9881bae0a32ead9954b60541dc6f79745780%2Flinux_uninstall.png?alt=media)

You should see the “Successfully uninstalled TDAgent” message as above.


# Mac Agent legacy

> **Note:**\
> Please check [Prerequisites and System Requirements](/endpoint-agent/prerequisites) before proceeding.

***

## Installation Steps

1. [Log in to the Customer Portal](https://portal.threatdefence.io/deployment/endpoint-agent) and select your tenant from the dropdown menu.\
   Your **Activation Code** will be displayed.
2. Choose **MacOS** from the available platforms, then click **Generate Download Link**.

   ![Generate Download Link](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-1ab6b8964eb7b127bbb55389b44f3f79677a978c%2Fgendllink_6.png?alt=media)
3. Once the link is generated, either:

   * Click **Click Here to Download** to download the installer, or
   * Copy one of the **Install Scripts** from the panel that appears.

   ![Install Scripts](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-804dea68c1aa2aab2d8c31707951a2594f1fe459%2Flinux_installscripts.png?alt=media)
4. Transfer the installer to your Mac (if downloaded), or run the script directly.\
   To install manually, open Terminal and run:

```
chmod +x ./TD_Endpoint_MacOS.run
sudo ./TD_Endpoint_MacOS.run install --activation_code ***your Activation Code***
```

5. The installer should complete, and provide output to your terminal.![Mac install done](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-33acc194bef422f341ef97955fe3087735cb383b%2Fmac_install.png?alt=media)

### Uninstall

Open your terminal and run the command: `sudo /opt/TDAgent/tdcli/tdcli.bin uninstall`

![Mac install uninstall](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-28a5629fe978953a166918aa0e0d0337a2ed6573%2Fmac_uninstall.png?alt=media)


# Mac Agent

## Install the TD Endpoint Agent on macOS

This guide covers installing the agent on a single Mac, either with the **TD Endpoint Installer** app (recommended) or from the **Terminal**.

### Requirements

* Apple Silicon Mac (arm64), macOS 13 or later for the installer app
* An administrator account on the Mac
* Your activation code from the ThreatDefence portal
* Network requirements mentioned in the portal

***

### Method 1 — TD Endpoint Installer app (recommended)

#### Install

1. Open the DMG (`TD_Endpoint_Installer_<version>.dmg`).

<div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-3f07621c928a3ab48f3ebddbc7860dc473db9540%2FScreenshot%202026-07-20%20at%202.28.11%E2%80%AFPM.png?alt=media" alt="" width="375"><figcaption></figcaption></figure></div>

2. Drag **TD Endpoint Installer** into the Applications folder.\
   ![](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-39f2251949c40eb0d46986012ad5eab7c2734bf2%2FScreenshot%202026-07-20%20at%202.27.34%E2%80%AFPM.png?alt=media)
3. Launch the **TD Endpoint Installer** from Applications.
4. Paste your activation code into the field.<br>

   <div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-1cadee97a092d5c0e381fc20676168e663936d4b%2FScreenshot%202026-07-20%20at%202.29.43%E2%80%AFPM.png?alt=media" alt="" width="375"><figcaption></figcaption></figure></div>
5. Leave **Enable automatic updates (recommended)** ticked unless this Mac must stay on a pinned agent version (untick to disable the 6-hourly self-update; it can be re-enabled later with `sudo /opt/TDAgent/tdcli/tdcli.bin enable-autoupgrade`).
6. Click **Install Agent** and enter your administrator password when macOS prompts (*"TD Endpoint Installer wants to make changes"*).
7. Wait 1–2 minutes while the agent installs.

<div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-a6101f1fc9ee17b516fc43dffa8e6a7fb12a926b%2FScreenshot%202026-07-20%20at%202.32.40%E2%80%AFPM.png?alt=media" alt="" width="375"><figcaption></figcaption></figure></div>

#### Grant Full Disk Access to TDES

Near the end of the install, a dialogue appears: **"TD Endpoint Agent — Permissions Required"**.

1. Click **Open System Settings** — the Full Disk Access page opens.

<div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-f88b4899c35cceeb95b25450ce2d1e3e59849b66%2FScreenshot%202026-07-20%20at%202.52.02%E2%80%AFPM.png?alt=media" alt="" width="563"><figcaption></figcaption></figure></div>

2. Enable the toggle for the entry named **TDES**.

* If **TDES** is not listed yet, wait a few seconds and reopen the page, or add `/Library/Application Support/TDAgent/TDES.app` with the **+** button.

<div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-89ca55d3d30132e7610157b82405b909461da3d8%2FScreenshot%202026-07-20%20at%202.52.21%E2%80%AFPM.png?alt=media" alt="" width="563"><figcaption></figcaption></figure></div>

This step authorises the agent's security monitor. Without it the agent runs, but endpoint telemetry is not collected.

#### After installation

Reopen the app at any time. When the agent is installed, it shows **"TDAgent Installed"** with the agent version, plus:

<div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-16600813cdddcc7a12dc2662a68069db74430bb2%2FScreenshot%202026-07-20%20at%202.34.18%E2%80%AFPM.png?alt=media" alt="" width="375"><figcaption></figcaption></figure></div>

* **Export Logs…** — packs `/var/log/tdagent/` into `<hostname>_tdmacagent.tar.gz` at a location you choose (asks for the admin password). Attach this file to support requests.
* **Uninstall** — removes the agent from the Mac (asks for confirmation and the admin password).

#### If the installation fails

The app shows **"Agent installation failed, please contact support and attach the exported logs"** along with the installer output.

1. Click **Get Log Files** and save `<hostname>_tdmacagent.tar.gz`.
2. Send the archive to support.
3. **Try Again** returns to the activation-code screen once the cause is resolved (typical causes: wrong/expired activation code, no network path to the activation server).

***

### Method 2 — Terminal (.run installer)

For administrators who prefer the command line:

```bash
sudo ./TD_Endpoint_MacOS.run install --activation_code <ACTIVATION_CODE>
```

<div align="left"><figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-8c992ba8196488a95654bd2e5eccc2cb755d8f73%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure></div>

* The activation code may be a bare key or `host:key` form.
* Auto-updates are enabled by default; add `--auto_update no` to disable.
* The same **TDES Full Disk Access** prompt appears at the end — enable the **TDES** toggle as described above.
* Re-running the installer on an existing install performs a snapshot-protected in-place upgrade (automatic rollback on failure).

#### Uninstall (Terminal)

```bash
sudo /opt/TDAgent/tdcli/tdcli.bin uninstall

```

<figure><img src="https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-f4e6104fa836c4349de3bf8eb2fe756d8390190e%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

#### Auto-updates

Control it via the **Enable automatic updates** checkbox at install time, or later per machine with:

```bash
sudo /opt/TDAgent/tdcli/tdcli.bin disable-autoupgrade
sudo /opt/TDAgent/tdcli/tdcli.bin enable-autoupgrade
```

***

### Verifying the installation

```bash
# All agent services registered with launchd:
sudo launchctl list | grep -E 'com.tdagent|com.threatdefence|com.velocidex'
```

```bash
# Agent version (JSON):
sudo /opt/TDAgent/tdcli/tdcli.bin version
```

Expected services: `com.tdagent.tls`, `com.tdagent.wazuh`, `com.tdagent.tdcli`, `com.threatdefence.tdes`, `com.tdagent.cron`, `com.velocidex.velociraptor`.


# Troubleshooting


# Agent Fails to Install

In most cases, failed ThreatDefence agent installations occur due to connectivity issues or the installation being blocked by Endpoint Detection & Response (EDR) software. This guide outlines the most common causes and steps to resolve them.

***

### 1. Verify You Are Using the Latest Agent <a href="#id-1-verify-you-are-using-the-latest-agent" id="id-1-verify-you-are-using-the-latest-agent"></a>

* Always download the latest version of the agent from the ThreatDefence portal: <https://portal.threatdefence.io/deployment/endpoint-agent>

***

### 2. Check System and Network Requirements <a href="#id-2-check-system-and-network-requirements" id="id-2-check-system-and-network-requirements"></a>

* Review the System and Network Requirements section in the portal: <https://portal.threatdefence.io/deployment/endpoint-agent>
* Ensure your system meets the minimum OS and hardware requirements.
* Verify that all provided IP addresses and hostnames are whitelisted on your perimeter firewall and/or proxy.
* On some enterprise firewalls (such as Palo Alto), SSL decryption can block traffic. You may need to add exceptions to SSL inspection policies. Example for Palo Alto decryption exclusions: <https://docs.paloaltonetworks.com/network-security/decryption/administration/decryption-exclusions/palo-alto-networks-predefined-decryption-exclusions#idfe9d8ac4-9a24-4cc0-a616-1f3092de7c6f>

***

### 3. Exclude ThreatDefence Agent from EDR or Antivirus <a href="#id-3-exclude-threatdefence-agent-from-edr-or-antivirus" id="id-3-exclude-threatdefence-agent-from-edr-or-antivirus"></a>

* Some Endpoint Protection platforms may interfere with agent installation or operation.
* Add exclusions in your EDR or antivirus (e.g., Microsoft Defender, CrowdStrike) for:

```
C:\Program Files\TDAgent\*
```

***

### 4. Remove Older Agent Versions (If Applicable) <a href="#id-4-remove-older-agent-versions-if-applicable" id="id-4-remove-older-agent-versions-if-applicable"></a>

* If an older ThreatDefence agent was previously installed, installation may fail until remnants are removed.
* Use the official cleanup tool before reinstalling: [here](/endpoint-agent/troubleshooting/cleanup-tool)

***

### 5. Collect Required Logs for Support <a href="#id-5-collect-required-logs-for-support" id="id-5-collect-required-logs-for-support"></a>

If the installation still fails after performing the above checks, please gather the following information and attach it to your support ticket:

* Tenant name
* Agent name
* Operating system
* MSI installation log
* Agent log (`C:\ProgramData\TDagent`)
* Error code or screenshot (if it was an interactive install)


# Agent not Reporting Data


# Clean-up Tool

## Overview

In situations where the standard uninstallation process cannot be used, ThreatDefence provides a **Cleanup Tool**. This utility completely removes the **TD\_Endpoint** software from a host system.

***

> **Caution:**\
> The cleanup script does **not** prompt for confirmation. Once executed, **TD\_Endpoint will be removed immediately**. Use this tool only when standard uninstall methods (e.g., Control Panel, command-line uninstall) are unavailable or have failed.

***

## Download

The Cleanup Tool can be downloaded here:

{% file src="/files/sS2856ncu26V9X20vdPa" %}

### Example Usage <a href="#example-usage" id="example-usage"></a>

```
PS /> powershell -ep bypass -f .\TD_Endpoint-Cleanup_Tool.ps1 -Uninstall -Force
```

### All Parameters <a href="#all-parameters" id="all-parameters"></a>

```
TD_Endpoint Cleanup Tool
Version 00B
ThreatDefence Pty Ltd
Copyright 2024

Usage: .\TD_Endpoint-Cleanup_Tool.ps1 [-Uninstall] [-Force] [-DisableSysmonOnly] [-SysmonDeepCleanup] [-Help]

Parameters:
  -Force               : Force uninstallation of TDAgent and removal of all residual files/keys
  -DisableSysmonOnly   : Only disable sysmon via tdcli.exe (default is false).
  -SysmonDeepCleanup   : Deep clean up sysmon and purge all residual files for it (default is false).
  -Uninstall           : Uninstall TD_Endpoint (default is false).
  -Help                : Show this help information.
```

> **Note:** Powershell must be run as administrator.


# Release Notes


# Windows Agent


# 6.x


# 6.2.2

Release Date: 2026-07-29

**Bug Fixes**

* Fixed the Sysinternals download location for Windows on ARM64. Installs on ARM64 devices now retrieve the correct ARM64 builds of Sysmon and Autoruns; previously the download failed and the components were not installed.

***

#### **Checksums**

\
**SHA1**:\
`9946e4c5db152a09ff4a525fe14fb22930f58568`\
\
**SHA256**:\
`a2eeeac6e09aa172ce5cf3ce8639303b18e0c1b10db5525f97231e4bdf72736e`\
\
**MD5**:\
`a977c340f8ad34936ba87ca9758059d4`


# 6.2.1

Release Date: 2026-07-21

**What's New**

* New lite install mode: pass `TD_LITE=1` to the silent installer to deploy a minimal footprint agent, HIDS and the TLS service only, without the Velo module or Sysinternals.
* Upgrades now run a connectivity preflight check. If the backend is unreachable, the upgrade is postponed until the next update cycle.
* The Velo module binary is now built and signed by ThreatDefence rather than redistributed from the upstream vendor

**Enhancements**

* Reduced installer and service log noise; routine cleanup detail moved to debug level.

***

**Checksums**

**SHA1**:

`e2aacf15eda903053948f1b9025ee5cff19a7ae4`

**SHA256**:

`d47502aeb43fda6c3f26da9ae14f20090963ffc668d9015ad6b6ee89c7ed0fb3`

**MD5**

`5b05b64b5ef8918d45ed6dcdd38a9d54`


# 6.2.0

Release Date: 2026-07-16

**What's New**

* Added proxy support: the installer and agent are now proxy-aware. Endpoints can install, register, and communicate through a HTTP proxy. Upgrades from pre-6.2.0 versions automatically retain their existing direct-connection behaviour.
* The agent now trusts the Windows certificate store enabling deployments behind TLS-inspecting proxies and environments using enterprise certificate authorities.
* New `tdcli re-register` command to re-register an endpoint without a full reinstall.
* Added Windows Server 2025 support and Security Configuration Assessment (SCA) policies to the HIDS component.
* Added native ARM64 Sysinternals tools on Windows-on-ARM endpoints.
* Upgraded Velo Module to latest stable release.
* Upgraded OpenSSL to latest LTS.

**Enhancements**

* Improved installer, service, and error-report logging for easier troubleshooting.

**Bug Fixes**

* Fixed upgrades leaving agent services unregistered or binaries missing.
* Fixed installer error 1316 during upgrades.
* Fixed the AUTOUPDATE installer property being ignored.
* Fixed incorrect error codes reported for some HIDS service failures.
* Fixed installation rollback, leaving pre-install files behind.

***

#### Checksums

**SHA1**:

`22d8a2df950fdb37100fba16e1f82d483679e4df`

**SHA256**:

`b1a0e4a06478f5cfce103242373ecae31e7b4f3abd00d3265dc7c9b1061b144b`

**MD5**

`cb96950270df6416253ea3a59c62571c`


# 6.1.4

Release Date: 2026-04-01

**What's New**

* Upgraded OpenSSL to 3.0.19 LTS (latest 3.0 LTS).

**Bug Fixes**

* Fixed Sysmon schema detection to support newer Sysmon versions.

***

**Checksums**

SHA1:

`2bf46384bfa22ae96dfe4e8211f06ee05b7cf8f5`

SHA256:

`0bcf65dfd6c1485be46cef1c8a858c1e290cec77452ef610f1deb63515f4d108`

MD&#x35;**:**

`937935d0fb41014d25749cbd29c7b15a`


# 6.1.3

Release Date: 2026-01-23

**What's New**

* Upgraded OpenSSL to latest 3.0 LTS.
* Upgraded Velo module to latest stable release.
* Updated TLS configuration to improve compatibility.

**Bug Fixes**

* Fixed a logging issue during module uninstallation.
* Fixed Sysmon schema detection logic.
* Fixed incorrect patch version being reported in logs.
* General service performance and stability improvements.

***

**Checksums**

SHA1:

`054e19f62da80fb4dc256596c4f5d5b5bbf465fe`

SHA256:

`4c053765ef463a50b117511d976f3571186307480e7458fc5d9357f515eb45c1`

MD5:

`14cff65ce03f6710d642e48aada281aa`


# 6.1.2

Release Date: 2025-05-21

**What's New:**

* Added support for new platform region.

***

#### Checksums

**SHA1:**

```
8880db75be82fd23e220861c24621588986501c2
```

**SHA256:**

```
fde05b030ac5b85d168225fadce285d5ff7d095f35afce5673092e2f8c356e48
```

**MD5:**

```
96a44db5a471bb907cb068c5c700754a
```


# 6.1.1

This version was reserved but never released.


# 6.1.0

Release Date: 2024-09-09

**What's New:**

* New MSI install argument `AUTO_UPDATE` (Default value = `Yes`). Declaring this variable as `No` will disable automatic updates for TD\_Endpoint.

**Bug Fixes:**

* Service performance optimizations and stability fixes.

***

#### Checksums

**SHA1:**

```
575969571c7fedc940bcc938bcd7d52dbd037ad9
```

**SHA256:**

```
700ae0af97fb1c18b323b50922c12a6aae6ad283d51ef76cc10560009b5a4560
```

**MD5:**

```
ab5f873c9397d9f5411b00a535432de6
```


# 6.0.3

Release Date: 2024-07-10

**Bug Fixes**

* Error dialogue messages no longer display during silent deployments.
* Error dialogue messages no longer pop-up twice during graphical deployments.

***

#### Checksums

**SHA1:**

```
88b1cc4a9f8a8d6b1b998733c0a95aded7f76f70
```

**SHA256:**

```
2e880015f66d66e02b693553ea3a3b9d3d0725459cd1aab4293ae5163f06eb58
```

**MD5:**

```
2f8a6e12b58cbdd853a617cecfcfc8c4
```


# 6.0.2

Release Date: 2024-06-25

**Bug Fixes**

* Resolved installation failures on certain Windows Servers with the Remote Desktop Services (RDS, formerly Terminal Services) feature enabled.

***

#### Checksums

**SHA1:**

```
bcf242a04ffe811fc663ad8041fb8e927b8a521c
```

**SHA256:**

```
f9d3c8b7db0a853993362e53fd3248379143079bbd8bac278190a8ff72989d12
```

**MD5:**

```
061c702580f28fe1af317611b377445a
```


# 6.0.1

Release Date: 2024-06-04

**Bug Fixes**

* Addressed an issue with Sysmon driver detection that affected certain Windows systems during installation.
* Implemented minor enhancements to logging functionality.

***

#### Checksums

**SHA1:**

```
96144163bc8e710d4e25041de0238e4e16fbf5b6
```

**SHA256:**

```
1d1400b8e347f285bc652b077d6ba5a2903632298882e82ef785bd001d27354f
```

**MD5:**

```
b72ae87f88ea10518a7925c397ed882a
```


# 6.0.0

Release Date: 2024-04-22

> :::warning Breaking changes: Command line install arguments have changed. Please see the [latest installer instructions](https://code.deploydefend.io/roche.zhang/gitbook/-/tree/main/secops-tools-deployment/endpoint-agent/Install%20Guides/Windows.md).

**What's New**

* Updated MSI Installer Framework: Introducing a new MSI package installer with a redesigned graphical user interface for an enhanced installation experience.
* Optional Sysinternals Binaries: Users now have the option to install Sysinternals binaries as optional components, providing greater flexibility in customizing installations.
* Enhanced TLS Security: The TLS tunnel now strictly enforces TLS 1.3, eliminating support for older versions to prevent security downgrades.

**Action Required**

* Command line install arguments have changed. Please see the [latest installer instructions](https://code.deploydefend.io/roche.zhang/gitbook/-/tree/main/secops-tools-deployment/endpoint-agent/Install%20Guides/Windows.md).

**Bug Fixes**

* Resolved an issue where endpoint agents were occasionally registering with incorrect hostnames, ensuring accurate system identification.
* Improved Sysmon configuration retrieval to be compatible with all schema versions, enhancing reliability across different setups.
* Addressed a problem causing some services to fail to automatically uninstall, ensuring cleaner and more reliable system maintenance.

***

#### Checksums

**SHA1:**

```
529ea8286560b8dcf5197da45fa3cfcd2ae2ca7b
```

**SHA256:**

```
d32c33fba5c46af8beb3e88b069fcc1ae6f72c2359ce5830e53ae416b4c8ecf5
```

**MD5:**

```
1d771c36338f3cd8b3f7e66bcb605576
```


# 5.x


# 5.6.3

Release Date: 2023-11-21

> :::warning Breaking Changes: Please ensure that your network allows outbound connections to <https://live.sysinternals.com>.

**What's New**

* Sysinternals binaries are now retrieved directly from <https://live.sysinternals.com>, rather than the previous archive site.

**Action Required**

* Please ensure that your network allows outbound connections to <https://live.sysinternals.com>.

**Bug Fixes**

* Resolution of system hang-ups encountered during logons on Windows 10 (caused by using older versions of Sysmon.)

***

#### Checksums

**SHA1:**

```
d5ef1765fbe59058e7109da12446fc2b7b20ad1a
```

**SHA256:**

```
e1495b42dcda81de0a3e5c8ee4ea5ae7d02cfd222e218cbfcfa4566cd865f7d9
```

**MD5:**

```
bdeffa24cc2d17a182fc71a927b19913
```


# 5.6.1

Release Date: 2023-09-27

**What's New**

* Added support for alternative regional activation servers.
* Added checks to prevent the installation of outdated installers.

***

#### Checksums

**SHA1:**

```
813209c1187476d4b1ac3abfcdc802efb04297dc
```

**SHA256:**

```
439b0a837fe3923f3b991d9eb7fdb2037d4b0c20c02017ea8db32c4078e6c5e8
```

**MD5:**

```
eb544012856ade594695c547c39741ca
```


# 5.6.0

Release Date: 2023-07-19

**What's New**

* The agent now communicates to the ThreatDefence SecOps platform exclusively over TCP port 443.
* Streamlined activation process: a single activation code is used instead of configuration files.
* Background self-updating improved: agents can automatically update to the latest version.
* Velociraptor endpoint integrated: Providing deeper forensic and incident response ability to your endpoints.

**Bug Fixes**

* Intermittent connection dropout issues resolved.
* Service performance optimizations and stability fixes.
* Sysmon driver stability issue resolved.

***

#### Checksums

**SHA1:**

```
d029633c89b3c57da5c4fb93d5f8f4ae65e5eba4
```

**SHA256:**

```
998c979c14d98e0d2eaeeca68883d2d9be438d3321ce6167e5a37e08da4447f8
```

**MD5:**

```
4e10b924c227d0b954e3fedb116652ae
```


# Linux Agent


# 6.x


# 6.2.0

Release Date: 2026-07-17

**What's New**

* Agent TLS tunnels now enforce TLS 1.3 as the minimum protocol version.
* Upgraded the HIDS component to latest stable release.
* Upgraded Velo Module to latest stable release.
* Upgraded OpenSSL to latest LTS.

**Enhancements**

* Improved installer and agent logging for easier troubleshooting.
* Installer now exits cleanly on unexpected errors instead of printing a traceback.

**Bug Fixes**

* Fixed some agents authenticating against the wrong backend node.
* Fixed detection of the correct HIDS package to install and improved error reporting.
* Fixed server query failures raising an unhandled error.

***

#### Checksums

**SHA1 (RPM):**

```
c21830ffd5ff901e3ae9eca18c4318088a8185a4
```

**SHA1 (DEB):**

```
548e73d5912491ddba6c294e1f06db4df38f197c
```

**SHA256 (RPM):**

```
61b50ba80865490a3b9dfaabcd869cc99c0e94933fab8f87efd304bf1f857a1d
```

**SHA256 (DEB):**

```
4238baf592aa9ff4a09f10001aa456d7ac33310e9f82a7e95784f6ef57f90fe1
```

**MD5 (RPM):**

```
beb20fb6673847043b690b6fbca70585
```

**MD5 (DEB):**

```
fe85e0ac81391276ffbb68b4bdd5cece
```


# 6.1.3

Release Date: 2025-09-15

**What's New**

* Upgraded OpenSSL library to latest 3.0 LTS.
* Upgraded Velo module to latest release.

**Bug Fixes**

* Improved Velo module compatibility with older Linux distributions.

***

#### Checksums

**SHA1 (RPM):**

```
3ecb24a31058a11e1c9ea7114dd53a3bb8cc47fd
```

**SHA1 (DEB):**

```
6a520ada247854553230bb7d398f11bb8ef6546c
```

**SHA256 (RPM):**

```
02b7d1487badd0944a44a895fd81d5dfee6c05f4fe4842623f4f55750db5a655
```

**SHA256 (DEB):**

```
cdc45b955f8148488a56ef1553f7419f25a2796e32b379328930e03d43b55627
```

**MD5 (RPM):**

```
8499a033a7b375c8949008525b358a13
```

**MD5 (DEB):**

```
37742561cc665bf1964040ebddac72a3
```


# 6.1.2

Release Date: 2025-05-21

**What's New**

* Added support for new platform region.
* Upgraded OpenSSL library to latest 3.0 LTS.

***

#### Checksums

**SHA1 (RPM):**

```
d6d44e40b222ef6ece169e5939d0a112cf75929b
```

**SHA1 (DEB):**

```
b46b12193321a95372978d0b012ff95e82cc43e8
```

**SHA256 (RPM):**

```
62607a12ce2a68690f02b536a2d37ac8925731e5f9ff96a98cd4c083579c8e2d
```

**SHA256 (DEB):**

```
e72ced3acba7351226fde1db43a3f25e673495fade96d8b7518e05a2876bdddc
```

**MD5 (RPM):**

```
e95dca4a701e4313aaf10bedf9775e67
```

**MD5 (DEB):**

```
8f57b514f8c64179f0b8eeb974a3d8ba
```


# 6.1.1

This version was reserved but never released.


# 6.1.0

#### Version 6.1.0

Release Date: 2024-12-13

**What's New**

* New install argument `--auto_update` (Default value = `Yes`). Declaring this variable as `No` will disable automatic updates for TD\_Endpoint.
* New `--proxy` option to configure explicit http proxy settings for agent communication with TD servers.

**Bug Fixes**

* Service performance optimizations and stability fixes.
* Automatic upgrade bug fixes.

***

#### Checksums

**SHA1 (RPM):**

```
fd961577d05e365736982f15787e947b907a6e92
```

**SHA1 (DEB):**

```
8772289d549d95c2d4e15110fb63788809cc1566
```

**SHA256 (RPM):**

```
d31c3c81fdf808532ae25ee241def5f1a81ce54804dbc5c13d89e1ee6df5a473
```

**SHA256 (DEB):**

```
1768e7d0d8983d77d83f56bc749223a1f598a19741b59d0f93465654828c1365
```

**MD5 (RPM):**

```
5dd9c9bd43351d5cf88ad766c708d83e
```

**MD5 (DEB):**

```
03810f7bae0c4603f713559dd9c2e07d
```


# 5.x


# 5.8.0

#### Version 5.8.0

Release Date: 2024-05-17

**What's New**

* Agent is now built with the latest OpenSSL 3.0 LTS version.

**Bug Fixes**

* Resolved a potential memory leak with the watchdog service.

***

#### Checksums

**SHA1 (RPM):**

```
a222e27eb16bd229c0f884492171cf86d7ac8fb8
```

**SHA1 (DEB):**

```
f0073f2e669927b9bd2c87cd389ed8bac7b59368
```

**SHA256 (RPM):**

```
0d6c0e9a8cef9e98e333c3161695d64d1afc1fe752f1ad31b0723c32a900769e
```

**SHA256 (DEB):**

```
a6081b83e0eff872ae65c6676f7fe4ae4790ceefa70e77840e791f60cf821c4e
```

**MD5 (RPM):**

```
4116c0b40ac1d224d2f7c501b5791c3f
```

**MD5 (DEB):**

```
f964a3c9efa8a509b438550bfb55b46f
```


# 5.7.0

#### Version 5.7.0

Release Date: 2023-11-23

**What's New**

* Auditd installation is now optional during the installation process and can be activated on-demand.

***

#### Checksums

**SHA1 (RPM):**

```
d1e1011e73382231e6b63e43446a511261c30965
```

**SHA1 (DEB):**

```
af6b6454c9ab3b1aa0b4064aa96a820d3ad9a5e2
```

**SHA256 (RPM):**

```
daa7a1111bf58086da401c4cad11907afe5a27b9a4d8f6d4b94234c53088905a
```

**SHA256 (DEB):**

```
d0cdd88f4c912ef1c09cfae33c5286109c4d9163ee0a0d1d8d0494d8f34b6812
```

**MD5 (RPM):**

```
d9ee51a3feaf440b20d7d7847e80cf54
```

**MD5 (DEB):**

```
26b142e76180856308419e0ebbe7533c
```


# 5.6.3

#### Version 5.6.3

Release Date: 2023-10-04

**Bug Fixes**

* Fixed activation error when attempting to resolve regional activation servers.

***

#### Checksums

**SHA1 (RPM):**

```
8f5b2517f0570ef36453c24401ea482feb685982
```

**SHA1 (DEB):**

```
419f079031c9e4dfdba89c909f08e33d8dd395b2
```

**SHA256 (RPM):**

```
0af3704659ac6d5e1e17053066098b289e74b7372645daaf2f1fe78240bfc3ff
```

**SHA256 (DEB):**

```
adc6b0e4a4189bb07dc015c8babbb1a0b250d0b33152d91d86043f62940043f3
```

**MD5 (RPM):**

```
8f507d7c9264c071071895007ae68b9a
```

**MD5 (DEB):**

```
2ebf9662228fd72577d148085a54e747
```


# 5.6.2

#### Version 5.6.2

Release Date: 2023-09-27

**What's New**

* Added support for alternative regional activation servers.
* Added checks when attempting to install outdated installers.

**Bug Fixes**

* Fixed installation errors on some SUSE Linux distributions.

***

#### Checksums

**SHA1 (RPM):**

```
14eb29020825e65724a08d9b8787ebc4090e54f2
```

**SHA1 (DEB):**

```
6d07a4e6ca37d96789e39aa70681744ef25a7452
```

**SHA256 (RPM):**

```
093c736f29f9c8438e6e1e093bd8718c9b7559b8e22868bd0137b9fe0b51bbfe
```

**SHA256 (DEB):**

```
ff61fdc884b95255cb3b8c5f2663b89729026e48d0d356e49f8c27bacae5f7dd
```

**MD5 (RPM):**

```
4013cf37370b09dde22701cc86c3c573
```

**MD5 (DEB):**

```
e150f53ec421498612609e230b1b3d01
```


# 5.6.1

#### Version 5.6.1

Release Date: 2023-09-15

**What's New**

* Replaced cronjobs with systemd timers.

**Bug Fixes**

* Fixed installation errors on some Amazon Linux distributions.
* Corrected minor spelling errors in informational logs.

***

#### Checksums

**SHA1 (RPM):**

```
2154d9edf3b9378c7271e221abe15110182933bf
```

**SHA1 (DEB):**

```
1089c368ddecafd2fde346994f950d5e7fc04f34
```

**SHA256 (RPM):**

```
300859b1f7ce2fd48a5a43986ef8c951a2fde3ac4ce4ad7f2414502e287f7735
```

**SHA256 (DEB):**

```
c43c6a6124701838c713b32f0e5569128b53b76ccea6d8ec1ac5f6000973111f
```

**MD5 (RPM):**

```
49e297836f056c0515e6536863011872
```

**MD5 (DEB):**

```
8a87d1b4cd178e0ece265f991173505c
```


# 5.6.0

#### Version 5.6.0

Release Date: 2023-09-11

**What's New**

* The agent now communicates to the ThreatDefence SecOps platform exclusively over TCP port 443.
* Streamlined activation process: a single activation code is used instead of configuration files.
* Background self-updating improved: agents can automatically update to the latest version.
* Velociraptor endpoint integrated: Providing deeper forensic and incident response ability to your endpoints.

**Bug Fixes**

* Intermittent connection dropout issues resolved.
* Service performance optimizations and stability fixes.

***

#### Checksums

**SHA1 (RPM):**

```
6ef5abe6400de5bbd4f8ccbfa8f211129a881728
```

**SHA1 (DEB):**

```
d7faace07985876b62f9c83f2e00251da640d1a2
```

**SHA256 (RPM):**

```
1807f73398baac6e5b83f38a833339036106b3e55c97caea7e88fb50e915b84c
```

**SHA256 (DEB):**

```
50ed8bc1728bb74588573715b1aaadac600a33725457f2d624070b82201acbb5
```

**MD5 (RPM):**

```
4772b699acc71b82febc99bf6ed8b954
```

**MD5 (DEB):**

```
b921081203f3bd6af8e53ea525b8ed6c
```


# Mac Agent


# 6.x




---

[Next Page](https://docs.threatdefence.com/llms-full.txt/1)