About

The ThreatMate integration brings your ThreatMate data into the ControlMap MSP portal, so you can see your clients' devices and vulnerabilities, and their compliance check results, in one place. You connect once with a ThreatMate username and password. ControlMap then syncs on a weekly schedule.

The integration collects:

• Companies: your ThreatMate segments. Each one is added to ControlMap as a prospect tenant.
• Assets: the devices ThreatMate finds, with the scan group each belongs to.
• Vulnerabilities found on those assets.

ControlMap also runs compliance checks on this data. Once a company is an active client, its assets, vulnerabilities and check results appear in that client's own portal, where they count as automatically collected evidence.

Before you start

Have these ready:

• Your ThreatMate URL, for example https://demo.threatmate.com. Include https://.
• The username and password of a user or service account that has access to the ThreatMate API.

The Help panel on the ThreatMate setup page also describes how to set up that account in ThreatMate. It says to create a custom user role with the permissions IAMDiscoveryRead, IAMAgentRead and IAMCloudAccountRead, then create a user in your top-level ThreatMate account and assign it that role.

Connect ThreatMate

1. In the MSP portal, select Integrations in the top bar.
2. Select + Integration. If you have no integrations yet, select Create Connection.
3. Under Asset Management, find the ThreatMate card and select Connect.

4. On Setup Connection, enter the ThreatMate URL, Username and Password.
5. Select Create & Next. ControlMap signs in to ThreatMate with these details first. If they are rejected, nothing is saved and an error appears under the form.

6. On Schedule, choose the Day of the week and the Time of the day. Scans run weekly.
7. Select Save & Scan Now to save the schedule and start a scan, or Save Schedule to save it only. Then select Got It. in the confirmation.

The first sync can take a few minutes. Your ThreatMate companies then appear as prospect tenants in the Companies tab and in the MSP dashboard.

What you'll see after connecting

Open the integration from the Integrations list. The page has these tabs:

• Compliance Checks: the Passed, Failed and Error tiles, and the checks ControlMap runs for ThreatMate. Select a tile to filter the list.
• Companies: the companies found in ThreatMate, with Company, Status, Last Update and Identifier.
• Assets: a chart of asset counts over time and a table with Client Name, Asset Name, Identifier, Scan Group, Status, Last Updated, Last Seen and Additional Information. Select Additional Information to open the full record from ThreatMate.
• Vulnerabilities: a Right Now card with the total and the Critical, High, Medium, Low, Trivial and None counts, a trend chart, and a table with Client Name, Name, Severity, Description, Impact Score, Exploit Score and Assets.
• Help, Connection and Schedule.

ControlMap runs these compliance checks on ThreatMate data:

• Assets are inventoried
• Vulnerabilities are inventoried
• Antivirus checks
• Untrusted applications checks
• Windows security center service issue
• Full disk encryption check
• Autoupdate check
• Internet settings check
• Physical breach check
• Secure boot check
• Security product check
• Shared resources check
• Up to date signatures check
• Windows firewall check

Next steps for prospect tenants

After the sync, each company is a prospect tenant. Choose what fits your workflow:

• Select Activate Tenant to create an active tenant and tenant portal for the company. This uses a license.
• Merge the prospect into an existing Pro tenant if that company already has one. This associates the ThreatMate data with the existing tenant.

Run a scan, change settings or delete

• To scan now, open the integration and select Run Once. The label changes to Running. While a scan runs, Force Stop appears.
• To change the schedule, open the Schedule tab, update the day or time and save.
• To change the ThreatMate URL, username or password, open the Connection tab, edit the fields and select Update Connection. ControlMap tests the details again before saving. The tab shows "Successfully connected to" the integration's name when the connection works.
• To delete the integration, select the trash icon on its row in the Integrations list. If it already has active client tenants, choose Keep data, delete integration or Delete data and integration. Then type DELETE and select Delete. Deleting the data also removes everything the integration brought in, and this cannot be undone.