Factorial IT installs the ThreatDown agent (by Malwarebytes) automatically on your devices to protect them against security threats. Use it when ThreatDown is your EDR, whether you buy the licence through us or already have your own tenant.

Feature/Functionality

Overview

The agent reaches targeted devices through an MDM control. Once the control is live, Factorial IT installs it via MDM with no manual installation and nothing for employees to do.

Which setup applies to you

There are two ways to run ThreatDown with Factorial IT:

• Licence through Factorial IT: Factorial IT sets up and runs ThreatDown on its own tenant. To get started, click Talk to Sales on the ThreatDown card.
• Your own Nebula tenant: you connect the ThreatDown tenant your company already has, and Factorial IT deploys the agent through it.

Connect your ThreatDown tenant

Skip this if Factorial IT manages ThreatDown for you.

1. Gather your ThreatDown credentials. In the ThreatDown console, find:
   • Account ID: in Settings > Account information.
   • Client ID and Client secret: create an API client in Settings > Application registration. ThreatDown shows the client secret only once, when the client is created, so copy it before closing the dialogue.
2. Open the integration. Go to MDM > Settings. In Integrations, click Add integration, then Connect on the Threatdown card.
3. Fill in the form. In Connect your ThreatDown tenant, enter the Account ID, Client ID and Client secret, then click Connect.

Factorial IT checks the credentials and the account before saving anything. If something is wrong, the console tells you why:

When the connection succeeds, Threatdown shows up in the Integrations section of MDM settings.

How to use: set up the control

1. Go to MDM > Controls > Add new control and select the EDR - ThreatDown control.
2. Choose the devices it applies to: all devices, specific device groups or a custom target.

From then on, the agent is installed automatically on the targeted devices.

Modify or remove the control

Open the control from MDM > Controls to change it or switch it off. Switching it off stops enforcement, but configurations already on devices stay in place.

Disable the integration

Go to MDM > Settings, click the Threatdown row in Integrations, then click Disable.

• If a ThreatDown control is still on, Factorial IT will not let you. Click See MDM controls and switch off the ThreatDown deployment first.
• If ThreatDown runs on your own tenant, click Disable to confirm. Automatic deployment disappears from your MDM controls, and devices stop showing the installation status.
• If Factorial IT manages ThreatDown for you, click Contact us and ask the team to disable it.

Troubleshooting and FAQ

Troubleshooting

• The connection fails. Read the message the console shows and follow the matching action in the table above.
• "ThreatDown did not answer." ThreatDown did not respond in time. Try again in a moment.
• You cannot disable the integration. A ThreatDown control is still on. Click See MDM controls and switch it off first.

FAQ

1. Do employees need to install anything?
   No. The agent is installed automatically through MDM.
    
2. Does switching off the control uninstall the agent?
   No. It stops enforcement, but existing configurations stay on devices.
    
3. How do I get a ThreatDown licence through Factorial IT?
   Click Talk to Sales on the ThreatDown card.
    
4. What happens to devices when I disable my own tenant's integration?
   Automatic deployment is no longer offered in your MDM controls, and devices stop showing the installation status.