Skip to main content

Identity Threat Detection & Response requirements for Nebula

Updated: 

Before configuring Identity Threat Detection & Response (ITDR), review the requirements below to ensure your environment is ready.

ThreatDown Subscription

ITDR is available as an add-on for Advanced and Elite bundles and is included with new Ultimate bundles. Contact your ThreatDown account representative to confirm if ITDR is included in or available for your subscription.

Nebula User Requirements

The Nebula Super Administrator role is required to access and configure ITDR.

Endpoint Requirements

ITDR requires the Endpoint Agent to be deployed across all endpoints with Endpoint Detection and Response (EDR) enabled. This allows it to capture Active Directory telemetry, identity hooks, and security events from your environment. 

Supported Identity Sources

At least one cloud identity source is required.

Identity Source Requirements
Microsoft Entra ID 
  • An Azure Global Administrator or Cloud App Role Administrator account to authorize the following:
    • Read-Write API for MS Graph
    • Read-only API for O365
  • Audit logs enabled in Microsoft Entra ID
Okta 

An Okta Super Administrator account to create a dedicated service account and generate an API token. The service account must be assigned the following roles:

  • Read-Only Administrator: Grants access to OKTA System Log and Event Hook data.
  • Organization Administrator: Enables response actions like suspend and forcing MFA enablement.

Back to ITDR Guide

Still have questions?

Support is available via chat, phone or by creating a ticket. You can also use our virtual assistant for guided assistance.

Learn more