Inspect and manage one device
Move from device identity and fresh observations to the right diagnostics, inventory, command, or history view.
Before you start
- Open the device from Endpoints in the correct organization.
- A live agent connection is needed for immediate diagnostics and the header’s reboot, inventory, and update actions.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Confirm identity and connection state
Open a device and check its display name, hostname, OS, assigned user, tags, and Last seen. The Agent badge shows connectivity. Click Refresh device details if the record is old; the retrieval time describes when the console fetched the record, while observation times describe when the agent measured something.
What you should see: You know which device you are examining and whether new work can be picked up now.
Use Overview to establish what is wrong
Select Overview. Read the Health banner, resource readings, inventory, and any investigation finding. Use Investigate to request read-only diagnostics on an online agent. If an investigation is already running, wait for its progress and review the returned evidence before choosing an action.
Review the DEX score, events, and sampled signals
Open DEX and read the current score, its complete or provisional state, component breakdown, and Composite trend (30d). A provisional score is not stored as a complete-score history point. Scroll to Signals (last 48h) for sampled free-memory and control-plane latency readings, then to Events (last 30d) for crashes, freezes, pressure transitions, and other reported incidents.
| Field or control | What to do |
|---|---|
| Signals (last 48h) | Read each signal’s latest value, observed range, and sample count. The source loads up to 4,000 newest signal rows; a sample is not an incident. |
| Events (last 30d) | Read Event, Time, App, Duration, and Details. Use Previous/Next for 25-row pages; the source can load up to 5,000 newest event rows. |
| Raw metadata | Turn this on to inspect original event fields instead of the formatted detail text. |
| ITSM tickets (last 30d) | When an enabled integration exists, inspect linked ticket references and alert context. This view reads up to 50 newest ticket-linked alerts. |
Inspect a telemetry window and export the plotted series
Open Telemetry and choose 1h, 24h, 7d, or 30d. Review CPU %, Memory used (GB), Disk free %, and Network throughput; hover for the observation time and value. Read the sample-coverage summary before comparing a trend with the incident. Click Download CSV to export the plotted measurement series, including its selected aggregation.
| Field or control | What to do |
|---|---|
| 1h / 24h / 7d / 30d | Plots individual samples / five-minute averages / hourly averages / daily averages, respectively. |
| Latest samples notice | The chart uses the newest 5,000 samples when the source reaches its limit; earlier observations in the selected window are omitted. |
| Top processes | Sums same-name process instances within a sample, then averages over samples where the process appeared in the agent’s top-N list. Read Samples alongside CPU and RAM averages. |
| Missing CPU or collection gaps | Remain unknown gaps in the charts. They are not treated as zero utilization. |
What you should see: The chart and exported series have a known time range, aggregation, and coverage limit.
Run a task or use the device actions menu
Choose Run a task to open the task flow with this device selected. The actions menu also offers Dispatch command, Reboot, Pull inventory, and Update agent. Dispatch command opens the Commands tab’s dialog. Pull inventory requests fresh inventory; the page refresh button only rereads the current record.
Dispatch and inspect a device command
In Commands, choose New command, select Command type, complete the fields it reveals, and read Summary. For a library script, choose Run script… instead. Confirm an uninstall or reboot when prompted, then click Dispatch. Open a command row to inspect output, exit code, duration, and approval state.
| Field or control | What to do |
|---|---|
| Software commands | Enter Package name, optional Version, and Package manager. auto lets the agent choose; other options depend on the device OS. |
| Service commands | Enter the actual Service name for Restart service or Stop service. |
| Reboot | Set Schedule delay (s) and confirm that the endpoint will reboot. |
| Cancel command | Requests cancellation of a pending, dispatched, or running job. Inspect the resulting state; cancellation does not undo completed changes. |
Maintain the display name and tags
An administrator can choose Rename in the actions menu to set a friendly display name. Remove an editable tag using its small remove control in the header. To add tags or assign a user, return to Endpoints and use its selection actions. A tag locked by an agent or patch policy requires an administrator.
What you should see: The device remains identifiable by its reported hostname while its display name, user, and tags provide operational context.
Verify the outcome in the relevant view
After a task, inspect Commands for status, output, and exit information; then return to the evidence tab relevant to the change. For example, after a patch scan use Patches, and after inventory collection use Software or Overview. Refresh the record when the agent has reported the new observation.
What you should see: The command result and the later device observation can be checked separately.
If something doesn’t work
The device link is invalid or no device is returned.
Return to Endpoints and open a current row in the selected organization. Device links use the endpoint ID; changing the organization may make an old link inaccessible.
A quick action is disabled.
Check the agent connection, your role, and whether another dispatch is in progress. Offline header actions need a live agent connection.
The Terminal tab is absent.
Remote terminal is available only in deployments where that feature is enabled. Files and approved task workflows remain separate options.