The inventory
Hosts lists every endpoint that has enrolled in the organizations in your scope, including those currently offline. Columns show the host, operating system, status (online, stale, offline, isolated), the required-tools badge from Security Tool Availability, risk score and when it was last seen.
Hosts are identified by the fleet identifier issued at enrolment, so a renamed machine keeps its history and two machines with the same hostname stay distinct.
Status
| Status | Meaning |
|---|---|
| Online | Heartbeat within the expected interval. |
| Stale | No heartbeat for a while; usually asleep or off the network. |
| Offline | No heartbeat for longer than the stale threshold. |
| Isolated | Containment is applied. |
Actions
Select a host to see its details, open alerts and tags, and jump to the response console: isolation, files, processes, application control, quick triage or the live shell. Admins can also create a removal token for the agent here. To change a host's fleet group or evict its agent, use Settings › Agents.
Fleet groups
Assign hosts to fleet groups to give them a policy: log shippers, required tools, collected event classes, managed sensors, on-host rules and maintenance windows. See Installer bundles and enrolment.