Skip to main content
Runtime Security → Devices & Enrollment is the operational console for the DLP agent fleet. Every laptop with the agent installed shows up here, with identity status, last seen, traffic volume, and tamper history.

​
The fleet table

​
Filters

Filter the table by:
  • Identity state (focus on every pending device).
  • OS (push a Windows‑only policy change).
  • User or directory group (cross‑check coverage for a team).
  • Tamper status (find devices where the agent isn’t running clean).
  • Last‑seen window (find dormant laptops the agent isn’t reaching).

​
Enrollment tokens

The same page houses the workspace’s enrollment tokens. Click Tokens to see:

​
Lifecycle

1

Create

Tokens → New. Pick a name; optionally cap activations, set an expiry, restrict to a directory group.
2

Distribute

Embed in your MDM payload (see Fleet rollout).
3

Rotate

Mint a new token, update MDM, then revoke the previous token. Existing devices are unaffected by token revocation; rotation only matters for new enrollments.
4

Revoke

From the token row, Revoke. New enrollments fail; existing devices keep working.

​
Per‑device actions

Click any device row to open the detail panel.

​
Tamper events

Every tamper attempt is captured. The agent’s guardian process and the service report integrity events to POST /agent/tamper-events. Tamper events appear in the audit trail with severity CRITICAL and can be pushed to your SIEM via the audit webhook.

​
Investigating a tamper event

1

Open the device

Click the row in the fleet table. The tamper history is the bottom panel.
2

Read the event

Each event has a code, detail (free‑text), timestamp, and a snapshot of the agent and OS state at the time.
3

Take action

For accidental tampering (a user uninstalled the agent), push the agent again via MDM. For malicious attempts, follow your IR runbook and consider locking the device with EDR.

​
Bulk operations

From the fleet table:
  • Select rows with checkboxes.
  • Push policy to every selected device.
  • Pause / resume scanning for a group.
  • Export to CSV for offline reporting.
Bulk actions are audited. The audit row records every device id touched.

​
Common workflows

  1. Filter the fleet table by Last seen > 7 days.
  2. Cross‑check against your asset list. Anyone still active in SCIM but absent here probably has a broken agent push.
  3. Re‑push the MDM payload from your console.
  1. Filter by User → directory group.
  2. Confirm every team member has at least one bound device.
  3. Anyone with zero bound devices is either a non‑agent user or has dropped off, escalate to IT.
  1. Change the policy in Runtime Security → Apps.
  2. Push policy to a pilot group from the fleet table.
  3. Watch verdict drift over the next 24h.
  4. Roll out to the rest of the fleet from the same screen.