Skip to main content

Endpoint Management

Endpoint Management provides visibility into your organization's device fleet through MDM integrations. Devices are synced from your MDM provider, evaluated against compliance policies (encryption, firewall, passcode, OS version), and tracked through a posture dashboard with historical compliance snapshots for audit evidence.

Overview​

Access from Security Operations → Endpoint Management in the sidebar. The page has four tabs: Dashboard, Devices, Policies, and History.

Dashboard​

Endpoint Management Dashboard showing six KPI cards (Compliance Rate 50% High, Encryption Coverage 89% Medium, Firewall Coverage 72% Medium, MDM Enrollment 100% Healthy, Stale Devices 17 at 83% High, Total Managed Devices 18 Healthy), and three breakdown panels: By Platform (macOS 10, iOS 2, Linux 1, Windows 5), Compliance Status (Compliant 9, Non-Compliant 6, Unknown 3, Not Evaluated 0), Encryption (Encrypted 16, Not Encrypted 2, Unknown 0)

The dashboard provides an at-a-glance view of device posture across six KPI cards and three breakdown panels.

KPI Cards​

MetricDescription
Compliance RatePercentage of devices meeting all policy requirements
Encryption CoveragePercentage of devices with disk encryption enabled
Firewall CoveragePercentage of devices with host firewall active
MDM EnrollmentPercentage of known devices enrolled in MDM management
Stale DevicesCount and percentage of devices that haven't checked in recently
Total Managed DevicesTotal number of devices in the fleet

Each KPI card is color-coded by health status:

  • Healthy (green) — Metric meets target thresholds
  • Medium (amber) — Below target but not critical
  • High (orange) — Significant compliance gap
  • Critical (red) — Requires immediate attention

Breakdown Panels​

  • By Platform — Device count by operating system (macOS, Windows, iOS, Android, Linux)
  • Compliance Status — Count of devices in each compliance state (Compliant, Non-Compliant, Unknown, Not Evaluated)
  • Encryption — Count of devices by encryption state (Encrypted, Not Encrypted, Unknown)

Device Inventory​

Endpoint Management Devices tab showing search bar, All Platforms and All Statuses filter dropdowns, and device table with columns for Device, Compliance, Encryption, Status, Last Check-In, and Source — 18 devices listed including macOS laptops (MacBook Pro, MacBook Air), Windows PCs (ThinkPad, Dell Latitude, Surface Pro), iPads, and a Linux server, with a mix of Compliant (green), Non-Compliant (red), and Unknown (amber) badges, sourced from Jamf Pro and Microsoft Intune

The Devices tab shows all synced devices with filtering and a detail sidecar.

Device Table​

ColumnDescription
DeviceDevice name with platform icon and OS version
ComplianceColor-coded badge: Compliant, Non-Compliant, Unknown, or Not Evaluated
EncryptionLock/unlock icon indicating disk encryption status
StatusManaged, Unmanaged, or Pending
Last Check-InRelative time since last MDM sync (e.g., "2h ago", "3 days ago")
SourceMDM provider name (SimpleMDM, Microsoft Intune, Jamf Pro)

Filtering​

  • Search — Filter by device name
  • Platform — All Platforms, macOS, Windows, iOS, Android, or Linux
  • Status — All Statuses, Compliant, Non-Compliant, Unknown, or Not Evaluated

Device Detail Sidecar​

Click any device row to open the detail sidecar showing:

Device Information:

  • Device name, platform, OS version, model, manufacturer
  • Serial number
  • User (name and email)
  • Source integration

Compliance Status:

  • Overall compliance badge
  • Managed status (Managed, Unmanaged, Pending)
  • Encryption, firewall, and passcode status (Enabled, Disabled, or Unknown)
  • Last check-in timestamp
  • First seen and last seen dates

Policy Results: Per-policy compliance breakdown showing each rule's pass/fail/unknown result, severity level, and descriptive label. This helps identify exactly which policy rules a non-compliant device is failing.

Device Sources​

Devices sync automatically from connected MDM providers:

ProviderPlatformsDescription
SimpleMDMmacOS, iOSApple device management with profile-based enforcement
Microsoft IntuneWindows, macOS, iOS, AndroidCross-platform device management via Microsoft Endpoint Manager
Jamf PromacOS, iOSEnterprise Apple device management with detailed compliance data

Connect MDM providers through Administration → Integrations. Devices sync on a 6-hour interval via the platform's sync scheduler. Each sync updates device attributes, compliance status, and last check-in timestamp.

Compliance Policies​

Endpoint Management Policies tab showing 3 policies count with + New Policy button, listing Antivirus and Endpoint Protection (1 rule), Check-In Freshness (1 rule), and Device Security Baseline (3 rules), each with evaluate and delete action buttons

Compliance policies define rules that devices must satisfy to be considered compliant. Devices are evaluated against all enabled policies — all rules within a policy must pass for the device to be compliant (AND logic).

Creating a Policy​

Click + New Policy to create a compliance policy:

  1. Name — Descriptive name (e.g., "Baseline Security Requirements")
  2. Description — Optional scope and purpose description
  3. Rules — Add one or more compliance rules

Rule Types​

FieldDescriptionOperators
Encryption EnabledDisk encryption (FileVault, BitLocker) must be activeequals, notEquals
Firewall EnabledHost firewall must be turned onequals, notEquals
Passcode CompliantScreen lock passcode must be configuredequals, notEquals
Antivirus ActiveAntivirus/EDR agent must be runningequals, notEquals
OS VersionOperating system must meet a minimum versionsemverMin
Last Check-InDevice must have synced within a time windowolderThanDays

Each rule includes:

  • Field — Which device attribute to check
  • Operator — How to evaluate the attribute
  • Value — The expected value or threshold
  • Severity — Critical, High, Medium, or Low — determines how the failure is weighted
  • Label — Descriptive text shown in compliance reports (e.g., "FileVault encryption required")

Evaluating Policies​

Click the Evaluate button on any policy to trigger an immediate re-evaluation against all devices. The result toast shows: "Evaluated X devices: Y compliant, Z non-compliant."

Policies also evaluate automatically after each device sync.

Example Policies​

Baseline Security Policy:

  • Encryption Enabled equals true (Critical) — "Full disk encryption required"
  • Firewall Enabled equals true (High) — "Host firewall must be active"
  • Passcode Compliant equals true (Medium) — "Screen lock passcode required"

OS Currency Policy:

  • OS Version semverMin 14.0.0 (High) — "macOS 14+ required"
  • Last Check-In olderThanDays 30 (Medium) — "Device must sync within 30 days"

Compliance Snapshots​

The History tab shows point-in-time compliance snapshots. Snapshots are captured automatically after each device sync and provide historical data for trend analysis.

Each snapshot records:

  • Timestamp — When the snapshot was captured
  • Total Devices — Fleet size at capture time
  • Compliance Rate — Percentage of compliant devices
  • Device Counts — Compliant, non-compliant, and unknown counts
  • Platform Breakdown — Per-platform compliance counts
  • Policy Breakdown — Per-policy pass/fail counts

Snapshots create an audit trail showing continuous monitoring and compliance trends over time — useful for demonstrating to auditors that devices are being actively managed and evaluated.

Compliance Statuses​

StatusDescription
CompliantDevice passes all enabled policy rules
Non-CompliantDevice fails one or more policy rules
UnknownDevice attributes insufficient to evaluate (e.g., null encryption status)
Not EvaluatedNo compliance policies are defined or the device hasn't been evaluated yet

Non-Compliance Handling​

When a device fails a policy rule:

  1. The device is flagged as Non-Compliant in the device inventory
  2. The detail sidecar shows which specific rules failed, with severity and description
  3. Dashboard KPI cards and breakdown panels update to reflect the compliance gap
  4. Compliance snapshots record the posture change for historical tracking
  5. Remediation tasks can be created to address specific failures (e.g., "Enable FileVault on Jim's MacBook")

Supported Platforms​

PlatformIconExamples
macOSApple iconMacBook Pro, Mac mini, iMac
WindowsWindows iconSurface Pro, Dell Latitude, ThinkPad
iOSMobile iconiPhone, iPad
AndroidAndroid iconPixel, Samsung Galaxy
LinuxLinux iconUbuntu, RHEL workstations