Security operations
Endpoints & collection agents
Detection quality is capped by collection coverage. This inventory shows which assets report, what each one collects, and where the blind spots are. A disconnected agent is not a quiet host — it is a host you cannot see.
Managed assets
10
Reporting normally
7
Blind spots
2
disconnected or never enrolled
Crown-jewel assets
2
Inventory
Select an asset to inspect its collection profile.
| Host | Group | Status | Last seen | EPS | Risk |
|---|---|---|---|---|---|
WS-FIN-014 10.20.4.14 · Windows 11 23H2 | workstations/finance | Healthy | 12s ago | 41 | |
WKS-HR-006 10.20.6.6 · Windows 11 23H2 | workstations/hr | Healthy | 9s ago | 27 | |
SRV-DC-01 10.10.1.10 · Windows Server 2022 | servers/identity | Healthy | 4s ago | 312 | |
SRV-FILE-02 10.10.2.22 · Windows Server 2019 | servers/file | Degraded | 6m ago | 8 | |
SRV-WEB-01 10.30.1.5 · Ubuntu 22.04 LTS | servers/web | Healthy | 7s ago | 190 | |
SRV-DB-01 10.30.2.9 · Rocky Linux 9 | servers/database | Healthy | 11s ago | 96 | |
SRV-BUILD-03 10.30.5.3 · Debian 12 | servers/ci | Disconnected | 3h 12m ago | 0 | |
MBP-DESIGN-02 10.20.9.2 · macOS 14.5 | workstations/design | Healthy | 31s ago | 12 | |
K8S-EDGE-POOL 10.40.0.0/24 · Container runtime | cloud/kubernetes | Healthy | 3s ago | 420 | |
WKS-ENG-021 10.20.8.21 · Windows 11 23H2 | workstations/engineering | Never connected | never | 0 |
WS-FIN-014
Standard asset · owner a.pratama
- Agent id
- AG-001
- Version
- 4.8.2
- Platform
- Windows 11 23H2
- Group
- workstations/finance
- Status
- Healthy
- Last seen
- 12s ago
Enabled collection modules
- Log collection
- Integrity monitoring
- Vulnerability scan
- Posture checks
Composite risk
Risk blends open vulnerability exposure, asset criticality and recent alert involvement — not vulnerability count alone.
Coverage triage
What to fix first when agents fall behind.
- 1. Never connected. Enrollment failed — no data has ever arrived. Highest priority on crown-jewel assets.
- 2. Disconnected. Data stopped. Check the host, then the collector, then the network path.
- 3. Degraded. Reporting but behind, buffering, or missing modules. Silent partial loss is the hardest failure to notice.
- 4. Version drift. Older agents may lack the fields your newest detections depend on.
Learn this capability
Hands-on labs that build the technique behind this workspace. Skills transfer to any mainstream SIEM.
Advanced · Guided Lab · 35 min
Baselining normal behaviour
You cannot spot abnormal without knowing normal. Build a baseline of authentication and process behaviour for the ACME-CORP estate.
Intermediate · Theory · 18 min
SIEM architecture overview
You keep the SIEM healthy. Everything analysts do depends on data arriving, parsing correctly and being searchable.
Entry · Guided Lab · 22 min
Telemetry: the data a SOC actually sees
You have the map; now learn the terrain. Four telemetry families feed this environment — endpoint, network, identity and cloud — and every investigation moves between them.