Endpoint Troubleshooting Home page, questions, and responses

This article explores how to frame questions in Endpoint Troubleshooting and view the responses.

Using the new Platform UI

Inventory Insights, 1E Intelligence, and Enhanced Settings use the new Platform UI. Selecting these modules opens the new Platform UI in your current browser tab.

The new Platform UI uses modern design principles, and includes the following elements.

Module visibility is determined by your 1E license.

Expandable left-hand and drop-down menu: The menu can be expanded or collapsed using the chevron icon located at the top of the pane.
Search: Execute Instructions and search for devices using keyboard shortcuts, including those based on their Fully Qualified Domain Name (FQDN) and Intelligent Insights.
Intelligence: A powerful tool designed to enhance your organization's efficiency and decision-making capabilities.
Inventory Insights: Devices and Software are available in the new left-hand navigation bar.
Settings: You can access and configure 1E Client certificates, Integrations, Identity Provider and Platform settings.
Module Launcher: You can launch other Platform modules and any 1E Solutions that are included with your license.
User Profile: Click this to switch between light and dark mode, see the Platform version, or log out.

Dark mode is only available in the new Platform UI.

Running Instructions and viewing Instruction History

You can run Instructions and view Instruction History from, Inventory Insights, 1E Intelligence and, Search.

The ability to run Instructions is controlled by Role-Based Access Control (RBAC). Refer to Permissions.

Using Inventory Insights and 1E Intelligence

You can search for, and run an instruction against a set of devices, from the Devices page, or 1E Intelligence >Insight > Insights details pages.
- Devices page: Select one or more devices from the device grid, or select Run Instruction from the Device Summary card.
- Intelligence Insight page: Select Investigate on the Insight summary card, refer to Insight details.
For both 1E Intelligence and Devices, clicking Run Instruction opens the Run Instruction drawer.
From the Run Instruction drawer, search for an Instruction, or choose one from:
- Recommended: If you are in 1E Intelligence > Insights.
- Recently used: If you are on the Devices page.
Click an Instruction to configure its parameters. You can configure every parameter except for coverage. If you navigate away after filling out any part of the form, an unsaved changes dialog will appear. When you have finished editing, click Run Instruction.

When you run an Action you will need to follow the approval workflow. From Instruction History, click Actions and then choose Authenticate from the drop-down list. Refer to The action approval workflow.

You can also complete authentication from Endpoint Troubleshooting.
After the Instruction runs, you can view summary details like Responses, Configuration and Lifecycle from the Instruction Summary drawer.

You can reach Instruction Summary from Actions > View Details.
From Instruction Summary you can view instruction responses in Endpoint Troubleshooting by clicking View Details. Refer to Viewing responses in Endpoint Troubleshooting.

Using Search

You can execute instructions directly from Search. When you select an instruction, you'll be taken to a full-screen configuration page where you can access various options, including editing the coverage. Future updates to Search will allow you to initiate this process from other areas within the new Platform UI.

Recent searches are displayed when you click Search... or open it using Ctrl + K.
Dynamic search results yield matches from Devices, Insights, and Instructions. For instance, in our example typing the word 'run' in the search field reveals four Insights and thirty-four Instructions. These can be filtered by question or action based on their descriptions.
We select the question, What services are running? from the Instruction results which opens the I want to... page. This reveals a description of the Instruction: Retrieves all the running services. Windows Only. Additionally, we can view the Approximate Target devices with an expandable Device Breakdown by device type and operating system, as well as the Projected Impact.
From the I want to... page we can build the question using the Coverage, Duration, Response Refinement, Data Export, and Comment fields. Once we have set our Question parameters, clicking Run Instruction launches the Instruction History page.

View Instruction history

From the Instruction > Instruction History page, you can review currently running and previously executed instructions to monitor past actions and their results. You also have the ability to re-run them. Additionally, you can view detailed instruction information and see responses.

Instruction History includes features such as:

Focus on specific Applications using the Application drop-down list.
Filter, and sort data to find specific instructions.
Export the current page as a CSV file.
Search for previously run Instructions.
See the Status of instructions with colored labels to quickly understand an Instruction's current status.
Re-run an instruction from the Actions column.
Drill down to see summary details to view configuration details, and audit trail information.

Viewing responses in Endpoint Troubleshooting

You can view Instruction results by clicking View Detailed Responses for an Instruction on the Instruction > Instruction History page. This action opens Endpoint Troubleshooting in a new browser window where you can view Instruction responses, refer to Endpoint Troubleshooting History.

In addition, you can view instructions that have been run from 1E Intelligence and Inventory by navigating directly to Endpoint Troubleshooting > Instructions > History and choosing the appropriate application from the drop-down list.

Using the legacy Platform UI

Endpoint Troubleshooting involves framing questions that allow you to quickly access and explore information on connected devices.

Choosing your instruction

Clicking on the All Instructions button lets you browse through all the currently installed instructions using groups with the following options:

Group by	Description
Instruction set	This option groups instructions by the instruction set they belong to. You can click on an instruction set to expand and collapse a list of its instructions. An instruction can only belong to one instruction set.
None	This option lists all of the instructions without sets.

You can see the instruction type (question or action), name and description.

The example shows the following steps:

The user selects the All Instructions dialog for a 1E system which has had DEX Packs already added.
In the All instructions pop-up the user then takes a quick look through the available Instruction sets as selected in the Group by options.
You can expand each of the Instruction sets and select the instruction that you want to run. In our example the user expands the 1E TachyonCore set and then selects the How many of each operating system versions are installed? question.

Selecting the question loads it into Endpoint Troubleshooting You can see the text for the question loaded into the question box with its operational parameters laid out underneath.

The following table describes the available parameters:

Parameter	Description
Duration	Determines how long the data will be gathered for and how long to keep the answers for. Instructions have defaults for the number of minutes to gather data for and keep answers for. You can override either of these defaults.
Approximate Target	An estimation of how many devices will receive the question.
Projected Impact	An estimation of how much impact the question will have on the target devices. The estimate depends on previous occasions the instruction has run.
Options	Lists any additional options that have been set for the question.

To ask a question you just click the Ask this question button below the parameters. When a question is asked, the view automatically switches to its Responses page and provides immediate feedback on how the question responses are coming in. The Responses from value at the top-right of the page displays the number of devices that have responded. In our example all 12 devices respond.

The selected Instruction displays a response visualization chart and returns a list of responses. You can switch to the list by clicking the List view icon.

Interacting with a response visualization

Some questions provided in DEX Packs are defined so that their responses can be viewed as graphs.

In our example we want to know which processes have made the most connections to the Domain Controller for our example environment in the past 10 days. The question we will ask is: Which processes have made connection to <ipAddresss> in the last <numDays> days?. This question will return the information so that it can be reviewed as a graph. It also makes use of Client Activity Record, where potentially useful information about network and device performance is gathered and held by the 1E client.

The example shows the following steps of the example:

On the Endpoint Troubleshooting home page the TCNQuestioner01 user types the text which processes into the text box and then selects the Which processes have made connection to <ipAddress> in the last <numDays> days? question from the matching list.
They then set <ipAddress> to 100.100.100.100 (the IP address for the ACME Domain Controller) and <numDays> to 10.
Once the parameters are set they then click on the Ask this question button and the clients respond with the list of Process Names that have connected to that IP address.
You can interact with the charts, toggling the display for each individual process between on and off, by clicking on the name of the process displayed beneath the chart. In our example TCNQuestioner01 toggles the display of each process with the highest number of connections off to reveal the processes with less connections.
You can also investigate the individual data nodes of the graphs by hovering the mouse over the points. Here the user looks at each node in turn for ccmexec.exe.

Checking the status of responses using the summary tab

In the example we show how the Summary tab on the Responses page can be used to check the status for the responses to a question. To check the Response page Summary tab we will run a Configuration Manager client health check question.

From the Tasks view navigate to Software Vendors→Microsoft→Configuration Manager
Select the What is the health of my SCCM clients? Check that inventory has run and that policy has been evaluated in the last <numdays> days. question.
Set <numdays> to 7 and click the Ask this Question button.
When the responses start coming in for the question, select the Summary tab to see how they are progressing.

On this page you will see some statistics related to the question responses and some charts that display the information graphically.

The Sent Count chart shows the total number of questions that have been sent and the balance between the responses that have been received and the awaiting responses. As each response comes in the percentage of Responses goes up and the Awaiting goes down. This is also seen in the actual values for the Responses count and Awaiting responses count.

The Responses Status chart shows the status for each response as it comes in. For each response the status may be one of the following:

Reponses	Description
Success	Devices that have responded with a success status
Success - no content	Devices that have responded with a success status but did not provide a response to the instruction content request
Error	Devices that have responded with an error encountered when attempting to run the instruction
Not implemented	Devices that have responded where the feature contained in the instruction is not implemented on the device
Response too large	Devices that have not been able to respond to the instruction content request because their response was too large

In our example, eventually the Responses count in the Percent Sent Count chart rises to 100% indicating that all the responses have been received now (for the devices currently connected).

We can now check on the Status tab to investigate the reasons for the response statuses we've seen.
Expanding the Not implemented row, we can see that our Linux device cannot run this instruction because it uses a PowerShell script that is not supported on this Platform.
Expanding the Error row, we can see that one of our Windows 7 devices generated a PowerShell error.