Introducing Endpoint Troubleshooting

An overview of Endpoint Troubleshooting is presented; what it does and how it can benefit your organization. An introduction to the features is provided.

Introduction

Endpoint Troubleshooting is the front-end to the real-time aspects of 1E. It lets you interactively ask questions, run actions and view responses and manage operations across all your endpoints in real-time. You can also use it to view the connected client devices.

Asking questions

Using the Endpoint Troubleshooting, questions can be asked of the 1E client devices by users with the questioner or actioner roles . The responses can be viewed by viewers, questioners and actioners.

Details on asking questions can be found in Endpoint Troubleshooting Home page, questions, and responses.

Real-time 1E

1E works in real-time, so not all of the devices may be connected at the time a question is asked. Questions have a configurable duration that they will gather data for - allowing devices that connect later, within the gather data for duration, to respond.

Questions also have a configurable keep answers for duration - given that the answers from a live network can potentially get stale quickly and questions are fast enough that you can simply ask the question again rather than relying on old answers.

Coverage and filters

You can use coverage and filters to reduce the amount of network traffic caused by asking a question. They are also useful in reducing the amount of data that is presented to the 1E users. 1E provides coverage, question filters and view filters.

Coverage is applied before a question is asked and reduces how many 1E client devices get asked the question. Coverage uses the device properties that are sent by a 1E client when it connects to 1E.

Question filters are applied at the 1E client after the question has been asked and use the attributes from the question responses to determine whether the client should send the response.

View filters are applied in the Endpoint Troubleshooting after the responses have been sent and reduce the responses that are displayed.

For more information see Coverage, question filters, and view filters.

Performing actions

Normally, before an action is performed a question is asked. This identifies the set of devices the action will be performed on, after the coverage, question and view filters have been applied.

Using the Endpoint Troubleshooting, actions can be performed on the client devices by users with the actioner role on a product pack subject to the following:

they will need to enter their password

if the action has been configured to use two-factor authentication, they will need to enter the authentication code

they will need the approval of someone other than themselves with an approver role.

Details on performing actions and the approval workflow can be found in The action approval workflow.