Devices

Device Inventory is similar to the Devices view in Endpoint Troubleshooting, but has extended features you can use to include all device data. Device inventory is available in both Inventory Insights and Endpoint Troubleshooting.

KPI cards

At the top of the page, there are KPI cards displaying the following:

Devices: Total count of different types of devices across manufacturers and operating systems.
Critical Devices: Devices whose criticality has been assigned as critical.
Inactive Devices: Devices that have been offline for 30 days or more.

Filtering and columns

You have the option to filter the page on Device Status as either Online, Offline or All by clicking the drop-down menu on the top right corner of the page. The list shows real-time, detailed information about all 1E devices in your environment.

Each page in Inventory Insights includes tools to help you customize your view and to interrogate your software data, refer to Page toolbar Search, Filters, Columns, Export for details.

Device View

Selecting a device from the devices page opens its Details which includes real-time response information.

Device details summary card

Gives you an review an overview of the current device.

Hover over last seen to view its UTC timestamp.
Customize items on the card by pinning them from device Details. Hover over an item to reveal its pin.

Device details

Explore every attribute gathered by the 1E Client for a device. Review each section to get a comprehensive view of the device profile and its current status. You can personalize the display by collapsing sections with the chevrons on each panel and rearranging them using drag and drop.

Device detail menu items

Menu item	Description
Overview	Details: Gain full visibility into the attributes collected by the 1E Client for a device. Environment Variables: Show operating system environment variables. Resource Usage: Examine the CPU, memory, and disk activity on the chart for the last hour. Insights: Displays a table that replicates the insights dashboard.
Downloads	Summary: Download activity and status for the device. Whenever you click on an FQDN on any of the Nomad pages, the Device View will be displayed with the Downloads tab selected. Content: Shows the Contents Titles on the selected device. The default view is from All Sources, All Types and All Status.
Hardware	Disk Drives: Show disk drives, including hardware and usage information. Peripherals: Shows the list of plug and play hardware devices (Windows only).
Software	Normalized Software: View and manage a comprehensive list of all normalized software installed on a device. All Software: Access a complete list of all software installed on a device, including unmatched software. Installations: Shows (per-device) installed software. Windows Services: Shows a list of installed Windows services and their current state. Process History: Shows detailed information about all running processes.
Network	Throughput: Examine the network throughput activity on a device. Interface Configuration: Returns the output from the native network interface configuration command (for example, ipconfig or ifconfig). DNS: Understand the device's DNS status and configuration. TCP Connections: Returns a list of established TCP connections. Listening Ports: Returns a list of processes that are listening for network connections. ARP Cache: Shows the list of entries in the local ARP (Address Resolution Protocol) cache. WiFi : Show a list of visible wifi networks, including basic network properties. Platforms: Windows, macOS.
Patch Insights	Patch Status: View patch status for a device, deploy one or more patches for that device, and view related event logs.
Experience	Application Interaction: Analyze how users interact with applications on a device. User Interaction: Show user interactive sessions with activity over last 30 days. Trends: The Trends tab shows the changes in the scores over time. Logs: The Event Logs tab gives you a listing of the Windows Event log entries for that device. Metrics: Metrics are the data points that are collected by the 1E Client and sent to the 1E server.
Policies	Rules Compliance: Shows a list of the rules applied. Diagnostics: Returns diagnostic information about the policy applied (rules and event subscriptions).
1E Client	Binaries: Shows a list of the binary files in the executable folder of the 1E Client. Configuration File: Shows the full content of the 1E Client configuration file. Extensibility: Shows extensibility objects (modules and providers) loaded by the 1E Client. Local Storage: Shows Data Files and Client Inventory Database Use tiles. Nomad Configuration: Shows all the registry settings for the 1E Nomad Branch service.

Run Instructions and view Instruction history

You can search for, and run an instruction against a set of devices, from the Devices page, or 1E Intelligence >Insight > Insights details pages.

Devices page: Select one or more devices from the device grid, or select the Investigate button on the Device details summary card.
Intelligence Insight page: Select Investigate on the Insight summary card, refer to Insight details.

The ability to run Instructions is controlled by Role-Based Access Control (RBAC).

Run an Instruction

If you are unfamiliar with running Instructions in the 1E Platform, refer to Endpoint Troubleshooting to get started.

For both 1E Intelligence and Devices, clicking Run Instruction opens the Run Instruction drawer.
From the Run Instruction drawer, search for an Instruction, or choose one from:
- Recommended Instructions: If you are in 1E Intelligence > Insights.
- Recent Instructions: If you are on the Devices page.
Click More Options to configure Instruction parameters. You can configure every parameter except for coverage. If you navigate away after filling out any part of the form, an unsaved changes dialog will appear.
When you have finished editing, click Run Instruction.

When you run an Action from 1E Intelligence, you will need to navigate to Endpoint Troubleshooting and add the Authorization code. Refer to The action approval workflow.
To view progress, click the link in the popup Instruction is now running. View it here to open Instruction History.
In both 1E Intelligence and Inventory, you can view instruction responses in Endpoint Troubleshooting by viewing Instruction Details and clicking View Detailed Responses, refer to Viewing responses in Endpoint Troubleshooting.

View Instruction history

From the Instruction > Instruction History page you can review running, and previously executed instructions to monitor past actions and their results, with the ability to re-run them. Additionally, you can view detailed instruction information and see responses.

Instruction History includes features such as:

Focus on specific Applications using the Application drop-down list.
Filter, and sort data to find specific instructions.
Export the current page as a CSV file.
Search for previously run Instructions.
See the Status of instructions with colored labels to quickly understand an Instruction's current status.
Re-run an instruction from the Actions column.
Drill down to see summary details to view configuration details, and audit trail information.

Viewing responses in Endpoint Troubleshooting

You can view Instruction results by clicking View Detailed Responses for an Instruction on the Instruction > Instruction History page. This action opens Endpoint Troubleshooting in a new browser window where you can view Instruction responses, refer to Endpoint Troubleshooting History.

In addition, you can view instructions that have been run from 1E Intelligence and Inventory by navigating directly to Endpoint Troubleshooting > Instructions > History and choosing the appropriate application from the drop-down list.