Device View

The Device View is a shared page accessible from many applications.

The Overview and 1E Client tabs are always present in the Device View. Other tabs are visible if an app has been installed and is licensed.

Each tab has one or more panels with tiles populated with data from various sources, some by instructions that are run instantly, with results cached for 3 minutes. An appropriate error message is displayed instead of a tile in the following circumstances:

  • If the device is offline, as indicated by the color of the icon in the top left.

  • The user does not have at least Viewer permission to view use the license the tab or panel.

  • The user does not have questioner permission to run the instruction.

  • An instruction has not been uploaded.

The Device View tabs and panels page lists the names of tabs and their panels, and a description of each tile indicating how the tile is populated.

The Device view in other 1E Platform applications

The Device View is a common view used in multiple apps to present device details. The aim of the Device view is to provide a combined overview of all the information known about a device along with the ability to retrieve information about the device in real-time. Each application displays a different default tab (see below), other tabs are visible if an application has been installed and licensed, and the user has permission to use the application.

1E application

Device page

Device page default tab

Device view

Introducing 1E Experience Analytics

Devices

Clicking on one of the links in the FQDN column of the Experience Analytics Devices page displays the Device view for the selected device. When displaying the Device view from a Experience Analytics page the view defaults to the Experience tab. The Experience tab contains information derived from and useful for Experience Analytics.

Introducing Endpoint Troubleshooting

The Devices Table

Clicking on the information icon next to the device name in the Device Name column of the Devices Table page displays the Device view for the selected device. When displaying the Device view from the Endpoint Troubleshooting Devices Table page, the view defaults to the Overview tab.

Endpoint Automation

Devices page and Devices view

Clicking on one of the links in the Device Name column of the Endpoint Troubleshooting Devices page displays the Device view for the selected device. When displaying the Device view from a Endpoint Troubleshooting page the view defaults to the Policies tab. The Policies tab contains information derived from and useful for using Endpoint Troubleshooting.

Content Distribution

Devices page

Clicking on one of the links in the FQDN column of the Content Distribution Devices page displays the Device view for the selected device. The default view in the Content Distribution devices view is Downloads.

Summary banner

The Summary banner displays a quick summary of the information provided in the various tabs displayed in the Device View. It can be viewed by toggling the Summary banner switch to on.

The following picture shows the Summary banner displayed for a particular device.

Summary banner panels

The following table describes the information provided in the Summary banner.

Panel

Description

Data source

Shows details equivalent to the following tiles:

Tab

Panel

Column

Tile

Description

Example

Overview

Details

Hardware and Operating System

Operating System

Version

Windows 10 Pro 20H2 (x86)

Hardware and Operating System

Hardware

Device Type

Desktop

 

 

Hardware and Operating System

Hardware

Manufacturer

VMware, Inc

 

 

Hardware and Operating System

Hardware

Model

VMWare Virtual Platform

 

 

Identification

Location

Location

 

 

 

Identification

Identification

Criticality

Undefined (0)

 

 

 

Data from 1E Master (the latest online status message)

Shows details equivalent to the following tiles:

Tab

Panel

Column

Tile

Description

Example

Overview

Details

Hardware and Operating System

Hardware

CPU Type

Intel(R) Xeon(R) CPU X5650 @2.67GHz x86

Hardware and Operating System

Hardware

RAM

3071 MB

 

 

Identification

Identification

1E Client

v5.2.5.251

 

 

Hardware and Operating System

Operating System

Version

v10.0.19042.746

 

 

Hardware and Operating System

Operating System

Virtual/Physical

VMWare

 

 

 

 

Shows details equivalent to the following tiles:

Tab

Panel

Column

Tile

Description

Example

Overview

Details

Identification

Location

Timezone

UTC+00 - Europe/London (Inferred)

Identification

Identification

Domain

1ETRN

 

 

Connectivity and Activity

Activity

User

1ETRN\Administrator

 

 

Connectivity and Activity

Connectivity

Local IP Address

10.0.1.3/24

 

 

 

 

 

 

Netmask

255.255.255.0

 

 

Shows details equivalent to the following tiles:

Tab

Panel

Column

Tile

Description

Example

Overview

Details

Connectivity and Activity

Connectivity

First Connected

22 March 2021, 12:17 UTC

Connectivity and Activity

Connectivity

Last Connected

27 April 2021, 09:23 UTC

 

 

Connectivity and Activity

Activity

Last Boot

18 March 2021, 12:24 UTC

 

 

 

 

 

 

Up time

a month

 

 

Shows details equivalent to the following tiles:

Tab

Panel

Column

Tile

Description

Example

Overview

Details

Identification

Grouping

Mgmt. Groups

  • All Devices

  • All Win10 Workstations

  • Servers

 

 

Exploring a device from the Device View

You can click on the Explore button in the Device View to launch Endpoint Troubleshooting with the current device set as the scope.

Closing the Device View

The Device View is a popup that is displayed when clicking on the name of a device on a page where devices are displayed. To return to the page you came from you need to click the x button.

The Device View tabs and panels

Tab

Panel

Description

Data source

Overview

 

Details

Displays a number of tiles sorted into Identification, Hardware and Operating System and Connectivity and Activity columns that show information for the selected device retrieved from the online status information stored in the 1EMaster database.

The columns and tiles are shown in the following table:

Column

Title

Description

Identification

 

 

Identification

Display's the current device:

  • FQDN

  • Name

  • Domain

  • Criticality

  • Serial Number

  • 1E Client

  • 1E GUID.

Location

Displays the device's:

  • Timezone

  • Offset

  • Location

  • Locale.

Grouping

Displays the device:

  • Tags - Freeform tags applied to the device

  • Coverage Tags - any coverage tags applied to the device. Refer to Tags.

  • Mgmt. Groups - lists the management groups the device is a member of.

Hardware and Operating System

 

Hardware

Shows hardware details for the device:

  • Virtual/Phyiscal

  • Manufacturer

  • Model

  • Device Type

  • Chassis Type

  • RAM

  • CPU Type

  • CPU Architecture

  • SMBIOS GUID.

Operating System

Shows operating system, type and version for example:

  • Type

  • Version

  • Version Number

  • Architecture

  • Installation.

Connectivity and Activity

 

Connectivity

Shows current device connectivity status:

  • Status

  • Last Connected

  • First Connected

  • Certificate Type

  • Certificate Expiry

  • Connection State

  • Local IP Address

  • MAC Address

  • Connecting IP.

Activity

Shows Last Boot date and time and current user.

 

Data from 1E Master (the latest online status message)

Environment Variables

Shows a list of the environment variables set on the device.

 

Resource Usage

Two panels:

  • Resource Usage over the last hour - shows system disk, CPU and memory usage per minute for the last one hour.

  • Resource Usage atday/month/year time - shows executable resource usage for a specific minute.

Column

Description

Product

Resource name, for example 1E Client

Executable

Resource executable, for example 1e.client.exe

Instance Count

Number of currently running instances.

Cpu Percent

Percentage of CPU currently being consumed.

Memory Virtual Mb

Virtual memory consumed in Mb.

Memory Physical Mb

Physical memory consumed in Mb.

Io Read Kb Per Second

Number of associated read input/output operations per second.

Io Write Kb Per Second

Number of associated write input/output operations per second.

Handle Count

The number of object handles.

 

1E-TachyonPlatform-Hardware-ResourceUsage

1E-TachyonPlatform-Hardware-ResourceUsageByMinute

Downloads

 

 

Summary

Download activity and status for the device. Whenever you click on an FQDN on any of the Nomad pages then the Device View will be displayed with the Downloads tab selected.

Data from Content Distribution.

Content

Shows the details of the Content on the selected device.

Column

Description

Content Titles

Title of the content.

Type

Type of the content.

Status

Status of the content.

Latest Activity

Last activity done.

Duration (DD:HH:MM:SS)

Duration of the last activity.

Download Bytes

Download bytes of the content.

Content Source

Source of the content.

You may see a difference in the number of items in a device’s Nomad cache versus that displayed in the Content Distribution app Device View. This is because if downloaded content has been deleted from Configuration Manager, the content titles cannot be resolved in the Content Distribution app and are not displayed. This is under consideration for re-design and may be revised in future versions of Content Distribution.

Data from Content Distribution.

Nomad Configuration

Shows all the registry settings for the 1E Nomad Branch service.

1E-Nomad-NomadBranchSettings

Experience

 

 

 

 

Metrics

Metrics are the data points that are collected by the 1E Client and sent to the 1E server. They are collected at different intervals depending on the type of data that is being collected.

Data from Experience metrics

Trends

The Trends tab shows the changes in the scores over time. Hovering over the chart shows the details for that time and event. The user has the ability to select the metrics and events as per the requirement. They can move the required metrics from available to visible to see the trend charts.

Data from Experience metrics

Logs

The Event Logs tab gives you a listing of the Windows Event log entries for that device. This brings that data to this view and is very useful when determining the root cause of an issue that has been reported on the device.

Data from Experience metrics

Application Interactions

 Shows user interaction times and ratios across applications measured over the last 30 days

1E-Experience-ApplicationInteraction

User interactions

Shows user interactive sessions with activity over last 30 days.

1E-Experience-UserInteractionHistory

Hardware

 

Disk drives

Shows disk drives, including hardware and usage information.

Column

Description

Drive

Drive letter.

Volume Name

Volume name, if set.

Drive Type

Drive type, for example:

  • Removable Disk

  • Local Disk

  • Compact Disk.

Size Gb

Total disk size in Gb.

Free Space Gb

Current free space in Gb.

Usage Percent

Percentage used of total drive space.

File System

File system, for example NTFS.

Manufacturer

Standard or SSD drive.

Model

Drive manufacturer.

Serial Number

Unique disk serial number.

Partition

Drive and partition of the specific drive.

Firmware Revision

Drive firmware version.

Device ID

Device ID of the specified disk.

 

1E-TachyonPlatform-Hardware-DiskDrives

Peripherals

 

Shows the list of plug and play hardware devices (Windows only).

Column

Description

Device Type

Hardware device, including for example things like:

  • Battery

  • Monitor

  • Keyboard

  • Mouse

  • Ports

  • SoftwareDevice.

Name

Device name.

Instance Count

Number of instances of a periperal device.

Service

Associated Windows service, for example atapi, serial, PCI, ACPI.

 

1E-TachyonPlatform-Hardware-Devices

Network

 

 

 

 

 

 

Throughput

Shows network throughput on all adapters for the last hour, represented by the following tiles:

  • Average throughput - including Timestamp, Bytes Received per Second, Bytes Sent Per Second

  • Bytes received per second

  • Bytes sent per second.

1E-TachyonPlatform-Network-AverageThroughput

Interface configuration

Returns the output from the native network interface configuration command (e.g. ipconfig or ifconfig).

1E-TachyonPlatform-Network-InterfaceConfiguration

DNS

Shows the Cache and Host file tiles:

  • DNS Cache Contents - with the entries from local DNS cache, Host Name and Address.

  • HOSTS file - shows the content of the drivers/etc/hosts file.

1E-TachyonPlatform-Network-DnsCache

1E-TachyonPlatform-Network-HostFileContent

TCP connections

 

Returns a list of established TCP connections.

Column

Description

Process Name

Local process name.

Process Id

Uniquely identifies an active process.

Class

Class of Internet networking protocol.

Local Address

Local network address.

Local Port

Network port used by a specific process.

Remote Address

Source IP address from which the traffic came from.

Remote Port

Remote port used by a specific process.

Latency Ms

The time taken in milliseconds for data or a request to go from a source to a destination.

1E-TachyonPlatform-Network-TcpConnections

Listening ports

 

Returns a list of processes which are listening for network connections.

Column

Description

Process Name

Local process name.

Process Id

Uniquely identifies an active process.

Class

Class of Internet networking protocol.

Local Address

Local network address.

Local Port

Network port used by a specific process.

Product

Related product, for example host process for Windows Services, Local Security Authority Process, SCNotification.

1E-TachyonPlatform-Network-ListeningPorts

ARP Cache

Returns a list of processes which are listening for network connections and also shows routing tables.

1E-TachyonPlatform-Network-ArpCache

1E-TachyonPlatform-Network-RoutingTable

WIFI

 

Shows a list of visible wifi networks, including basic network properties.

Column

Description

SSID

WiFi network name.

Is Connected

Shows as either true or false, dependent on whether the corresponding adapter is connected to the network.

Is Hidden

Shows as true if the WiFi network is not broadcasting a public SSID.

Is Secure

Shows as either true or false:

  • true - if the WiFi network is secure.

  • false - if the network is open.

Signal

Shows WiFi signal quality; from 0 (worst) to 100 (best).

Authentication

The default authentication mechanism supported by the network.

BSSI IDs

The Service Set Identifier (SSID) of the network, it will be empty if the network is hidden.

Encryption

Shows the default encryption mechanism supported by the network.

Adapter

Shows the WiFi network adapter name to which this network is visible.

1E-TachyonPlatform-Network-WiFiNetworks

Policies

 

Rules Compliance

Shows a list of the rules applied.

Column

Description

Rule Name

Name of rules applied to the current device. The viewable list relates to the selected 1E policy from the policy dropdown on the page.

State

If the device state is Compliant, Noncompliant or Not Applicable.

Type

Rule type:

  • Check - allows you to verify that a device has a particular state, such as a registry key having a specific value

  • Fix - allows you to define a desired state for the device and then enforce that state.

Effectiveness

Policy rule effectiveness is the usefulness of policy rules and is represented as either:

  • Disabled - the rule has not yet been enabled from the Endpoint Automation Rule Administration page, so it is not currently active

  • Unassigned - the rule is enabled, but has not been deployed to any devices

  • Ineffective - the rule has been deployed, but no devices have changed their compliance position for this rule in the last thirty days

  • Effective - the rule has been deployed and at least one device has changed its compliance position for this rule in the last thirty days.

History

Rule history.

Data from Endpoint Automation

Diagnostics

Shows the diagnostic information about the policy applied (rules and event subscriptions)

 

 

 

Software

 

 

 

Normalized Software

Shows a comprehensive list of all normalized software installed on this device.

Column

Description

Vendor

Software vendor.

Title

Software product title.

Version

Product version number.

Edition

Product edition number

Installation Date

Software installation date.

 

All Software

Shows a complete list of all software installed on the device, including unmatched software.

Column

Description

Publisher

Software publisher.

Product Name

Software product name.

Source Version

Product source version number.

Source Edition

Product source edition

Architecture

Instruction set architecture (ISA) version.

Normalized

Software Normalized status

Installation Date

Software installation date.

 

Installations

Shows (per-device) installed software.

Column

Description

Product

Software product name.

Publisher

Software publisher.

Version

Product version number.

Architecture

Instruction set architecture (ISA) version.

Install Date

Software installation date.

 

1E-TachyonPlatform-Software-Installations

Windows Services

 

Shows list of installed Windows services and their current state.

There are search and filter options available to find the Windows services from the available list. It also allows to export the data as a CSV file.

Column

Description

Name

Windows service name.

State

Windows service state, Running or Stopped.

Startup Type

Windows service startup type, for example Automatic, Automatic (Delayed Start), Manual, Disabled.

Process Id

Uniquely identifies an active process.

Description

Windows service description.

Logon Account

Windows service logon account context.

Type

Windows services type, for example file system driver, kernel driver, shared process.

1E-TachyonPlatform-Software-Services

Environment Variables

Shows operating system environment variables.

1E-TachyonPlatform-Software-EnvironmentVariables

Process History

 

Shows detailed information about all running processes.

There are search and filter options available to find the process from the available list.

Column

Description

Product

Software product name.

Executable

Executable name.

Version

Product version number.

Architecture

Instruction set architecture (ISA) version.

Platform

Platform name.

Crashes

Number of times this software crashed during the last 24-hour reporting period.

Hangs

Number of times this software crashed during the last 24-hour reporting period.

Software crash and hang information is obtained from Windows event data.

Performance anomalies

Number of performance anomalies detected in this software during the last 24-hour reporting period.

I/O Read KB/s

Average disk I/O read rate per second during the last 24-hour reporting period.

I/O Write KB/s

Average disk I/O write rate per second during the last 24-hour reporting period.

For background information on analyzing disk storage performance refer to https://docs.microsoft.com/en-gb/archive/blogs/cotw/analyzing-storage-performance

Virtual Memory Usage KB

Average Virtual Memory Usage KB during the last 24-hour reporting period.

For an explanation of Windows Virtual Memory organization refer to https://answers.microsoft.com/en-us/windows/forum/windows_10-performance/physical-and-virtual-memory-in-windows-10/e36fb5bc-9ac8-49af-951c-e7d39b979938 and https://support.microsoft.com/en-us/help/2160852/ram-virtual-memory-pagefile-and-memory-management-in-windows

Processor Time Seconds

Each instance of the executable will burn processor time. This column gives the average of the total time consumed by each process instance per second. Each instance uses the sum of all time used by each core in parallel.

Therefore, it is possible to see more seconds here than in a day (usually 60 x 60 x 24 = 86400) for the whole column, if your system is working extremely hard 24x7. The theoretical maximum would be somewhere near number of cores  x seconds per day . Hence, 'Processor Time' rather than 'Human Time'

Processor Time %

This is an easier notion than Processor Time Seconds. This is the average of the processor consumption of each instance. Each instance of this process will have caused different percentages of compute resource in all the processors and cores to be used over time (unless they have specifically requested certain core affinity).

For each minute each process is running, a profile of the usage is built for the whole day. This value is the average of all of those samples. There is no way to work out, for any one of the process instances involved, how long any particular instance was running for. This could indicate a process that is going wild with resources, but it would take more investigation on the device to discover for how long this is happening. It is perfectly possible to see all the values in this column adding up to more than 100% as the processes were not necessarily running at the same time.

For further information on Processor time refer to https://social.technet.microsoft.com/wiki/contents/articles/12984.understanding-processor-processor-time-and-process-processor-time.aspx

Responsiveness Impact %

An indicator of how reactive a process is to activity by other processes on the device. Typically, anti-virus products watch and respond to potentially suspicious activity such as increased network traffic. Anti-virus products will differ in their impact on the overall performance of a device.

Responsiveness Impact % is used to indicate how sensitive a process appears to be to the use of system resources by other processes on a device. For example, Security Protection software present on a device may reveal a spike in its activity whenever a new process is started on that device.

This would typically be because the Security Protection software may wish to ensure that the new process starting on the device is present in a security white list. Other software may also react to activity by other processes and by reacting they impact system resource uses, thereby adversely affecting the user's experience. So it is useful to be able to identify software with the highest Responsiveness Impact on a device and potentially investigate further.

Responsiveness Impact % represents the proportion of the increased CPU activity detected by the 1E Client as a result of performing a set of operating system-level operations that can be attributed to a given running process. Examples of these would be Windows registry and resource creation operations.

It is reported as a percentage to normalize results across devices that offer a range of computing power.

For example, if software.exe on a device is attributed a Responsiveness Impact of 53% this means that more than half of the spike in CPU usage caused by software monitoring activity on that device can be attributed to software.

Handle Count

Average number of Windows handles used by this software during the last 24-hour reporting period.

For further information on Windows handles refer to https://docs.microsoft.com/en-us/windows/win32/sysinfo/handles-and-objects

For tips on examining open handles for any Windows process refer to https://docs.microsoft.com/en-us/sysinternals/downloads/handle and https://techcommunity.microsoft.com/t5/windows-blog-archive/pushing-the-limits-of-windows-handles/ba-p/723848

Physical Memory Usage KB

Average Physical Memory Usage KB during the last 24-hour reporting period.

Please refer to https://docs.microsoft.com/en-us/sysinternals/downloads/rammap for a useful tool to examine physical memory allocation on a device.

1E-TachyonPlatform-Software-Processes

1E Client

 

 

 

 

Binaries

Shows a list of the binary files in the executable folder of the 1E Client.

Column

Description

File Name

Associated 1E Client file name.

File Version

Software version.

File Size

File size in bytes.

Description

File description

Date Created

The date the file was written to disk.

Date Modified

The date the file was last saved.

 

1E-TachyonPlatform-Client-Binaries

Configuration file

Shows the full content of the 1E Client configuration file, including:

  • Logging settings

  • Communication settings

  • Agent settings

  • Module settings.

1E-TachyonPlatform-Client-ConfigFileContent

Extensibility

 

Shows extensibility objects (modules and providers) loaded by the 1E Client.

Column

Description

Type

Module or Provider component.

Binary Name

Associated 1E Client binary name, for example 1E.Client.Module.Interaction.dll

Name

Name, for example Interaction.

Version

1E Client version

1E-TachyonPlatform-Client-Extensibility

Local Storage

Shows Data Files and Client Inventory Database Use tiles that display the list of:

  • Data files (logs, databases, etc) created by the 1E Client.

  • Tables in the1E Client Inventory database, along with a row count per table.

1E-TachyonPlatform-Client-DataFiles

1E-TachyonPlatform-Client-InventoryDatabaseUse

Product Pack references

The Device View page requires the following feature-related Product Packs that contain instructions used by the page.

Product Pack name

Instruction name

Device View panel

Readable Payload

1E-Experience

1E-Experience-ApplicationInteraction

Experience\Application Interaction

User interaction across applications

1E-Experience

1E-Experience-LogonSessions

n/a

Current user logon sessions

1E-Experience

1E-Experience-UserInteractionHistory

Experience\User Interaction

Get user interaction history over last 30 days

1E-Nomad

1E-Nomad-NomadBranchSettings

Downloads\Nomad Configuration

Nomad Branch service settings

1E-Tachyon-Platform

1E-TachyonPlatform-Client-Binaries

1E Client\Binaries

List deployed 1E Client binary files

1E-Tachyon-Platform

1E-TachyonPlatform-Client-ConfigFileContent

1E Client\Configuration File

Show 1E Client configuration file content

1E-Tachyon-Platform

1E-TachyonPlatform-Client-DataFiles

1E Client\Local Storage

List 1E Client data files

1E-Tachyon-Platform

1E-TachyonPlatform-Client-Extensibility

1E Client\Extensibility

Show 1E Client extensibility (modules and providers)

1E-Tachyon-Platform

1E-TachyonPlatform-Client-InventoryDatabaseUse

1E Client\Local Storage

List of inventory database tables

1E-Tachyon-Platform

1E-TachyonPlatform-Hardware-Devices

Hardware\Peripherals

List of hardware devices

1E-Tachyon-Platform

1E-TachyonPlatform-Hardware-DiskDrives

Hardware\Disk Drives

List disk drives

1E-Tachyon-Platform

1E-TachyonPlatform-Hardware-ResourceUsage

Overview\Resource Usage

Hardware resource usage over time

1E-Tachyon-Platform

1E-TachyonPlatform-Hardware-ResourceUsageByMinute

Overview\Resource Usage

Resource usage by executable for %minute%

1E-Tachyon-Platform

1E-TachyonPlatform-Network-ArpCache

Network\ARP and Routing

List entries in ARP cache

1E-Tachyon-Platform

1E-TachyonPlatform-Network-AverageThroughput

Network\Throughput

Network throughput for last 60 minutes

1E-Tachyon-Platform

1E-TachyonPlatform-Network-DnsCache

Network\DNS

DNS cache entries

1E-Tachyon-Platform

1E-TachyonPlatform-Network-HostFileContent

Network\DNS

Host file content (for DNS overrides)

1E-Tachyon-Platform

1E-TachyonPlatform-Network-InterfaceConfiguration

Network\Interface configuration

Network interface configuration

1E-Tachyon-Platform

1E-TachyonPlatform-Network-ListeningPorts

Network\Listening ports

Processes listening on TCP and UDP ports

1E-Tachyon-Platform

1E-TachyonPlatform-Network-RoutingTable

Network\ARP and Routing

Routing table information

1E-Tachyon-Platform

1E-TachyonPlatform-Network-TcpConnections

Network\TCP connections

Established TCP connections

1E-Tachyon-Platform

1E-TachyonPlatform-Network-WiFiNetworks

Network\WiFi

List visible WiFi networks

1E-Tachyon-Platform

1E-TachyonPlatform-Software-EnvironmentVariables

Software\Env. Vars

List environment variables

1E-Tachyon-Platform

1E-TachyonPlatform-Software-Installations

Software\Installations

List software installations

1E-Tachyon-Platform

1E-TachyonPlatform-Software-Processes

Software\Processes

List running process details

1E-Tachyon-Platform

1E-TachyonPlatform-Software-Services

Software\Windows Services

List Windows Services