---
title: "Automation"
description: "How Outpost configures and maintains endpoints: profiles and policy, scripts, the software catalog, patching, and vulnerability findings."
url: "https://support.outpostplatform.com/automation/"
product: "depot"
type: "concept"
status: "draft"
ai_summary: "Overview of Outpost automation. Profiles bundle policy settings and are assigned to scopes, and the agent applies the merged result. Scripts run from a signed library on demand, in batches, or on schedules. The software catalog deploys and offers applications. Patching approves and installs OS and package updates. Vulnerabilities match inventory to CVEs. All plans."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/automation/index.md"
license: "CC BY 4.0"
---

# Automation

Automation is how Outpost keeps endpoints configured and current without a
technician at each endpoint. You describe what an endpoint should look like in
profiles, run your own code from the script library, install and remove
applications from the software catalog, and approve operating system and
package updates. Every plan includes all of it.

## The parts

| Part | Where in the console | What it does |
| --- | --- | --- |
| Profiles and policy | **Profiles** | A [profile](/automation/profiles/) is a named bundle of settings from the settings catalog. You assign it to your whole client, a site, a device group, an endpoint, or people, and the agent applies the merged result. |
| Scripts | **Scripts** | The [script library](/automation/scripting/) holds PowerShell, cmd, batch, sh, bash, zsh, and Python scripts. Approving a script signs it. You run it on endpoints straight away or on a schedule. |
| Custom fields | **Scripts** > **Custom fields** | [Endpoint custom fields](/automation/custom-fields/) hold facts about an endpoint that inventory does not collect, filled in by a collector script or by hand. |
| Software | **Software** | The [software catalog](/automation/software/) lists applications you can deploy, offer in the tray for people to install themselves, require, or block. |
| Patching | **Software** > **Patching** | [Patching](/automation/patching/) is where you approve, decline, and hold updates, and where you check patch compliance. |
| Vulnerabilities | **Software** > **Vulnerabilities** | [Vulnerabilities](/automation/vulnerabilities/) matches installed software against the National Vulnerability Database and lists the CVEs found on your endpoints. |

On the MSP plan, these sections are inside each client's workspace, because
the endpoints, runs, and policy belong to one client.

## How the parts fit together

Profiles carry the rules, and the other parts act within them. A profile
decides whether an endpoint runs scripts at all, which interpreters it accepts,
and whether it refuses unsigned scripts. It sets the patch maintenance window,
which updates approve themselves, and whether the endpoint may install updates.
It lists the software an endpoint must have and the software it must not have.

Each endpoint receives its merged policy from your Outpost and keeps the copy it
last received. When you change a profile, endpoints that are connected receive
the change straight away, and the others receive it when they reconnect. An
endpoint opens its patch maintenance window, and runs scheduled scripts marked
to run offline, even while it cannot reach your Outpost.

Policy that changes the configuration of the endpoint itself, such as firewall,
password, and drive encryption settings, starts in monitor mode. The endpoint
reports what it finds and changes nothing until a profile sets
`enforcement.mode` to `enforce`. See
[Enforcement mode](/automation/profiles/#enforcement-mode).

## What each platform supports

| Feature | Windows | Linux | macOS (Preview) | FreeBSD and OpenBSD |
| --- | --- | --- | --- | --- |
| Profiles and policy enforcement | Yes | Yes | Yes | Platform-neutral settings only, no enforcement |
| Scripts | PowerShell, cmd, batch | sh, bash, zsh, Python | sh, bash, zsh, Python | sh, bash, zsh, Python |
| Software deployment | winget, Chocolatey, uploaded installers, vendor URLs | apt or dnf | Homebrew, `.pkg`, and `.dmg` | No |
| Patching | Windows Update | apt or dnf | macOS Software Update | pkg and freebsd-update (FreeBSD), syspatch and pkg_add (OpenBSD) |

See [Supported platforms](/get-started/platform-support/) for the full matrix.

## Related

- [Profiles and policies](/automation/profiles/)
- [Policy settings reference](/automation/policy-settings/)
- [Scripting](/automation/scripting/)
- [Software catalog and self-service](/automation/software/)
- [Patching](/automation/patching/)
- [Vulnerabilities](/automation/vulnerabilities/)