Policy settings reference

This page lists every setting a profile can set, as defined by the settings catalog, including the remote shell control in Depot 0.6.0. It does not cover how to build a profile; see Create and assign a profile.

Scope

• The catalog is maintained by Outpost. Releases can add settings.
• Every setting is listed, grouped by the category the console shows on a profile’s Settings tab. Categories and rows are in alphabetical order.
• What it does is the catalog’s own description, shortened to its first sentence. The Settings tab shows the full description and the compliance framework badges for each setting.

How to read the tables

Type is the kind of value the setting takes:

Type	Values
Boolean	true or false
Integer	A whole number
Seconds	A whole number of seconds. 0 means no limit where the setting says so.
Bytes	A whole number of bytes
String	Text. Empty means unset or the default, as the row says.
Choice	One of the listed options
List	A list of strings. Where options are listed, only those values are allowed.
Object	A JSON object, used for backup retention schedules

Default is the value that applies when no profile sets the setting.

Platforms says where the agent applies the setting:

Value	Meaning
Any	One mechanism in the agent on every platform that applies profiles: Windows, Linux, and macOS.
Windows, Linux, macOS	Only the platforms named. An endpoint on another platform reports Not supported on this OS. A setting with backends for more than one platform can take a per-OS variant.
Server	Your Outpost resolves and applies the setting itself. Nothing on the endpoint reads it.
None	No platform applies the setting in this version.

FreeBSD and OpenBSD endpoints apply only settings that are not tied to a platform, such as the patch.* install and maintenance-window settings. They enforce no operating system settings.

Merge is how two values combine when two profiles at the same rank set the setting, or when two mandatory values meet. Between different ranks the higher rank wins, whatever the merge rule. See How profiles merge.

Merge	Result
On wins	true if any value is true.
Off wins	false if any value is false.
Smallest, Largest	The smaller or larger number.
Smallest above 0, Largest above 0	The smaller or larger number, where 0 means no limit and loses to any positive value.
Strictest	The option latest in the listed order. Options are listed least restrictive first.
Common values	Only the values every list contains.
Common values, strictest	Only the values every list contains. If the lists share none, the strictest value either list would allow.
Combined	Every value from every list.
Single value	No combining. Two different values at the same rank are reported as a conflict. Use different ranks.

Cannot be made mandatory marks the few settings the catalog does not let you pin. See Mandatory settings.

Antimalware

Key	Type	Default	Platforms	Merge	What it does
antimalware.cloud_protection_level	Choice	high	Windows	Strictest	How aggressively cloud-delivered protection blocks unknown files. Options, least to most restrictive: not_configured, high, high_plus, zero_tolerance.
antimalware.excluded_paths	List	Empty	Windows	Common values	Paths excluded from scanning.
antimalware.macos_gatekeeper_enabled	Boolean	false	macOS	On wins	Turns on Gatekeeper on macOS endpoints with spctl --global-enable, so downloaded apps are checked for a valid signature and notarization, and scanned by XProtect, before they first open.
antimalware.pua_protection	Boolean	true	Windows	On wins	Block potentially unwanted applications such as bundled adware and crypto miners.
antimalware.real_time_protection	Boolean	true	Windows	On wins	Keep real-time antimalware scanning on.
antimalware.signature_update_interval_seconds	Seconds	14400 (4 hours)	Windows	Smallest above 0	How often malware definitions are refreshed, in seconds.
antimalware.tamper_protection	Boolean	true	Windows	On wins	Prevent local changes to antimalware settings, including by an administrator or by malware that has gained one.

Appearance

Key	Type	Default	Platforms	Merge	What it does
appearance.desktop_wallpaper_style	Choice	fill	Windows	Single value	How the desktop background image is scaled to the screen. Options: tile, center, stretch, fit, fill. Cannot be made mandatory.
appearance.desktop_wallpaper_url	String	Empty	Windows, Linux, macOS	Single value	URL of the desktop background image pushed to the endpoint. Cannot be made mandatory.
appearance.lock_screen_image_url	String	Empty	Windows	Single value	URL of the lock screen image. Cannot be made mandatory.
appearance.show_desktop_icons	Boolean	true	Windows	Single value	Whether desktop icons are visible. Cannot be made mandatory.
appearance.taskbar_alignment	Choice	left	Windows	Single value	Where the Windows 11 taskbar buttons sit. Options: center, left. Cannot be made mandatory.
appearance.theme_mode	Choice	system	Windows, macOS	Single value	Light or dark application theme, or whatever the system is set to. Options: system, light, dark. Cannot be made mandatory.

Audit

Key	Type	Default	Platforms	Merge	What it does
audit.linux_auditd_enabled	Boolean	false	Linux	On wins	Run the Linux audit daemon, start it at boot, and load Outpost’s baseline rules (/etc/audit/rules.d/50-outpost.rules: account databases, sudo, SSH server, PAM and audit configuration, login records).
audit.logon_events	Boolean	true	Windows	On wins	Audit successful and failed sign-in attempts.
audit.policy_change	Boolean	true	Windows	On wins	Audit changes to security and audit policy, which is what makes tampering with the audit trail itself visible.
audit.process_creation_command_line	Boolean	true	Windows	On wins	Include the full command line in process creation audit events, which is the difference between knowing a script ran and knowing what it did.
audit.security_log_max_bytes	Bytes	201326592 (192 MiB)	Windows	Largest	Maximum size of the local security event log, in bytes.

Backup

Key	Type	Default	Platforms	Merge	What it does
backup.allow_metered	Boolean	false	Any	Off wins	Whether backups may run while the endpoint is on a metered connection such as a phone hotspot.
backup.allow_on_battery	Boolean	false	Any	Off wins	Whether backups may run while a laptop is on battery.
backup.browser_download_max_bytes	Bytes	2000000000 (2 GB)	Any	Smallest above 0	The largest selection a technician may download from a backup as a zip in the browser, in bytes.
backup.delete_floor_days	Integer	7	Any	Largest	How many days every backup object is protected from deletion, so ransomware on the endpoint cannot erase recent backups.
backup.enabled	Boolean	false	Any	On wins	Whether Outpost Backup protects this endpoint.
backup.exclude_paths	List	Empty	Any	Combined	Files and folders never to back up, as paths or glob patterns.
backup.image_retention	Object	{"latest": 0, "hourly": 0, "daily": 0, "weekly": 4, "monthly": 3, "annual": 0}	Any	Single value	Which system images to keep.
backup.image_schedule	String	0 2 * * 0	Any	Single value	When the system image runs, as a five-field cron expression in the endpoint’s local time.
backup.include_downloads	Boolean	false	Any	On wins	Whether each user’s Downloads folder is backed up along with Desktop, Documents, Pictures, Videos, Music and Favorites.
backup.include_paths	List	Empty	Any	Combined	Extra files and folders to back up, as paths or glob patterns, in addition to each user’s standard folders.
backup.object_lock	Boolean	true	Any	On wins	Whether to apply S3 Object Lock retention to backup objects when the bucket supports it, so even someone holding the bucket’s keys cannot delete them early.
backup.post_script_id	String	Empty	Any	Single value	A script from the library to run after every backup, named by script id.
backup.pre_patch	Boolean	false	Any	On wins	Whether to take a backup before installing patches.
backup.pre_script_id	String	Empty	Any	Single value	A script from the library to run before every backup, named by script id.
backup.primary_interval_minutes	Integer	240	Any	Smallest above 0	How often the primary file backup runs, in minutes.
backup.primary_retention	Object	{"latest": 6, "hourly": 0, "daily": 14, "weekly": 8, "monthly": 12, "annual": 0}	Any	Single value	Which primary file snapshots to keep, grandfather-father-son style.
backup.primary_storage_profile_id	String	Empty	Any	Single value	The storage destination the primary backup is written to, named by a storage profile id.
backup.secondary_interval_minutes	Integer	1440	Any	Smallest above 0	How often the secondary file backup runs, in minutes.
backup.secondary_retention	Object	{"latest": 3, "hourly": 0, "daily": 7, "weekly": 4, "monthly": 6, "annual": 0}	Any	Single value	Which secondary snapshots to keep.
backup.secondary_storage_profile_id	String	Empty	Any	Single value	An optional second destination for a 3-2-1 copy: an independent repository with its own key, schedule and retention.
backup.self_service_restore	Boolean	true	Any	Off wins	Whether people can restore their own files from the tray.
backup.system_image	Boolean	false	Any	On wins	Whether to back up the whole system as well as files: a disk image on Windows, every local filesystem plus the disk layout on Linux, and the data volume on macOS.
backup.upload_limit_kbps	Integer	0	Any	Smallest above 0	The most bandwidth backup may use to upload from this endpoint, in kilobits per second.
backup.verify_interval_days	Integer	7	Any	Smallest above 0	How often, in days, the endpoint checks that its backups can actually be restored, by verifying a sample of the repository and restoring a few files to a temporary folder.

Browser

Key	Type	Default	Platforms	Merge	What it does
browser.allowed_url_list	List	Empty	Windows	Common values	URL patterns exempted from the block list.
browser.block_password_manager	Boolean	false	Windows	On wins	Stop the browser saving passwords locally.
browser.blocked_url_list	List	Empty	Windows	Combined	URL patterns the browser refuses to load.
browser.enforce_safe_browsing	Boolean	true	Windows	On wins	Keep the browser’s malicious site and download protection on.
browser.extension_install_blocklist	List	Empty	Windows	Combined	Extension ids the browser refuses to install.
browser.incognito_mode_availability	Choice	enabled	Windows	Strictest	Whether private browsing windows may be opened. Options, least to most restrictive: enabled, disabled.

Chat

Key	Type	Default	Platforms	Merge	What it does
chat.away_minutes	Integer	30	Any	Smallest above 0	How long a technician who has marked themselves available may be idle before Outpost marks them away and stops offering them chats, in minutes.
chat.enabled	Boolean	true	Any	Off wins	Whether the people in this scope can start a live chat with the support desk from the tray.
chat.max_concurrent	Integer	3	Any	Smallest above 0	How many live chats one technician may hold at the same time.
chat.queue_seconds	Integer	45	Any	Smallest above 0	How long a chat rings the available technicians before it is marked missed and turned into a ticket, in seconds.
chat.retention_days	Integer	365	Any	Smallest above 0	How many days a finished chat transcript is kept before it is removed for good.

Compliance

Key	Type	Default	Platforms	Merge	What it does
compliance.endpoint_audit_retention_days	Integer	365	Any	Largest	How long the endpoint settings audit trail and each endpoint’s Connected from history are kept, in days. 0 keeps them forever.
compliance.evidence_retention_days	Integer	365	Any	Largest	How long a generated compliance evidence pack is kept, in days.
compliance.target_frameworks	List	Empty	Server	Combined	Which compliance frameworks this scope is audited against. Contractual frameworks turn their baselines into enforced floors. stig, ms_baseline, and cis are advisory. Options: soc2, cjis, pci_dss, hipaa, nist_800_171, nist_800_53, cmmc_l2, iso_27001, stig, ms_baseline, cis.

Credentials

Key	Type	Default	Platforms	Merge	What it does
credentials.local_admin.account_name	String	Empty	Windows	Single value	Which local account Outpost manages.
credentials.local_admin.create_if_missing	Boolean	false	Windows	Off wins	Whether to create the named account, as a local administrator, when it is not there.
credentials.local_admin.enabled	Boolean	false	Windows	On wins	Whether Outpost manages a local administrator account’s password on this endpoint, rotating it on a schedule and escrowing every password in the vault before it is set.
credentials.local_admin.password_charset	List	lower, upper, digits, symbols	Windows	Common values, strictest	Which character classes the generated password may draw on, with at least one character from each selected class present. Options, least to most restrictive: lower, upper, digits, symbols.
credentials.local_admin.password_length	Integer	20	Windows	Largest	How many characters the generated password has, from 12 to 64.
credentials.local_admin.post_rotation_action	Choice	none	Windows	Single value	What else to do once the password is rotated. Options: none. Cannot be made mandatory.
credentials.local_admin.rotation_interval_days	Integer	30	Windows	Smallest	How often the managed account’s password is rotated, in days, from 1 to 365.

Device activity

Key	Type	Default	Platforms	Merge	What it does
device_activity.alert_on_driver_change	Boolean	true	Any	On wins	Whether a driver being installed, removed or moved to a different version on one of this scope’s endpoints raises an alert.
device_activity.alert_on_netdrive_change	Boolean	false	Any	On wins	Whether a network drive being mapped or unmapped in a signed-in user’s session raises an alert.
device_activity.alert_on_service_change	Boolean	true	Any	On wins	Whether a Windows service being installed, removed, or moved to a different start type on one of this scope’s endpoints raises an alert.
device_activity.alert_on_unc_change	Boolean	false	Any	On wins	Whether a connection to a share with no drive letter, opened by typing a path such as the one Explorer’s address bar accepts, raises an alert.
device_activity.alert_on_usb_other	Boolean	false	Any	On wins	Whether every other kind of USB device raises an alert: keyboards, mice, headsets, phones, dongles and docks.
device_activity.alert_on_usb_storage	Boolean	true	Any	On wins	Whether a USB mass storage device arriving at or leaving one of this scope’s endpoints raises an alert.
device_activity.enabled	Boolean	true	Any	Off wins	Whether Outpost watches this scope’s endpoints for device and network changes: USB arrivals, driver installs and removals, mapped network drives, and connections to a share with no drive letter.
device_activity.user_session_poll_seconds	Integer	120	Any	Smallest above 0	How often the tray re-checks which network connections the signed-in user’s session holds, in seconds.

Device control

Key	Type	Default	Platforms	Merge	What it does
device_control.allowed_usb_device_ids	List	Empty	Windows	Common values	Hardware ids of USB devices permitted despite the storage policy, for approved encrypted drives.
device_control.autorun_disabled	Boolean	true	Windows	On wins	Disable autorun and autoplay for removable media.
device_control.block_bluetooth_file_transfer	Boolean	false	Windows	On wins	Block file transfer over Bluetooth, which is removable media without the removable part.
device_control.usb_storage_encryption_required	Boolean	false	Windows	On wins	Require removable storage to be encrypted before it can be written to.
device_control.usb_storage_policy	Choice	read_write	Windows	Strictest	What removable USB storage may do on this endpoint. Options, least to most restrictive: read_write, read_only, blocked.

Discovery

Key	Type	Default	Platforms	Merge	What it does
discovery.arp_rate_pps	Integer	10	Any	Smallest above 0	Most ARP requests per second a sweep may send.
discovery.arp_table_collection	Boolean	true	Windows, Linux	Off wins	Collect the endpoint’s own ARP table, which finds neighbors without sending a single probe packet.
discovery.auto_track_types	List	Empty	Any	Single value	Device types to track automatically on trusted networks.
discovery.dhcp_server_allowlist	List	Empty	Any	Combined	MAC or IP addresses of approved DHCP servers.
discovery.disable_legacy_ntlm	Boolean	false	Any	On wins	Refuse WinRM push deploys, which authenticate with NTLM. SMB and SSH deploys are unaffected.
discovery.enabled	Boolean	false	Any	Single value	Master switch for network discovery on this endpoint.
discovery.fragile_ports	List	9100-9107, 515, 631, 102, 502, 1911, 1962, 2222, 2404, 4911, 9600, 18245, 20000, 44818, 47808, 789	Any	Combined	Ports and port ranges a sweep never probes, because printers and industrial controllers can misbehave when touched.
discovery.link_neighbor_collection	Boolean	false	Any	Off wins	Collect what is on the other end of each network link by listening for the announcements neighboring switches already broadcast (LLDP, CDP).
discovery.link_neighbor_protocols	List	lldp, cdp	Any	Common values	Which neighbor-announcement protocols are accepted: lldp (IEEE 802.1AB, near-universal) and cdp (Cisco Discovery Protocol). Options: lldp, cdp.
discovery.max_hosts_per_scan	Integer	1024	Any	Smallest above 0	Cap on how many hosts a single sweep may touch.
discovery.network_scan_enabled	Boolean	false	Any	Off wins	Whether this endpoint acts as a discovery probe for its network.
discovery.new_device_alert_severity	Choice	info	Any	Single value	Alert severity for a new device after a ten-minute grace period. Options: off, info, warning, critical.
discovery.new_device_allowlist	List	Empty	Any	Combined	MAC or IP addresses exempt from new-device alerts.
discovery.passive_listeners	Boolean	true	Any	Off wins	Whether the agent joins mDNS and SSDP and listens for the answers to its own discovery queries.
discovery.port_scan_enabled	Boolean	false	Any	Off wins	Whether the probe enumerates open TCP ports on discovered hosts, as opposed to only detecting that a host exists.
discovery.probe_rate_pps	Integer	20	Any	Smallest above 0	Most probe packets (ICMP and TCP connects) per second a sweep may send.
discovery.scan_excluded_ranges	List	Empty	Any	Combined	CIDR ranges never to scan, whatever the permitted ranges say.
discovery.scan_intensity	Choice	normal	Any	Strictest	How hard the probe sweeps: parallelism, timeouts, and how many probes per host. Options, least to most restrictive: aggressive, normal, light.
discovery.scan_interval_seconds	Seconds	86400 (1 day)	Any	Largest above 0	How often the probe sweeps its permitted ranges, in seconds.
discovery.scan_subnets	List	Empty	Any	Common values	CIDR ranges the probe is permitted to scan.
discovery.scan_window_end	String	Empty	Any	Single value	End of the daily sweep window, as HH:MM in the endpoint’s local time.
discovery.scan_window_start	String	Empty	Any	Single value	Start of the daily window in which scheduled sweeps may run, as HH:MM in the endpoint’s local time.
discovery.scanner_role	Choice	auto	Any	Single value	Whether this endpoint may be elected its network’s active scanner. Options: always, auto, never.
discovery.snmp_community	String	Empty	Any	Single value	Deprecated and ignored. Use discovery.snmp_credential.
discovery.snmp_credential	String	Empty	Any	Single value	The vault credential used for SNMP queries during discovery, by its id.
discovery.snmp_enabled	Boolean	false	Any	Off wins	Whether the probe queries discovered devices over SNMP for model and interface detail.

Encryption

Key	Type	Default	Platforms	Merge	What it does
encryption.escrow_recovery_key	Boolean	true	Any	On wins	Escrow the drive recovery key to your Outpost so a locked-out endpoint is recoverable.
encryption.linux_require_disk_encryption	Boolean	false	Linux	On wins	Require the root filesystem and every mounted data volume on a Linux endpoint to sit on LUKS.
encryption.macos_require_filevault	Boolean	false	macOS	On wins	Requires FileVault on the startup disk of macOS endpoints.
encryption.os_drive_cipher	Choice	xts_aes_128	Windows	Strictest	Cipher used to encrypt the OS drive. Options, least to most restrictive: aes_128, aes_256, xts_aes_128, xts_aes_256.
encryption.require_fixed_drive_encryption	Boolean	false	Windows	On wins	Require full-disk encryption on fixed data drives other than the OS drive.
encryption.require_os_drive_encryption	Boolean	true	Windows, macOS	On wins	Require full-disk encryption on the drive the operating system boots from.
encryption.require_pre_boot_authentication	Boolean	false	Windows	On wins	Require a PIN or startup key before the OS drive is unlocked, so a stolen endpoint cannot be booted straight to the sign-in screen.

End user

Key	Type	Default	Platforms	Merge	What it does
tray.enabled	Boolean	true	Any	Off wins	Run the Outpost tray on the endpoint.

Enforcement

Key	Type	Default	Platforms	Merge	What it does
enforcement.mode	Choice	monitor	Any	Single value	Whether the endpoint applies the security settings its profiles resolve (enforce), or only reads and reports them (monitor). The default is monitor. Options: monitor, enforce.

Firewall

Key	Type	Default	Platforms	Merge	What it does
firewall.allow_local_rule_merge	Boolean	false	Windows	Off wins	Whether firewall rules created locally on the endpoint are honored alongside the pushed ones.
firewall.allowed_inbound_ports	List	Empty	Windows	Common values	Inbound ports opened by policy, as port or port/protocol strings.
firewall.default_inbound_action	Choice	block	Windows	Strictest	What happens to inbound traffic no rule matches. Options, least to most restrictive: allow, block.
firewall.default_outbound_action	Choice	allow	Windows	Strictest	What happens to outbound traffic no rule matches. Options, least to most restrictive: allow, block.
firewall.enabled_domain_profile	Boolean	true	Windows	On wins	Whether the host firewall is on for the domain network profile.
firewall.enabled_private_profile	Boolean	true	Windows, macOS	On wins	Whether the host firewall is on for the private network profile.
firewall.enabled_public_profile	Boolean	true	Windows	On wins	Whether the host firewall is on for the public network profile.
firewall.linux_allowed_inbound_ports	List	Empty	Linux	Common values	Inbound openings on Linux endpoints, as “port” or “port/protocol” strings (443, 5000-5010/udp; a bare port means tcp).
firewall.linux_enabled	Boolean	false	Linux	On wins	Turn the Linux host firewall on with inbound traffic denied by default.
firewall.macos_enabled	Boolean	false	macOS	On wins	Turns on the application firewall on macOS endpoints with socketfilterfw --setglobalstate on.
firewall.macos_stealth_mode	Boolean	false	macOS	On wins	Turns on stealth mode for the application firewall on macOS endpoints with socketfilterfw --setstealthmode on, so the endpoint does not answer ping or probes to closed ports.

Lockout

Key	Type	Default	Platforms	Merge	What it does
lockout.admin_lockout_enabled	Boolean	true	Windows	On wins	Apply the lockout policy to the built-in administrator account as well.
lockout.duration_seconds	Seconds	900 (15 minutes)	Windows	Largest	How long a locked account stays locked, in seconds.
lockout.linux_duration_seconds	Seconds	0	Linux	Largest	How long a locked Linux account stays locked, in seconds, written as unlock_time in /etc/security/faillock.conf.
lockout.linux_reset_counter_seconds	Seconds	0	Linux	Largest	The window, in seconds, in which failed Linux sign-in attempts count towards the lockout, written as fail_interval in /etc/security/faillock.conf.
lockout.linux_threshold_attempts	Integer	0	Linux	Smallest above 0	Failed sign-in attempts before a Linux account is locked, written as deny in /etc/security/faillock.conf.
lockout.macos_duration_seconds	Seconds	0	macOS	Largest	How long a locked account on macOS endpoints stays locked before it unlocks by itself, in seconds.
lockout.macos_threshold_attempts	Integer	0	macOS	Smallest above 0	Failed sign-in attempts before an account on macOS endpoints is locked, applied as an account policy with pwpolicy (policyAttributeFailedAuthentications, identifier com.outpost.lockout.<N>.<seconds>).
lockout.reset_counter_seconds	Seconds	900 (15 minutes)	Windows	Largest	How long after a failed attempt the failure counter resets, in seconds.
lockout.threshold_attempts	Integer	5	Windows	Smallest above 0	Failed sign-in attempts before the account locks.

Monitoring

Key	Type	Default	Platforms	Merge	What it does
monitoring.agent_offline_alert_minutes	Integer	30	Any	Smallest above 0	How long an endpoint may go without a heartbeat before it is alerted as offline, in minutes.
monitoring.alert_on_new_admin_account	Boolean	true	Windows	On wins	Raise an alert when a new account is added to the local administrators group.
monitoring.alert_on_service_stop	Boolean	true	Any	On wins	Raise an alert when a watched service stops unexpectedly.
monitoring.collect_event_log_errors	Boolean	true	Any	On wins	Whether error and critical event log entries are forwarded to your Outpost. Nothing acts on this setting in this version.
monitoring.cpu_sustained_warn_percent	Integer	90	Any	Smallest	Sustained CPU utilization at or above which a warning is raised, as a percentage. Compared against the 15-minute average. See What disk, memory, and CPU alerts measure.
monitoring.disk_free_critical_percent	Integer	5	Any	Largest	Free space on any fixed drive at or below which a critical alert is raised, as a percentage.
monitoring.disk_free_warn_percent	Integer	15	Any	Largest	Free space on any fixed drive at or below which a warning is raised, as a percentage.
monitoring.event_log_channels	List	System, Application, Security	Windows	Combined	Windows event log channels collected from the endpoint. Nothing acts on this setting in this version.
monitoring.heartbeat_interval_seconds	Seconds	60 (1 minute)	Any	Smallest above 0	How often the agent reports that it is alive, in seconds.
monitoring.inventory_interval_seconds	Seconds	86400 (1 day)	Any	Smallest above 0	How often full hardware and software inventory is collected, in seconds.
monitoring.live_metrics_enabled	Boolean	true	Any	Off wins	Allow a technician viewing this endpoint to subscribe to live performance data (CPU, memory, disk, network, GPU) streamed from the agent in near real time.
monitoring.live_metrics_min_interval_ms	Integer	1000	Any	Largest	Floor on how often the agent samples live performance data, in milliseconds.
monitoring.live_metrics_process_list	Boolean	true	Any	Off wins	Include the running-process table in the live view.
monitoring.log_retention_days	Integer	30	Any	Largest	How long collected logs are retained, in days. Nothing acts on this setting in this version.
monitoring.memory_used_warn_percent	Integer	90	Any	Smallest	Memory in use (total minus available) at or above which a warning is raised, as a percentage.
monitoring.process_watchlist	List	Empty	Any	Combined	Process names to watch. A watched process that is not running raises a critical alert in the Process category, such as Watched process sqlservr is not running, which clears when the process runs again. Names match without regard to case, with or without .exe. There is no alert for a process that is running.
monitoring.service_watchlist	List	WinDefend, WdNisSvc, Sense, SecurityHealthService, wscsvc, mpssvc, BFE, EventLog, wuauserv, BITS, Winmgmt, Schedule, CryptSvc, SamSs, VSS, Dhcp, Dnscache, LanmanWorkstation, RpcSs, TrustedInstaller, OutpostAgent, OutpostWatchdog	Windows, Linux	Combined	Service names whose state is watched and alerted on, and whose start type being changed raises an alert of its own.
monitoring.telemetry_interval_seconds	Seconds	300 (5 minutes)	Any	Smallest above 0	How often CPU, memory, and disk telemetry is sampled and reported, in seconds.

Password

Key	Type	Default	Platforms	Merge	What it does
password.complexity_enabled	Boolean	true	Windows	On wins	Enable the platform’s built-in password complexity rule, which is what makes the individual character-class requirements take effect on Windows.
password.history_count	Integer	24	Windows	Largest	How many previous passwords are remembered and refused.
password.linux_max_age_days	Integer	0	Linux	Smallest above 0	Maximum password age in days for Linux accounts, written as PASS_MAX_DAYS in /etc/login.defs.
password.linux_min_age_days	Integer	0	Linux	Largest	Minimum days between password changes for Linux accounts, written as PASS_MIN_DAYS in /etc/login.defs.
password.linux_min_character_classes	Integer	0	Linux	Largest	How many of the four character classes (lower case, upper case, digits, others) a new Linux password must contain, written as minclass in /etc/security/pwquality.conf.
password.linux_min_length	Integer	0	Linux	Largest	Minimum password length on Linux endpoints, written as minlen in /etc/security/pwquality.conf.
password.linux_warn_age_days	Integer	0	Linux	Largest	Days of warning before a Linux password expires, written as PASS_WARN_AGE in /etc/login.defs.
password.macos_history_count	Integer	0	macOS	Largest	How many previous passwords an account on macOS endpoints may not reuse, applied as an account policy with pwpolicy (policyAttributePasswordHistoryDepth, identifier com.outpost.password.history_count.<N>).
password.macos_max_age_days	Integer	0	macOS	Smallest above 0	Maximum password age in days for local accounts on macOS endpoints, applied as an account policy with pwpolicy (identifier com.outpost.password.max_age_days.<N>).
password.macos_min_character_classes	Integer	0	macOS	Largest	How many of the four character classes (lower case, upper case, digits, symbols) a new password must contain on macOS endpoints, applied as an account policy with pwpolicy (identifier com.outpost.password.min_character_classes.<N>).
password.macos_min_length	Integer	0	macOS	Largest	Minimum password length for local accounts on macOS endpoints, applied as an account policy with pwpolicy (identifier com.outpost.password.min_length.<N>).
password.max_age_days	Integer	90	Windows	Smallest above 0	How long a password may be used before it must be changed, in days.
password.min_length	Integer	12	Windows, macOS	Largest	Minimum characters in a local account password.
password.require_digit	Boolean	true	Windows	On wins	Require at least one digit in a password.
password.require_symbol	Boolean	true	Windows	On wins	Require at least one non-alphanumeric character in a password.
password.require_uppercase	Boolean	true	Windows	On wins	Require at least one upper-case letter in a password.
password.reversible_encryption	Boolean	false	Windows	Off wins	Store passwords using reversible encryption, which is effectively storing them in plain text.

Patch

Key	Type	Default	Platforms	Merge	What it does
patch.auto_approve_critical	Boolean	true	Any	On wins	Automatically approve updates classified critical.
patch.auto_approve_driver_updates	Boolean	false	Windows	Off wins	Automatically approve driver updates.
patch.auto_approve_feature_updates	Boolean	false	Any	Off wins	Automatically approve OS feature updates, which change the platform version rather than fixing it.
patch.auto_approve_security	Boolean	true	Any	On wins	Automatically approve security updates below critical severity.
patch.deferral_days_feature	Integer	30	Windows	Smallest	How long feature updates are held back after release, in days.
patch.deferral_days_quality	Integer	0	Windows	Smallest	How long quality (monthly) updates are held back after release, in days.
patch.excluded_kb_ids	List	Empty	Any	Common values	Update identifiers held back from this scope.
patch.include_optional_updates	Boolean	false	Any	Off wins	Whether optional and preview updates are offered.
patch.install_enabled	Boolean	false	Any	Off wins	Let the endpoint install the updates its scan found and its plan approved. Off by default, so nothing installs until a profile turns it on.
patch.macos_update_credential	String	Empty	macOS	Single value	The vault credential a Mac installs macOS updates with: a credential id, or managed_admin for the Mac’s own managed local administrator.
patch.maintenance_window_days	List	sun, mon, tue, wed, thu, fri, sat	Any	Common values	Which days the patch window is open on. Options: sun, mon, tue, wed, thu, fri, sat.
patch.maintenance_window_duration_seconds	Seconds	14400 (4 hours)	Any	Smallest above 0	How long the patch window stays open, in seconds.
patch.maintenance_window_start	String	22:00	Any	Single value	Local start time of the patch window, as 24-hour HH:MM, resolved against the endpoint site’s time zone.
patch.notify_user_before_reboot_seconds	Seconds	900 (15 minutes)	Windows	Largest above 0	How much warning a user gets before a forced restart, in seconds.
patch.reboot_grace_period_seconds	Seconds	86400 (1 day)	Windows	Smallest above 0	How long a user may postpone a required restart, in seconds.
patch.reboot_policy	Choice	notify_user	Windows	Strictest	What happens when an installed update needs a restart. Options, least to most restrictive: never, notify_user, scheduled, force_after_grace, immediate.
patch.scan_enabled	Boolean	true	Any	Off wins	Let the endpoint scan itself for missing updates. A scan installs nothing.
patch.scan_interval_seconds	Seconds	43200 (12 hours)	Any	Smallest above 0	How often the endpoint scans for available updates, in seconds.
patch.third_party_patching_enabled	Boolean	true	Any	On wins	Whether third-party applications are patched alongside the OS.
patch.wsus_server_url	String	Empty	Windows	Single value	Internal update server the endpoint takes updates from.

Power

Key	Type	Default	Platforms	Merge	What it does
power.fast_startup_enabled	Boolean	true	Windows	Single value	Windows Fast Startup. Turn it off on endpoints that must wake on LAN from shut down. On leaves the endpoint’s own setting alone. Cannot be made mandatory.
power.hibernate_enabled	Boolean	true	Windows	Single value	Whether hibernation is available. Cannot be made mandatory.
power.lid_close_action	Choice	sleep	Windows	Single value	What closing a laptop lid does. Options: nothing, sleep, hibernate, shutdown. Cannot be made mandatory.
power.require_password_on_resume	Boolean	true	Windows	On wins	Require the account password when the endpoint resumes from sleep or hibernation.
power.return_to_sleep_after_maintenance	Boolean	false	Any	Single value	After a wake for maintenance, put the endpoint back to sleep, or shut it down again if it was woken from shut down, once the maintenance has finished. Cannot be made mandatory.
power.sleep_timeout_ac_seconds	Seconds	0	Windows	Smallest above 0	Idle time before an endpoint on mains power sleeps, in seconds.
power.sleep_timeout_battery_seconds	Seconds	1800 (30 minutes)	Windows	Smallest above 0	Idle time before an endpoint on battery sleeps, in seconds.
power.wake_for_maintenance	Boolean	false	Any	Single value	Wake a sleeping or shut-down endpoint shortly before its patch window opens or a scheduled script is due, so the maintenance runs on time. Cannot be made mandatory.
power.wake_lead_minutes	Integer	10	Any	Single value	How many minutes before the maintenance is due to wake the endpoint. Cannot be made mandatory.
power.wake_on_lan_enabled	Boolean	false	Windows, Linux, macOS	Single value	Arm the wired network adapters to wake the endpoint on a Wake-on-LAN magic packet, so a technician can wake it from the console. On a Mac this is the Wake for network access setting. FreeBSD and OpenBSD report it as unsupported. Firmware (BIOS or UEFI) Wake-on-LAN is not changed and may also need to be on. Cannot be made mandatory.

Remote access

Key	Type	Default	Platforms	Merge	What it does
remote_access.ai_control	Boolean	true	Any	Off wins	Lets Pioneer AI see the screen and use the mouse and keyboard during a remote session a technician opened, after the technician approves each task.
remote_access.allowed_modes	List	unattended, attended, consent, escorted	Any	Common values, strictest	Which remote-control modes a technician may initiate against this endpoint. Options, least to most restrictive: unattended, attended, consent, escorted, none.
remote_access.audit_file_hash_to_endpoint	Choice	keyed	Any	Strictest	How the audit log records the content hash of each file sent to the endpoint: a plain SHA-256, a keyed hash (HMAC-SHA256 of the SHA-256 under a key that never leaves the endpoint, checkable later with Verify a file), or nothing. Options, least to most restrictive: plain, keyed, none.
remote_access.audit_file_hash_to_technician	Choice	keyed	Any	Strictest	How the audit log records the content hash of each file copied from the endpoint to the technician: a plain SHA-256, a keyed hash (HMAC-SHA256 of the SHA-256 under a key that never leaves the endpoint, checkable later with Verify a file), or nothing. Options, least to most restrictive: plain, keyed, none.
remote_access.audit_file_names_to_endpoint	Choice	full_path	Any	Strictest	How the audit log records the names of files sent to the endpoint: the full destination path, the file name only, a keyed hash of the path, or a keyed hash of the name. Options, least to most restrictive: full_path, file_name, path_hash, name_hash.
remote_access.audit_file_names_to_technician	Choice	full_path	Any	Strictest	How the audit log records the names of files copied from the endpoint to the technician: the full source path, the file name only, a keyed hash of the path, or a keyed hash of the name. Options, least to most restrictive: full_path, file_name, path_hash, name_hash.
remote_access.audit_file_sizes_to_endpoint	Choice	exact	Any	Strictest	How the audit log records the sizes of files and clipboard content sent to the endpoint: exact bytes, or a rounded summary such as 2.1 MB. Options, least to most restrictive: exact, summary.
remote_access.audit_file_sizes_to_technician	Choice	exact	Any	Strictest	How the audit log records the sizes of files and clipboard content copied from the endpoint to the technician: exact bytes, or a rounded summary such as 2.1 MB. Options, least to most restrictive: exact, summary.
remote_access.clipboard_images	List	to_endpoint, to_technician	Any	Common values	Which directions images may sync between the technician’s clipboard and the endpoint’s during a remote session. Options: to_endpoint, to_technician.
remote_access.clipboard_text	List	to_endpoint, to_technician	Any	Common values	Which directions plain and rich text (HTML) may sync between the technician’s clipboard and the endpoint’s during a remote session. Options: to_endpoint, to_technician.
remote_access.consent_timeout_seconds	Seconds	120 (2 minutes)	Any	Smallest above 0	How long the endpoint user has to answer a consent prompt before the request is auto-denied, in seconds.
remote_access.e2e_require_verification	Boolean	false	Any	On wins	Whether the technician must confirm the six-digit secure transfer code shown on the endpoint before any clipboard or file transfer, on every new logon in a session.
remote_access.escort_quorum	Integer	1	Any	Largest	How many escorts must be present for an escorted session.
remote_access.file_transfer	List	to_endpoint, to_technician	Any	Common values	Which directions files and folders may be copied during a remote session, by paste, drag and drop, upload or download. Options: to_endpoint, to_technician.
remote_access.file_transfer_max_file_mb	Integer	0	Any	Smallest above 0	Largest single file a remote session may transfer in either direction, in MiB.
remote_access.file_transfer_max_session_mb	Integer	0	Any	Smallest above 0	Total file data a remote session may transfer, both directions counted together, in MiB.
remote_access.idle_resume_requires_reauth	Boolean	false	Any	On wins	Whether a session paused for technician idle resumes only after the technician confirms their identity again. Off, the next input resumes it.
remote_access.recording_pauses_on_idle	Boolean	true	Any	On wins	Whether recording pauses while a session is idle-paused, so an hour of a frozen screen is not stored.
remote_access.recording_required	Boolean	false	Any	On wins	Whether every remote-control session against this endpoint is recorded. Off until a profile turns it on. Enterprise and MSP only. See Recording on other plans.
remote_access.session_max_seconds	Seconds	3600 (1 hour)	Any	Smallest above 0	Hard cap on a remote-control session, in seconds. 0 means no time limit.
remote_access.tech_idle_pause_minutes	Integer	10	Any	Smallest above 0	Technician idle time before input and viewing are paused, in minutes, counted from the technician’s own input. 0 turns the pause off.
remote_access.tech_idle_terminate_minutes	Integer	30	Any	Smallest above 0	Technician idle time before the session ends, in minutes. 0 turns the idle end off.
remote_access.tech_idle_warn_minutes	Integer	5	Any	Smallest above 0	Technician idle time before the session shows an idle warning, in minutes. 0 turns the warning off.

Remote display

Key	Type	Default	Platforms	Merge	What it does
remote_display.enabled	Boolean	false	Windows	Off wins	Allow the separately certified Outpost Recovery Display component to maintain one console monitor when no usable physical output exists.

Remote logon

Key	Type	Default	Platforms	Merge	What it does
remote_logon.disable_cad_on_server_core	Boolean	false	Windows	Off wins	On Windows Server installations without the desktop experience, open the sign-in screen without Ctrl+Alt+Del (DisableCAD), so a remote technician can sign in.

Remote shell

On a profile’s Settings tab, Remote shell contains remote_shell.enabled. This controls interactive terminals independently of script execution. Outpost and the agent both refuse terminal session requests when it is off, including AI and MCP terminal access.

Key	Type	Default	Platforms	Merge	What it does
remote_shell.enabled	Boolean	true	Any	Off wins	Allow interactive remote terminal sessions.

See Open the remote console.

Script execution

The agent receives and enforces script settings. In Effective config, Delivered by shows Agent (script environment). Agent 0.3.0 or later reports delivery as Applied, Pending, or Not reported. See Script delivery.

Key	Type	Default	Platforms	Merge	What it does
script_execution.allowed_interpreters	List	powershell, cmd, sh, bash	Any	Common values	Which interpreters a pushed script may run under. An interpreter is allowed only where every applicable profile allows it. Options: powershell, cmd, batch, sh, bash, zsh, python.
script_execution.allowed_script_repository	Choice	any	Any	Strictest	Where a script must come from to run. Options, least to most restrictive: any (a script typed at run time is allowed), library_only (only scripts saved in a script library), client_library_only (only this client’s own library, not the shared one). Outpost refuses a run that breaks it before sending it, skips scheduled runs, and the endpoint refuses it again.
script_execution.approval_required	Boolean	false	Any	On wins	A script runs only after someone other than its author approves it: a library script version, or the exact text typed at run time. Editing a script needs a new approval. See Second-person approval.
script_execution.blocked_commands	List	Empty	Any	Combined	Command names a script may not invoke, checked before execution.
script_execution.enabled	Boolean	true	Any	Off wins	Allow scripts to run. Off makes the agent refuse one-off, scheduled, library, and AI or MCP script requests.
script_execution.log_script_output	Boolean	true	Any	On wins	Keep script output. When off, Outpost keeps a run’s exit code and status but not its output, and the run shows Output not kept by policy. The compliance baselines that include this setting keep it on.
script_execution.max_concurrent_scripts	Integer	2	Any	Smallest above 0	How many pushed scripts may run at once on one endpoint.
script_execution.max_runtime_seconds	Seconds	3600 (1 hour)	Any	Smallest above 0	How long a script may run before it is killed, in seconds.
script_execution.powershell_execution_policy	Choice	remote_signed	Windows	Strictest	The PowerShell execution policy set on the endpoint. Options, least to most restrictive: bypass, unrestricted, remote_signed, all_signed, restricted.
script_execution.require_signed_scripts	Boolean	false	Any	On wins	Refuse scripts without a valid signature from a trusted publisher. Only an approved script carries a signature.
script_execution.run_as_context	Choice	system	Any	Strictest	Which account a pushed script runs as. Options, least to most restrictive: system, service_account, logged_in_user.

Session

Key	Type	Default	Platforms	Merge	What it does
session.disconnect_idle_rdp_seconds	Seconds	900 (15 minutes)	Windows	Smallest above 0	Idle time before an inbound Remote Desktop session is disconnected, in seconds.
session.hide_last_signed_in_user	Boolean	false	Windows	On wins	Hide the previous account name on the sign-in screen, so a shared endpoint does not advertise who uses it.
session.idle_logoff_timeout_seconds	Seconds	0	None	Smallest above 0	Idle time before the interactive session is signed out entirely, in seconds. 0 means never. No endpoint applies this setting in this version, and Windows endpoints report it as not supported.
session.legal_notice_caption	String	Empty	Windows	Single value	Title of the consent banner shown before sign-in.
session.legal_notice_text	String	Empty	Windows	Single value	Body of the consent banner shown before sign-in.
session.linux_screen_lock_timeout_seconds	Seconds	0	Linux	Smallest above 0	Lock the screen after this many seconds of inactivity on Linux desktops, for every user.
session.macos_guest_account_disabled	Boolean	false	macOS	On wins	Turns off the guest account on macOS endpoints with sysadminctl -guestAccount off.
session.macos_screen_lock_timeout_seconds	Seconds	0	macOS	Smallest above 0	Idle seconds before the screen locks on macOS endpoints.
session.require_password_on_wake	Boolean	true	Windows, macOS	On wins	Require the account password to dismiss the lock screen after sleep or a screensaver.
session.screen_lock_timeout_seconds	Seconds	900 (15 minutes)	Windows, macOS	Smallest above 0	Idle time before the screen locks, in seconds.
session.screensaver_enabled	Boolean	true	Windows	On wins	Whether a screensaver runs at all, which is what makes the screen lock timeout take effect on Windows.

Software

Key	Type	Default	Platforms	Merge	What it does
software.allow_user_installs	Boolean	true	Windows	Off wins	Whether a standard user may install software themselves.
software.auto_update_managed_packages	Boolean	true	Any	On wins	Keep managed packages at their latest approved version automatically.
software.blocked_packages	List	Empty	Any	Combined	Package identifiers that must not be present. Entries are catalog package ids or package source references.
software.install_timeout_seconds	Seconds	3600 (1 hour)	Any	Smallest above 0	How long an install may run before it is abandoned and reported failed, in seconds.
software.installer_signature_required	Boolean	false	Any	On wins	Refuse installer files the agent runs itself (an EXE or MSI uploaded to Outpost on Windows, a .pkg or disk image on macOS) unless they carry a trusted code signature. Installs through a package manager, such as winget, apt, or Homebrew, are verified by the package manager. Linux has no installer files to check. The compliance baselines that include this setting turn it on.
software.inventory_scan_interval_seconds	Seconds	86400 (1 day)	Any	Smallest above 0	How often installed software is inventoried, in seconds. The agent resends its full inventory at the shorter of this and monitoring.inventory_interval_seconds.
software.msstore_policy	Choice	allowed	Windows	Strictest	What the platform app store may install. Options, least to most restrictive: allowed, private_store_only, blocked.
software.package_source_url	String	Empty	Windows	Single value	An extra winget source: the https URL of a Windows Package Manager REST source, added on the endpoint as outpost-custom. A package the public winget source does not have is installed from it. Empty adds no source.
software.reboot_after_install_policy	Choice	notify_user	Any	Strictest	What happens when an installed package needs a restart. Options, least to most restrictive: never, notify_user, scheduled, force_after_grace, immediate. See Restart after a software install.
software.required_packages	List	Empty	Any	Combined	Package identifiers that must be present on the endpoint. Entries are catalog package ids or package source references.
software.uninstall_unapproved	Boolean	false	Any	On wins	Remove software the software catalog does not allow. Titles marked Not allowed are removed. Unreviewed titles are removed 7 days after they are first seen unless they are approved first. Approved titles and required packages are kept. See Remove unapproved software.
software.winget_bootstrap_package_id	String	Empty	Windows	Single value	Names the catalog package holding the App Installer bundle the agent uses to bootstrap winget.

Restart after a software install

When an installer reports that the endpoint needs a restart, software.reboot_after_install_policy decides what happens:

Value	What happens
never	Nothing. The install’s result says a restart is pending.
notify_user	The tray shows that a restart is needed, with no deadline. Remind me later dismisses it. Only the person restarts the endpoint.
scheduled	The endpoint restarts in the next patch maintenance window, with the patch grace prompt if someone is signed in. Without a maintenance window, the person gets the notify_user notice instead.
force_after_grace	The patch grace prompt starts now, using patch.reboot_grace_period_seconds, and the endpoint restarts at its deadline.
immediate	The endpoint restarts now, after a 60-second warning.

A restart the person makes themselves counts. A scheduled restart or grace prompt that is still waiting is dropped once the endpoint has restarted.

SSH

Key	Type	Default	Platforms	Merge	What it does
ssh.macos_remote_login	Choice	unmanaged	macOS	Strictest	Remote Login (the SSH server) on macOS endpoints, set with systemsetup -setremotelogin. Options, least to most restrictive: unmanaged, on, off.
ssh.max_auth_tries	Integer	0	Linux	Smallest above 0	Authentication attempts allowed per SSH connection (sshd MaxAuthTries).
ssh.password_authentication	Choice	unmanaged	Linux	Strictest	Whether SSH accepts passwords (sshd PasswordAuthentication). Options, least to most restrictive: unmanaged, yes, no.
ssh.permit_root_login	Choice	unmanaged	Linux	Strictest	Whether root may sign in over SSH (sshd PermitRootLogin). Options, least to most restrictive: unmanaged, yes, prohibit-password, forced-commands-only, no.
ssh.x11_forwarding	Choice	unmanaged	Linux	Strictest	Whether SSH forwards X11 connections (sshd X11Forwarding). Options, least to most restrictive: unmanaged, yes, no.

Sync

Sync settings follow the person. They are taken from profiles assigned to the person, their user group, or the whole client. Profiles assigned to an endpoint, a site, or a device group do not change them. See Outpost Sync policy settings.

Key	Type	Default	Platforms	Merge	What it does
sync.allow_metered	Boolean	true	Any	Off wins	Whether Outpost Sync may transfer files while the endpoint is on a connection Windows reports as metered, such as a phone hotspot.
sync.enabled	Boolean	false	Any	Off wins	Whether Outpost Sync gives this person a folder that follows them between the endpoints they sign in to.
sync.max_versions	Integer	10	Any	Smallest above 0	How many previous versions of one file Outpost Sync keeps.
sync.quota_bytes	Bytes	10737418240 (10 GiB)	Any	Smallest above 0	How much storage one person’s Sync folder may occupy, in bytes.
sync.storage_profile_id	String	Empty	Any	Single value	The storage destination this person’s Sync files are written to, named by a storage profile id.
sync.upload_limit_kbps	Integer	0	Any	Smallest above 0	The most bandwidth Outpost Sync may use to upload from this endpoint, in kilobits per second.
sync.version_retention_days	Integer	30	Any	Smallest above 0	How many days of previous versions and deleted files Outpost Sync keeps before removing them for good.

UAC

Key	Type	Default	Platforms	Merge	What it does
uac.admin_approval_prompt	Choice	prompt_for_consent_secure_desktop	Windows	Strictest	What an administrator is asked when a program requests elevation. Options, least to most restrictive: elevate_without_prompting, prompt_for_consent, prompt_for_credentials, prompt_for_consent_secure_desktop, prompt_for_credentials_secure_desktop.
uac.detect_application_installs	Boolean	true	Windows	On wins	Detect application installations and prompt for elevation.
uac.enabled	Boolean	true	Windows	On wins	Keep User Account Control on.
uac.standard_user_elevation	Choice	prompt_for_credentials	Windows	Strictest	What a standard user is offered when a program requests elevation. Options, least to most restrictive: prompt_for_credentials, automatically_deny.

Updates

Key	Type	Default	Platforms	Merge	What it does
updates.automatic_security_updates	Boolean	false	Linux	On wins	Have the Linux distribution install security updates by itself: unattended-upgrades on Debian and Ubuntu (a security origin is added only when none is configured), dnf-automatic with upgrade_type security on RHEL-family systems.
updates.macos_automatic_os_updates	Boolean	false	macOS	On wins	Lets macOS endpoints install macOS updates automatically, written as AutomaticallyInstallMacOSUpdates in /Library/Preferences/com.apple.SoftwareUpdate.
updates.macos_automatic_security_updates	Boolean	false	macOS	On wins	Turns on automatic checking, downloading and installing of security responses and system data files on macOS endpoints, written to /Library/Preferences/com.apple.SoftwareUpdate (AutomaticCheckEnabled, AutomaticDownload, CriticalUpdateInstall, ConfigDataInstall).

Vulnerability

Key	Type	Default	Platforms	Merge	What it does
vuln.alert_min_severity	Choice	high	Server	Strictest	The lowest CVSS severity that raises an alert when it is newly found on this endpoint. Findings below it are still recorded. Options, least to most restrictive: critical, high, medium, low, none.
vuln.scan_enabled	Boolean	true	Any	Off wins	Match this endpoint’s installed software against the vulnerability feed.

Read the catalog in the console or the API

The console shows every setting on any profile’s Settings tab under Profiles. The API serves the same catalog at GET /api/v1/settings/catalog to holders of catalog:read.

Related

• Profiles and policies
• Create and assign a profile
• Check an endpoint’s effective configuration
• Compliance