Endpoint details

This page lists every tab on an endpoint’s detail page and what it shows. Open an endpoint by selecting its name in the endpoint list. Actions you take on the endpoint are on Endpoint actions.

The tabs are the same for every endpoint. What each tab can show depends on the endpoint’s operating system, because each agent reports which parts of the inventory it can collect. A section the agent cannot collect shows the agent’s reason instead of an empty list, so an empty list always means “collected and found nothing”.

Page header

Control	What it does
Connect	Opens the remote viewer in its own window. On an endpoint that cannot share its screen, such as a Linux server without a display, FreeBSD, or OpenBSD, it reads Open terminal and opens the viewer as a terminal-only window. Shown only when the endpoint is connected, supports remote access, and you have remote:initiate. Otherwise it is hidden. See Start a remote desktop session.
Refresh	Re-reads what Outpost already holds for this endpoint. It does not ask the endpoint for anything.
Auto	Refreshes the page on a timer: Off, 5s, 10s, 15s, 30s, 1m, 2m, or 5m. The choice is remembered in your browser.
Collect now	Asks the endpoint to run a fresh inventory sweep. It takes about 15 seconds of the endpoint’s processor time. Unavailable while the endpoint is offline.
Actions	Everything you can do to the endpoint. See Endpoint actions.

Under the controls, the header shows when the page was refreshed and when the endpoint last sent an inventory.

A retired endpoint keeps all its tabs, so you can read its last inventory and history, but the header controls are removed and a banner shows Retired on and the date.

On the MSP plan, an endpoint that also appears in another client shows a note naming that client, such as Also enrolled in a client, Shares a network adapter with an endpoint in a client, or Seen on a network at a client.

On the MSP plan, an endpoint with a transfer to another client in progress shows a banner naming the target client. While the endpoint is offline and the transfer waits for it, the banner reads Moving to the client when it next connects., and Cancel transfer stops the transfer. Once the endpoint connects and the transfer is under way, the banner reads Moving to the client, and the transfer can no longer be canceled. See Transfer an endpoint to another client.

Tabs

Tab	Shows	Permission beyond endpoint:read
Overview	A summary of the endpoint, its live gauges, its custom fields, and anything that needs attention.	None
Alerts	This endpoint’s alerts, newest first.	None
Live	Live performance and processes.	None
Hardware	Hardware inventory.	None
Software	Software inventory and the Outpost agent.	None
Security	Antivirus, firewall, ports, certificates, and recovery keys.	bitlocker:read for Recovery keys
Patches	This endpoint’s patches and their state, and its patch history.	patch:read
Vulnerabilities	Open vulnerability findings on this endpoint.	vuln:read
Identity	Domain join, sessions, user profiles, and local accounts.	None
Documentation	Documentation about this endpoint, and credentials for it.	Documentation permissions
Backups	Outpost Backup and other backup products for this endpoint.	backup:read
Commands	Running scripts, the remote console, and command history.	command:execute to run anything
Remote	Remote access and session history.	Remote access permissions

Overview

Section	Contents
Needs attention	Problems that need a technician, each linked to the page that holds the detail. Shown only when there is something to report.
Status	Name (with Rename), Asset tag, Connection, Enrollment, Site, Groups, Health score, Signed in, Uptime, Last seen, Last wake when the endpoint has been woken, and Inventory taken.
System	Operating system, Version, Architecture, Last patched, Domain, Roles & tags, Windows activation on Windows, Time zone, Locale, Manufacturer, Virtualization when detected, Model, and Serial number.
Hardware	Processor, Memory, System drive, Battery health, Displays, Graphics, and the Installed software count.
Network	Adapter, Wi-Fi network, IPv4 address, Gateway, and MAC address.
Live gauges	CPU, Memory, Disk, Network, and GPU, while the endpoint is connected.
Custom fields	Your organization’s custom fields for endpoints. Editing them needs endpoint:write.
Not available on this endpoint	Every capability the agent reported as unavailable, with its reason.

You can change the endpoint’s site from the Site row. This needs endpoint:write. See Organize endpoints.

The Groups field on Overview adds or removes static group memberships. This needs identity:manage. Dynamic groups use rules to determine membership.

When Outpost recognizes a virtual endpoint, Virtualization shows Virtual machine: followed by the platform. Detection uses reported hardware manufacturer and model information, with QEMU guest-agent service evidence as a fallback. Recognized platforms include QEMU/KVM (including Proxmox guests), VMware, Hyper-V, VirtualBox, Xen, Parallels, Amazon EC2, Google Compute Engine, and Azure. Generic QEMU or Hyper-V hardware does not identify the hosting provider by itself.

In the endpoint list, use Filters > Virtual / Physical to choose Virtual or Physical / unknown. The latter includes endpoints whose virtual platform has not been recognized.

The Agent capabilities section lists Supported, Reported only, and Unavailable capabilities with their reasons. Not reported means the agent has not supplied the evidence. See Endpoint capabilities.

Alerts

The live alerts on this endpoint, newest first. You can acknowledge an alert from here. See Alerts.

Live

Sub-tab	Contents
Performance	Graphs of processor, memory, disk, network, and GPU, sampled while you have the tab open.
Processes	The running processes, filterable by name, process ID, or user.

See Live metrics and the remote console.

Hardware

Sub-tab	Contents
Overview	System, Processor and memory, Battery, and At a glance.
Storage	Storage volumes, Mapped network drives saved to reconnect at sign-in, RAID arrays and storage pools, and Physical disks with their reliability counters.
Network	Network adapters with their addressing, Link neighbors: the switch and port at the other end of each link, from LLDP and CDP, and Connected from: the public addresses the agent has connected from.
Displays	Displays and Graphics adapters.
Peripherals	Printers installed for the signed-in user, and USB device history.

Connected from lists every public address the endpoint’s agent has connected to your Depot from, newest first. Each row shows the Public IP, its Type (IPv4 or IPv6), First seen, Last seen, and Connections, the number of times the agent connected from that address. Last connected from above the table is the most recent one.

• The address is the one your Depot sees. An endpoint behind a router shows the site’s internet address, not the machine’s own.
• The history starts when your Depot first records a connection from the endpoint, so it can be empty for an endpoint that has not reconnected since. It does not wait for an inventory.
• An address is kept until it has not been seen for the number of days in compliance.endpoint_audit_retention_days, 365 by default. 0 keeps every address. See Policy settings.
• Reading it needs only endpoint:read. The same history is available from GET /api/v1/endpoints/{agentID}/connections in the REST API and from the endpoint_connection_history tool on the MCP server.

Software

Sub-tab	Contents
Overview	Updates, At a glance, and Scheduled tasks whose last run failed.
Applications	Installed applications.
Updates	Installed updates and patches, newest first.
Scheduled tasks	Scheduled tasks added to the endpoint.
Startup	Autoruns started by a sign-in or a boot.
Services	Services from the last inventory sweep, with controls to start, stop, restart, and set the start type. Hidden when the agent reports that it cannot read the endpoint’s services. A service on the monitored service list is marked, because stopping it, or moving it off automatic, raises an alert.
Browser	Browser extensions found in signed-in users’ profiles.
Features	Windows optional features, enabled first.
Outpost Agent	The agent’s build, install, and reporting details. The tab is marked when an agent update is available.

Security

Sub-tab	Contents
Overview	Firewall, Antivirus, and Platform.
Antivirus	Antivirus engine and the Antivirus products registered with the operating system.
Firewall	Enabled Inbound allow rules, the ones most in need of review first.
Ports	Listening ports, by port number.
Certificates	Certificates on the endpoint, soonest expiry first.
Recovery keys	Drive encryption recovery keys escrowed with Outpost. Listing them needs bitlocker:read, and revealing one needs bitlocker:reveal.

On Linux, macOS, FreeBSD, and OpenBSD, security shows one Host firewall status with the detected firewall: nftables, ufw, firewalld, iptables, pf, ipfw, or Application Firewall. Not reported means no firewall tooling answered; it does not mean the firewall is disabled.

The alert Host firewall disabled; upstream protection not assessed means the endpoint reports its own firewall as disabled. Outpost does not assess firewalls or other network protection upstream of the endpoint. Review the endpoint’s firewall and your network controls separately.

Patches and Vulnerabilities

Both tabs are read-only. Patches lists the endpoint’s patches with their state, and its patch History. Vulnerabilities lists open findings, with known-exploited findings marked. To scan or install, use Scan for patches or Install approved patches in the Actions menu. See Patching.

Identity

Sub-tab	Contents
Overview	Domain and cloud join (On-premises and Cloud), Signed-in user, and Local accounts.
Sessions	Signed in now, console first, and Has a profile here: user profiles on the endpoint, most recently used first.
Accounts	Local accounts, local administrators first.

Documentation

The articles and assets your team has written about this endpoint, and a Credentials for this machine panel for credentials stored for it. See Documentation.

Backups

The Outpost Backup status and schedule, Runs, Restores, the Snapshot timeline, and Other backup products that report for this endpoint. You start a restore from here. See Backup.

Commands

Sub-tab	Contents
Overview	Run a script from the library, Run a one-off script, and the Most recent command.
Console	Open terminal for an interactive shell, and Session transcripts of earlier console sessions.
History	Command history: every command sent to this endpoint, with its state, exit code, and output.

See Live metrics and the remote console.

Remote

Overview starts a remote session and shows the endpoint’s state. History lists remote access attempts. The tab is disabled, with the agent’s reason, on an endpoint that has no way to capture its screen. See Remote access.

Differences by operating system

Each row is a part of the inventory that is not collected everywhere. Anything not listed here is collected on Windows, Linux, and macOS.

Inventory	Windows	Linux	macOS (Preview)
Features (optional features)	Yes	No equivalent. Installed packages are listed under Applications.	No equivalent
Windows activation	Yes	No equivalent	No equivalent
RAID	Yes	Yes	Not collected
Printers	Yes	Only when CUPS is installed	Only when lpstat is available
Services	Yes	Only when systemd is the running init	Yes
Mapped network drives	Yes	Shows mounted network file systems (NFS, CIFS, and SSHFS)	Yes
Live	Yes	Yes	Yes
Remote tab	Yes	Only with a display	Yes

FreeBSD and OpenBSD endpoints report basic inventory and the running process list. Most hardware, software, and security sub-tabs show the agent’s reason instead of data, and the Live tab has no metrics. See Supported platforms.

Related

• Endpoint actions
• Device activity
• Server roles