Device Management
Managing enrolled endpoint devices in the BlueSentinel dashboard.
Device List
Navigate to Devices to see all enrolled endpoints. The list shows:
- Hostname — Device name
- OS — Windows or macOS with version
- Status — pending, active, locked, wiped, or retired
- Group — Assigned device group
- Last Heartbeat — Time since last agent check-in
- Guards Status — Which guards are active/inactive
Filtering & Search
Filter devices by:
- Group — Show devices in a specific group
- Status — Filter by device status
- OS — Windows or macOS
- Search — Search by hostname, username, serial number, or email
Device Details
Click a device to see its full details:
- Device information (hostname, OS, serial number, MAC address, agent version)
- Guard status (running/stopped for each guard)
- Recent alerts from this device
- Assigned policy and group
- Encryption status and recovery key availability
- Command history
Device Status Lifecycle
Enrollment Token → pending → active → locked/wiped/retired- pending — Device enrolled but not yet sent first heartbeat
- active — Device is online and reporting
- locked — Device locked remotely (screen lock command sent)
- wiped — Agent data wiped remotely
- retired — Device decommissioned (API key invalidated)
Remote Commands
From the device detail page, you can send commands:
| Command | Effect |
|---|---|
| `lock` | Lock the screen (Win: LockWorkStation, Mac: displaysleepnow) |
| `wipe` | Wipe agent data (requires confirmation) |
| `restart_agent` | Force agent restart |
| `update_policy` | Force immediate policy sync |
| `force_encrypt` | Enable disk encryption |
| `collect_status` | Request full status report |
| `enable_guard` | Enable a specific guard |
| `disable_guard` | Disable a specific guard |
| `set_message` | Display a message on the device |
| `run_scan` | Run a compliance scan |
Commands go through a lifecycle: pending → delivered → executed/failed