Skip to main content

Management

The Devices web interface provides comprehensive management for data collection sources through an intuitive card-based dashboard.

Access​

Navigate to Home > Fleet Management > Devices, or use the hamburger menu and select Fleet Management > Devices.

Overview​

The Devices dashboard is where you manage all configured devices through the web interface. To standardize data collection rules across multiple devices, see Datasets and Profiles.

Dashboard Interface​

The overview page displays all available device types as cards organized by category:

  • Operating Systems — Windows, Linux (coming soon: macOS, Oracle Solaris, AIX, FreeBSD, OpenBSD, NetBSD)
  • Microsoft Azure — Azure Blob Storage, Azure Event Hubs, Microsoft Sentinel, Microsoft Graph API
  • Amazon Web Services — Amazon S3, Amazon Security Lake
  • Google Cloud (GCP) — Google Cloud Pub/Sub, Google Cloud Storage
  • Message Queues — Kafka, NATS, RabbitMQ, Redis
  • Protocols — Syslog, HTTP, UDP, TCP, eStreamer
  • Analytics — Splunk HEC, Elasticsearch
  • Others — WEC, CCF, DataStream Stats, Proofpoint On Demand (coming soon: Azure Alerts, Azure Logs, Azure Metrics)

A sidebar filter panel allows selection by category. The interface provides a Search device types field to filter by name. A card count displays "Viewing X device type(s)".

Each device type displays as a card showing Icon, Title, Description, Enabled Count, Disabled Count, and optionally a Coming Soon Tag for unavailable types. Clicking a card navigates to that device type's management page.

List View​

Clicking a device card opens the device list view showing all instances of that device type.

Table​

The table displays Name, Director, Log Stream (per-row bar chart of recent throughput), Status (Enabled/Disabled), Connection Status (Connected/Not Connected), and an Actions menu (⋮) for each device.

Clicking a row's Name opens a side drawer (Device Detail Drawer) summarizing the device — see Device Detail Drawer below.

info

The ability to add a pre-processing pipeline is available for all devices.

Table Controls​

Filter devices using a search field with a dynamic placeholder of Search [Device Type] devices (for example, Search Syslog devices), a Directors dropdown (All or specific Director), and a Status dropdown (All, Enabled, Disabled).

A Connection Status filter (All, Connected, Not Connected) is available on the Windows and Linux device-type overview tabs, where the table lists Agent-based or Agentless devices.

The Add new device toolbar button launches the creation wizard. This button is disabled if no Director exists.

Director Requirement

On the Windows and Linux device-type overview pages, if no Directors exist an info notification displays No directors found with an explanation and a Create Director button that navigates to the Director creation wizard.

Actions​

Each device row provides an Actions menu (⋮) with the following operations:

View Details:

  • Manage device - Navigate to the device detail view

For users with read-only access (no Create/Edit/Delete permission), this item is replaced by See device details, which opens the same detail view without edit controls.

Status Management:

  • Enable device - Activate a disabled device
  • Disable device - Deactivate an enabled device

Configuration:

  • Clone device - Duplicate device configuration for quick setup
    warning

    Windows and Unix devices cannot be cloned

Deletion:

  • Delete device - Remove device from platform

Device Detail Drawer​

Clicking the Name cell in the device list opens a side drawer that summarizes the device without leaving the list. The drawer displays:

  • Name
  • Directors assigned
  • Pre-processing Pipeline
  • Status
  • Connection Status

The drawer footer provides two actions:

  • Edit - Navigate to the device detail page
  • Clone - Open the creation wizard pre-filled with this device's configuration

Creation Wizard​

The device creation process varies by device type.

Device wizards use different step counts depending on the device family:

  • Generic devices (protocols, cloud, message queues, analytics, AWS/GCP/Azure storage) — 4 steps: General Settings, followed by two device-specific steps, ending with Review.
  • Windows and Linux Agent devices — 5 steps: Setup Device, Install and Connect, Review & Configure Data, Update Management, Review and Complete Setup. When an Agentless deployment is chosen, the Update Management step is disabled.

Each step is labeled with its specific name rather than a generic step number.

Orchestrated Director Behavior​

When an Orchestrated Director is selected during device creation, the wizard adapts its options to reflect orchestrated mode constraints.

Director Dropdown: Orchestrated Directors display with a gray Orchestrated tag next to their name in the Director selection dropdown, distinguishing them from Self-Managed and Managed Directors.

Disabled Device Types: Four device types cannot be assigned to Orchestrated Directors. These device types are excluded from selection when an Orchestrated Director is chosen:

  • Proofpoint On Demand
  • eStreamer
  • Microsoft Sentinel
  • CCF

Deployment Type Restriction (Windows/Linux): Orchestrated mode only supports Agent deployment. Agentless deployment is not available for Orchestrated Directors. When an Orchestrated Director is selected, an info alert displays:

Agentless deployment is not supported in orchestrated mode Orchestrated mode only supports agent deployment type. Agentless deployment is not available for the selected director.

Connection Verification (Windows/Linux): Agent deployment with an Orchestrated Director does not perform an inbound access check. The Agent's connection status updates after Director configuration is applied manually. If there is a connection issue, review the Director logs.

General Settings​

Applies to: Syslog, HTTP, UDP, TCP, eStreamer, AzureBlobStorage, AzureEventHubs

Basic device configuration including name and Director assignment:

  • Name - Unique device identifier
  • Device Status - Enable or disable device
  • Directors - Assign device to one or more Directors
  • Pre-processing Pipeline - Optional pipeline for input normalization

Protocol Settings​

Applies to: Syslog, HTTP, UDP, TCP, eStreamer

Network protocol configuration:

  • Protocol - Communication protocol (UDP, TCP, HTTP, etc.)
  • IP Address - Network address to bind (0.0.0.0 for all interfaces)
  • Port - Network port number for listening
  • Framing - Message framing mode (delimiter, RFC6587, etc.)
  • TLS Encryption - Optional TLS/SSL configuration
  • Certificate and Key - TLS certificate files when encryption enabled

Advanced Configuration​

Applies to: Syslog, HTTP, UDP, TCP, eStreamer, AzureEventHubs

Performance tuning and advanced settings:

  • Socket Address Reuse - Enable SO_REUSEADDR for port sharing
  • Workers - Number of concurrent processing workers
  • Max Connections - Maximum concurrent connections limit
  • Max Message Size - Maximum message size in bytes
  • Timeout - Connection and read timeout settings
  • Buffer Size - Input buffer size for data reception
  • Batch Size - Number of messages per batch
  • Queue Interval - Queue processing interval
  • Forwarding - Optional forwarding to another destination

Setup​

Applies to: Windows, Linux

Initial device configuration and deployment type selection:

  • Name - Device identifier
  • Director - Director assignment for Agent coordination
  • Deployment Type - Choose between Agent-based or Agentless connection
    • Agent - Install VirtualMetric Agent on target system
    • Agentless - Connect remotely without installing Agent

Install and Connect​

Applies to: Windows, Linux

Agent installation or agentless connection configuration (varies by deployment type):

For Agent Deployment:

  • Installation Command - Platform-specific PowerShell/Bash script
  • Copy Button - One-click copy installation command
  • Connection Verification - Verify Agent successfully connected to Director
  • Connection Status - Real-time connection state display

For Agentless Deployment:

  • IP Address - Target server address
  • Port - WinRM or SSH connection port
  • Timeout - Connection timeout in seconds (default: 30)
  • Username - Authentication username
  • Password - Authentication password (or use SSH Key for Linux)
  • SSH Key - Private key content and optional passphrase (Linux only, replaces password)
  • Domain - Windows domain for Active Directory authentication (optional)
  • Connection Verification - Test remote connection before proceeding

Review and Configure​

Applies to: Windows, Linux

Log type selection and configuration review:

  • Log Categories - Accordion-based log type selection with predefined definitions
  • Windows Log Types:
    • Event Logs (Basic/Custom modes with XML editor)
    • Security Events (with log level filtering)
    • DNS Logs (with include/exclude filters)
    • Firewall Logs (with event type selection)
  • Linux Log Types:
    • System Events (with file path configuration)
    • Audit Events (with file path configuration)
    • Firewall Events (with file path configuration)
  • Pre-processing Pipeline - Optional pipeline assignment per log type
  • Configuration Summary - Review all settings before creation

Azure Properties​

Applies to: AzureBlobStorage, AzureEventHubs

Azure-specific authentication and resource configuration:

  • Managed Identities - Toggle for Azure Managed Identity authentication
  • Authentication Method - Service Principal or Connection String
  • Tenant ID / Client ID / Client Secret - Service Principal credentials
  • Account / Container / Namespace - Azure resource identifiers
  • Connection String - Alternative authentication method

File Properties​

Applies to: AzureBlobStorage

File reading and processing configuration:

  • Path Prefix - Blob path prefix filter
  • File Format - Expected file format (JSON, Parquet, Avro, etc.)
  • Batch Size - Number of files to process per batch
  • Poll Interval - Frequency to check for new files
  • Max Concurrent Files - Maximum parallel file processing
  • Delete After Read - Remove files after successful processing

Wizard Navigation​

Progress Indicator:

  • Visual step progress at top of wizard
  • Click steps to navigate (after validation)
  • Current step highlighted
  • Completed steps marked with checkmark

Navigation Buttons:

  • Cancel - Exit wizard without creating device
  • Back - Return to previous step
  • Next - Advance to next step with validation
  • Create device - Finalize device creation (final step)

Detail View​

Clicking a device from the list opens the detailed management interface with tabbed panels.

Protocol Devices​

Protocol devices (Syslog, HTTP, UDP, TCP, eStreamer) display three tabs:

General Settings Tab:

  • Name - Editable device name
  • Description - Editable device description
  • Director - Assigned Director (read-only)
  • Tags - Editable device tags
  • Status - Current operational state
  • Edit Mode - Click edit to modify general settings
  • Save/Cancel Buttons - Commit or discard changes

Protocol Settings Tab:

  • Device-specific network configuration
  • Address and port settings
  • Protocol parameters
  • Read-only display with configuration details

Advanced Configuration Tab:

  • TLS/SSL settings
  • Buffer and queue configuration
  • Performance tuning parameters
  • Read-only display with configuration details

Windows and Linux Devices​

Windows and Linux devices have different tab structures based on deployment type:

Agent-Based Devices (3-4 tabs):

Device Configuration Tab:

  • Name - Editable device name
  • Director - Assigned Director
  • Deployment Type - Agent-based or Agentless
  • Edit Mode - Modify device settings
  • Save/Cancel - Commit or discard changes

Access Configuration Tab:

  • For Agent devices - Token assignment; view current token or change to a different valid token
  • For Agentless devices - Remote connection credentials (IP Address, Port, Username, Password/SSH Key, Domain)
  • Edit Mode - Modify access settings

Agent Deployment Tab (Agent-based only):

  • Deployment Type - Agent or Agentless indicator
  • Token - Authentication token in use
  • Connection Status - Connected or Not Connected
  • Connection History - Link to activity logs
  • Installation Command - Platform-specific script with copy button
  • Re-Install Agent - Click to reinstall; select token, copy new installation script, verify connection

Data Configuration Tab:

On this tab, you select which log types to collect from the Windows device. The interface provides accordion-based sections for different log categories.

Each log type supports optional pre-processing pipeline assignment - allowing you to transform or enrich data before it reaches the main processing pipeline.

Windows Security Events:

  • Security audit logs from Windows Event Log
  • Configurable log level filtering
  • Optional Pre-processing Pipeline - ComboBox to select pipeline for this log type

Windows Event Logs:

  • Category Selection - Choose between Basic and Custom modes
  • Basic Mode:
    • Pre-configured log level checkboxes
    • Application and System channel options
    • Log level selection (Information, Warning, Error, Critical, Verbose)
    • Simple checkbox-based configuration
  • Custom Mode:
    • XML Configuration Editor - Monaco code editor for XPath queries
    • DCR Format Import - Import button to convert Azure DCR format to XML
    • Import DCR Config modal with XML editor
    • System converts DCR to XPath automatically
    • Full custom query support for advanced scenarios
  • Optional Pre-processing Pipeline - ComboBox to select pipeline for this log type

Windows Firewall Logs:

  • Multiple firewall log options with tick boxes
  • Configurable firewall event types
  • Optional Pre-processing Pipeline - ComboBox to select pipeline for this log type

Windows DNS Logs:

DNS logs provide the most complex filtering with include/exclude logic:

Include Filters - Specify which DNS events to collect:

  • Add New Filter button opens filter configuration
  • Multiple filters can be added (treated with OR logic between filters)

Exclude Filters - Specify which DNS events to ignore:

  • Same interface as Include filters
  • Processed after include filters

Filter Configuration:

For each filter (include or exclude), you configure:

  1. Filter Type Selection - ComboBox with options:

    • Event ID
    • Response Code
    • Question Type
    • Client IP
    • Query Name
    • And other DNS-specific fields

  2. Filter Type Selection - ComboBox showing operators based on Filter selection:

    • For Event ID, Response Code, Question Type: Only "Equals" operator (MultiSelect values)
    • For text fields (Client IP, Query Name, etc.): Multiple operators available
      • Equals
      • Contains
      • Starts With
      • Ends With
      • And other string comparison operators

  3. Value Input:

    • MultiSelect Dropdown (for Event ID, Response Code, Question Type)
      • Pre-defined value list
      • Select multiple values from dropdown
    • TextArea Input (for text fields)
      • One value per line
      • Free-form text entry

  4. Additional Filter Types (for TextArea filters only):

    • "Add Another Type" button appears after selecting filter type
    • Allows multiple filter types on same field
    • Each additional type treated conjunctively (AND logic)
    • Info alert explains: "Multiple types within a condition are treated with AND logic"

  5. Multiple Conditions:

    • "Add Condition" button adds another condition to the filter
    • Each condition can have different Filter and Filter Type
    • Multiple conditions within a filter treated conjunctively (AND logic)
    • Info alert explains: "Multiple conditions are treated with AND logic"

  6. Filter Management:

    • Save Filter button validates and adds filter to list
    • Edit button on each filter row reopens configuration
    • Delete button removes filter
    • Cancel button discards changes

Filter Logic Summary:

  • Within a filter: Multiple conditions use AND logic
  • Within a condition: Multiple additional types use AND logic
  • Between filters: Multiple filters use OR logic

Pipeline Selection:

  • Optional Pre-processing Pipeline - ComboBox at bottom of DNS logs section
  • Applies to all DNS events collected by this log type
  • Transforms or enriches DNS data before main processing

Data Configuration Edit Mode:

  • Click Manage device details button to enter edit mode
  • Accordion toggles become enabled for log type selection
  • Filter configuration inputs become editable
  • Save Changes button commits all modifications
  • Cancel button reverts to previous configuration

Agent History Tab:

  • Connection Events - Agent connection/disconnection log
  • Configuration Changes - Device configuration updates
  • Status Changes - Enable/disable operations
  • Timestamp - Date and time of each event

Linux Devices​

Linux devices follow the same structure as Windows devices with platform-specific log types and configuration.

Device Configuration Tab:

  • Same as Windows device (Name, Director, Deployment Type)

Access Configuration Tab (Agentless only):

  • Same as Windows device (IP Address, Port, Authentication, Domain)

Agent Deployment Tab (Agent-based only):

  • Same as Windows device (Installation Command, Connection Status, Agent Information)

Data Configuration Tab:

Linux devices provide three log type categories for collection. The interface is similar to Windows but with Linux-specific log sources.

Each log type supports optional pre-processing pipeline assignment - allowing you to transform or enrich data before it reaches the main processing pipeline.

Linux System Events:

  • System logs from Linux syslog daemon
  • File Path - Input field to specify log file location
    • Tooltip with information icon explains path requirements
    • Default behavior if empty:
      • Ubuntu/Debian: /var/log/syslog
      • Red Hat/CentOS/Fedora: /var/log/messages
    • Custom paths can override defaults
  • Optional Pre-processing Pipeline - ComboBox to select pipeline for this log type

Linux Audit Events:

  • Audit logs from Linux auditd system
  • File Path - Input field to specify audit log file location
    • Tooltip with information icon explains path requirements
    • Default behavior if empty: System uses distribution-specific default path
    • Typically /var/log/audit/audit.log on most distributions
  • Optional Pre-processing Pipeline - ComboBox to select pipeline for this log type

Linux Firewall Events:

  • Firewall logs from iptables/nftables
  • File Path - Input field to specify firewall log file location
    • Tooltip with information icon explains path requirements
    • Default behavior if empty: System uses distribution-specific default path
    • Custom paths allow collection from non-standard locations
  • Optional Pre-processing Pipeline - ComboBox to select pipeline for this log type

Linux Data Configuration Edit Mode:

  • Click Manage device details button to enter edit mode
  • Accordion toggles become enabled for log type selection
  • Path input fields become editable when accordion is toggled on
  • Pipeline ComboBoxes become enabled for selection
  • Save Changes button commits all modifications
  • Cancel button reverts to previous configuration

Path Configuration Notes:

  • Empty path field uses distribution-specific defaults
  • Custom paths must be absolute paths (e.g., /custom/log/location)
  • Agent must have read permissions for specified paths
  • Tooltip information icon provides platform-specific guidance

Azure Cloud Devices​

Azure cloud devices display three tabs:

General Settings Tab - Name, description, Director, tags

Azure Properties Tab:

  • Cloud-specific configuration
  • Authentication details
  • Connection strings
  • Workspace information
  • Read-only display

Advanced Configuration Tab (varies by device):

  • Performance tuning
  • Retry logic
  • Error handling
  • Read-only display

Detail Actions​

The detail view provides an Actions menu with context-specific operations:

View and Configuration:

  • Manage device - Current view (disabled in dropdown)

Status Management:

  • Enable device - Activate a disabled device
  • Disable device - Deactivate an enabled device

Advanced Operations:

  • Clone device - Duplicate configuration for new device
  • Delete device - Remove device from platform

Operations​

Enable / Disable​

To change device status:

  1. Navigate to the device detail view or use the Actions menu from the list
  2. Click the Actions menu
  3. Select Enable device or Disable device
  4. A success notification confirms the status change

Enabled devices actively receive or collect data. Disabled devices preserve their configuration but stop all data collection.

Clone​

Duplicate an existing device configuration for quick setup:

  1. Navigate to the device detail view or use the Actions menu from the list
  2. Click the Actions menu
  3. Select Clone device
  4. The system navigates to the device creation wizard
  5. The form is pre-filled with the cloned device configuration
  6. Modify name and other settings as needed
  7. Complete the wizard to create the new device

Delete​

Delete Device Process:

Remove a device from the platform with dependency checking:

  1. Navigate to the device detail view or use the Actions menu from the list
  2. Click the Actions menu
  3. Select Delete device
  4. A deletion modal appears with confirmation

Standard Deletion:

  • Confirm device name matches
  • Click Delete to proceed
  • Success notification confirms deletion
  • Redirect to device list view

Deletion with Dependencies:

If a device has active dependencies, an error modal displays:

Error Modal Contents:

  • A Cannot delete device heading
  • A short description explaining the device is in use
  • An actionable warning notification with title and message
  • A Go to routes button that navigates to the Quick Routes page

The modal does not enumerate the specific routes that depend on the device — use the Go to routes button to inspect and update them.

Dependency Resolution:

  1. Click Go to routes in the error modal to open the Quick Routes page
  2. Identify routes that reference the device and edit them to use a different device or delete the routes
  3. Retry device deletion after the dependencies are removed
warning

For Windows and Linux Agent devices, deleting the device does not uninstall the Agent from the endpoint. Use the Agent CLI to uninstall if needed.

Edit Mode Workflow​

Device detail tabs support inline editing with unsaved changes protection:

Enter Edit Mode:

  1. Navigate to editable tab (General Settings, Device Configuration, etc.)
  2. Click Edit button in top-right of tab
  3. Form fields become editable
  4. Save and Cancel buttons appear

Make Changes:

  • Modify editable fields
  • Changes are not saved automatically
  • Form validation occurs on save

Save Changes:

  1. Click Save button
  2. System validates changes
  3. Success notification displays confirmation
  4. Edit mode exits
  5. Tab displays updated values

Cancel Changes:

  1. Click Cancel button
  2. Form reverts to original values
  3. Edit mode exits
  4. No changes are saved

Tab Navigation Protection:

If you attempt to navigate to another tab while in edit mode:

  • Unsaved Changes Modal appears
  • Modal Contents:
    • "Unsaved changes" heading
    • "You have unsaved changes. Are you sure you want to leave?" message
    • Discard Changes - Exit edit mode and switch tabs
    • Continue Editing - Return to current tab
    • Cancel - Close modal

Notifications​

The Devices interface provides automatic notifications for all operations:

Success Notifications​

Success messages auto-dismiss after 10 seconds. These include confirmations for device creation, enabling, disabling, deletion, and configuration updates. Hover to pause the auto-close timer, or click X to dismiss manually.

Error Notifications​

Error notifications persist until manually dismissed. These include failures for enable, disable, delete, update operations, and Director requirement alerts for device creation. Review error details and take corrective action before dismissing.