Fleet Management

Manage devices, agents, groups, and organizational hierarchy

The Fleet page gives you visibility and control over every device and agent in your organization. Four tabs cover different views of the same fleet data.

Tabs

Hierarchy

A tree view showing the organizational structure:

Organization
└── Team
    └── Machine (Device)
        └── Agent (Claude Code, Cursor, etc.)

Expand nodes to drill down. Each level shows aggregate status and risk. Click any node to see its details in a side panel.

This view is useful for understanding how agents are distributed across your organization and spotting machines with unusual agent counts or risk levels.

Agents

A flat table of all agent instances, with two view modes:

Table View — sortable columns for agent name, platform, device, status, last seen, risk score, and session count.

Graph View — a React Flow visualization showing relationships between agents, devices, and teams. Nodes are color-coded by risk level. Drag to rearrange, scroll to zoom.

Toggle between views with the view switcher in the top-right corner.

Devices

All connected machines with:

• Hostname and OS info
• Agent count — how many AI agents are running
• Daemon status — connected, disconnected, or degraded
• Last heartbeat — when the device last checked in
• IP address — network information

Click a device to see its agent list, recent sessions, and connection history.

Groups

Device groups for scoped policy application. Groups let you apply different policies to different segments of your fleet.

For example:

• “Engineering” — relaxed policies for dev machines
• “Finance” — strict policies for machines handling financial data
• “Contractors” — limited agent access

Each group shows its member count, applied policies, and aggregate risk.

Agent Status

Each agent has a status indicating its current state:

Status	Meaning
Active	Agent is running and reporting events
Idle	Agent is running but no recent activity
Disconnected	Agent hasn’t reported in beyond the heartbeat threshold
Blocked	Agent has been manually or policy-blocked
Pending	Agent enrolled but awaiting policy evaluation

Agent Management

From the Agents tab, you can:

• Block — immediately stop an agent from operating. The edge daemon enforces the block.
• Unblock — restore a blocked agent.
• View Sessions — jump to the sessions page filtered to this agent.
• View Alerts — see alerts generated by this agent.
• Assign to Group — move the agent’s device to a different group for policy scoping.

Graph Visualization

The graph view uses React Flow to render agent-device-team relationships visually. Key features:

• Node colors — green (low risk), yellow (medium), orange (high), red (critical)
• Edge thickness — thicker edges indicate more event traffic
• Clustering — devices on the same team cluster together
• Hover details — hover any node for a quick summary tooltip
• Click to detail — click a node to open its full detail view

The graph view is particularly useful for spotting outliers — a single red node in a sea of green is immediately visible, whereas it might get lost in a table of hundreds of rows.

Groups and Policies

Groups are the bridge between fleet management and policy enforcement:

1. Create a group

   Define a group with a name and description (e.g., “Production Servers”).

2. Add devices

   Assign devices to the group. A device can belong to multiple groups.

3. Attach policies

   Create or assign policies scoped to this group. Policies only apply to devices within the group.

4. Monitor

   The group’s aggregate risk and alert count reflect only its member devices.

Devices not assigned to any group inherit the organization-level default policies. Explicit group membership always takes precedence over org defaults.