Devices

Discover AI > Devices lists every device that runs a Discover AI client: the macOS agent, the Windows agent, or a browser extension. It shows each device's health, last check-in, installed clients and how it authenticates.

The Devices page

The time range picks which devices are listed: a device appears if one of its clients was active in the range. Every column shows the device's current state. The OS filter narrows the list by platform.

KPI cards

Table

Columns: Hostname, Source, OS, macOS Agent, Windows Agent, Extension, Health, Last Check-in, IP, User, Auth, Assurance and Serial (macOS only). You can hide and reorder columns. For a device with only a browser extension, the hostname column shows the user's name.

• Search matches hostname, user, IP, OS, client versions, health and authentication status.
• Health filter: All statuses, Healthy, Degraded, Offline.
• Auth filter: All auth, Certified, Partial, API key, Revoked, Legacy key present.

An extension version below 0.1.18 is flagged in amber. Those versions cannot enroll themselves from the enrollment script; update the extension.

Select a row to open the device detail panel.

Device health

Each client on a device reports a check-in about every hour. Health is worked out per client and then rolled up to the device.

The device takes the worst state that applies:

• Every client offline: the device is Offline.
• Some clients offline and at least one online: the device is Degraded, with a reason such as "1 of 3 installs offline".
• All online and any client degraded: Degraded.
• Otherwise: Healthy.

A browser that has been closed for a long time keeps its device Degraded until it checks in again or the device is deleted.

Authentication status

The Auth column shows how the device's clients authenticate:

An extra API key on device badge appears when a device still stores the project key after moving to certificates. Re-run the enrollment script to clear it. Only clients seen in the last 7 days count toward the badge.

Assurance shows how well the device's key is protected: Attested, Hardware or Software, with the key store (TPM, Secure Enclave, Software, or Browser (non-extractable)).

Device detail panel

• Identity & compliance: platform, OS, architecture, IP address, first and last seen, serial, MDM enrollment, job title, department, whether the user is an admin, and the user's name.
• Certificates & access (or Device actions when the project uses API keys): see below.
• Installs: one card per client with its version, health, upload failures, queued events and last check-in. For the macOS agent it also shows the Accessibility, Input Monitoring, Full Disk Access, Network Extension and Endpoint Security permissions.
• Network activity (macOS): connections and bytes sent and received to AI hosts.
• Recent checkins: the latest check-in from each client.

The panel can lag the table by up to 5 minutes.

CrowdStrike Falcon agent ID

When the CrowdStrike Falcon sensor is installed, the macOS and Windows agents read its agent ID (AID) and report it at every check-in. ANTS Platform stores it with the device and adds it, with the hostname, serial number and user principal name, to the events it sends to your SIEM and to policy violation webhooks. Collection is off by default and is turned on per deployment. Devices with only a browser extension have no AID. See CrowdStrike Falcon.

Device actions

Open a device and use the Actions menu. Each action asks for a reason, which is written to the audit log.

With device certificates you can also Revoke a single certificate. That client's next request is refused and it stops collecting. Events queued on the device and not yet uploaded are lost. A revoked device can enroll again with a new key unless it is blocked.

Unenrolling a device

Settings > Deployment & Keys > Enroll devices > This machine has an Uninstall script button next to the enrollment script. The script is valid for 24 hours after download. When it runs on a device, it removes the local enrollment and revokes that device's certificates in the project. A device unenrolled this way can enroll again later with the enrollment script. Unenrolling raises an Agent unenrolled alert when tamper and silence alerts are on.

Tamper and silence alerts

Discover AI alerts you when the control on a device may have been switched off or removed. Set them up under Settings > Discover AI > Tamper alerts. Each alert is off until you turn it on and choose where it goes.

Each alert names the device, its user and the client concerned. Alerts can go to:

• Email, when your deployment has an email server configured.
• Slack, to the channel you choose. See Slack.
• The policy violation webhook. See Policy Violation Webhooks.

Changing these settings requires write access to Discover AI configuration, which Owner and Department Admin have by default.

Preventing bypass

• Extension removal: force-install the extension with the managed browser policies, so a managed user cannot remove or disable it. See Deploying Agents & Extensions.
• Private browsing: turn on Disable private browsing in the generated Chrome and Edge policies. See Disable private browsing.
• Windows agent: runs as a system service that standard users cannot stop.
• macOS agent: runs in the logged-in user's session. The Device silent alert tells you when it stops reporting.
• Unsupported browsers: restrict them with your MDM.

Alternate DNS, personal VPNs and hotspots are not detected by these alerts.

Device certificates

Device certificates are used when Settings > Deployment & Keys > Authentication method is set to Device certificates (mTLS). See Deploying Agents & Extensions.

• Desktop agents get an X.509 certificate during enrollment. Browser extensions cannot use a client certificate, so they create a non-extractable key in the browser, register its public half, and sign each request with it. Both appear in the same certificate list.
• Certificates are valid for 365 days by default. The desktop agent renews its certificate automatically with a new key. The old certificate keeps working for 24 hours after renewal.
• The Certificates tab in the device panel lists each certificate by fingerprint, with its status (ACTIVE, REVOKED or SUPERSEDED), client, and created, expiry or revocation details. Revocation history lists who revoked each certificate, when and why.
• Revocation takes effect within seconds. There is no CRL or OCSP to distribute.

Fleet enrollment credentials

With device certificates, MDM-managed devices register with a fleet enrollment credential (fleet-ap-...) instead of the project keys. The credential only lets a device register. Each device then authenticates with its own certificate.

• Created by: downloading the enrollment script with Download enroll script (device certificates) creates a new credential on every download. In Install clients, payloads that need one show Generate fleet credential, with a Valid for (hours) field that takes whole hours from 1 to 8760 (365 days).
• Shown once: copy it when it is created. Only a hash is stored.
• Default validity: 24 hours.
• Used in: the macOS managed preferences key fleetEnrollmentCredential, and the browser 3rdparty policy key fleetEnrollmentCredential.
• Reuse: any number of devices can redeem one credential, but each device can register only once per client type.
• Listed under: Keys & credentials > Issued fleet credentials, with scope, the devices that redeemed it, expiry and status (Active, Revoked, Expired).
• Revoke: stops new devices from enrolling with it. Devices already enrolled keep working. Revocation cannot be undone.

Related

• Deploying Agents & Extensions
• Troubleshooting
• Audit Logs