View Arctic Wolf Agents

Note: Agents and Agent risks associated with assets that were removed from the Risk Dashboard are not visible.
  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Data Collection > Agents.
  3. Optional: Use search or filters to refine the data that displays in the table.

    See View Arctic Wolf Agent filters for more information.

  4. Optional: Hide, show, or rearrange table columns.
    For more information, see Hide, show, or rearrange table columns.
  5. Optional: Change the table row spacing.
    For more information, see Change table row spacing.

Agent table

On the Agent page, the Agent table displays information about Agent endpoints.

The Agent table includes these columns:

  • Hostname — The host name.
  • Status — The Agent status: Online, Offline (# hours), Offline (# days), Offline (> # days), Contained, or Degraded.
  • OS Version — The OS of the host.
  • Containment Driver — One of these status values:
    • Disabled — The containment driver is waiting to be uninstalled.
    • Pending — The containment driver is waiting to be installed.
    • Version — The version number of the installed containment driver.
    • N/A — The containment driver can't be installed on the endpoint.
  • Sysmon — One of these status values:
    • Disabled — Sysmon management is not enabled for this endpoint.
    • Pending — Sysmon management is enabled by the endpoint, but Sysmon is not installed on the device.
    • Version — Sysmon management is enabled, and the installed version of Sysmon displays.
    • N/A — Sysmon is not supported on Linux or macOS.
  • IP Address — The IP address.
  • Version — The version of the Agent.
  • Group Assignment — The group that manages the endpoint.
  • Domain — The Active Directory domain name used to manage users.
  • OS Type — Either Linux, macOS, or Windows.
  • Architecture — Either x64, x86, or arm64 architecture.
  • First Reported — The date and time that the Agent first reported.
  • City — The geographical location of the host.
  • Country — The geographical location of the host.
  • Last Reported — The date and time that the Agent last reported.
  • Username — The username of the Agent.
  • ID — The UUID of the Agent.
  • VDI State — The image used to create the non-persistent Virtual Desktop Infrastructure (VDI) instance. This column does not display details for persistent instances. State options include:
    • None — This instance is not part of a VDI configuration.
    • Instance — This instance was created from the golden image.
    • Template — The master image template.

Hide, show, or rearrange table columns

You can hide, show, or rearrange table columns to view the most useful information.

Note: Your column settings are maintained in local storage until you click Reset in the Columns dialog.
  1. Click Columns.
  2. For each column that you want to change, do one of these actions:
    • Hide a column — Clear the checkbox.
    • Show a column — Select the checkbox.
  3. Optional: Click Show/Hide All to select or clear all checkboxes.
  4. Optional: Click Reset to show the default table columns.
  5. Optional: As needed, click and drag a column heading into the desired position or click in the column heading, and then click Pin to left, Pin to right, or Hide column.

Change table row spacing

You can change the space between your table rows to help with readability.

  1. Click Density.
  2. Click one of these options:
    • Compact — Has a small amount of space between table rows.
    • Standard — Has a medium amount of space between table rows.
    • Comfortable — Has a large amount of space between table rows.