Deactivate an Arctic Wolf Agent

An offline Arctic Wolf® Agent can be deactivated.

Arctic Wolf Agent deactivation and activation is automatic. If a device is not Online for 90 days, it is automatically removed from the MDR Dashboard Endpoints table. The device automatically reappears in the table the next time that Agent detects it as Online.

Agent also automatically deactivates when it is uninstalled. For more information about uninstalling Agent, see Uninstall Arctic Wolf Agent.

You can also manually deactivate an Agent. After any related incidents are resolved, you can remove any endpoints from the Endpoints table that are Offline.
Note: You are not required to deactivate Arctic Wolf® Agents that are contained. Arctic Wolf recommends keeping Agents in the MDR Dashboard Endpoints table until the containment incident is resolved.
  1. Sign in to the MDR Dashboard.
  2. Click Dashboard > Managed Detection and Response.
  3. Click the Online Endpoints tile.
  4. In the Endpoints table, find the endpoint to deactivate.
  5. In the Actions column, click Remove offline endpoint.
    Tip:

    You can only remove endpoints that are Offline. The Agent identifies endpoints as Offline if the Agent did not check in with them for 72 hours.

  6. In the dialog, click Remove Endpoint.