Devices

Devices lists every device across your environment, from every connected tool, matched into one record per device. Where Device Explorer shows your estate on a map, Devices is the table you filter, save and act on.

​

What’s on the page

Columns are organised into five groups: The toolbar at the bottom of the screen switches what the integration columns show:

• Deployment: whether the device exists in each tool. Use it for audit, to prove “we have this many devices in CrowdStrike”.
• Vitals: whether each tool is healthy on the device: Healthy, Functioning, Misconfigured or Not Healthy. Use it for triage, to see how many of those are actually working. See Security Monitoring.

Click a column header to sort by it.

​

Adding columns

The default columns are kept minimal. To add more, click Toggle columns in the bottom toolbar (or press ⇧ C). Hundreds of fields are available, including: Before you add a clause to a query, check whether there’s a column that shows the same thing.

​

Opening a device

Click a device’s name to open its details in a window over the grid.

• Header: the device name, its tags and a ⋯ menu. The menu has Split Services, for when tools have been matched into one device that are really separate devices.
• Device details: OS and build, location, when it was last seen, and hardware such as architecture, serial number, manufacturer, model, storage, IP and MAC address. Click Show more for the rest.
• Vitals: a tile per integration, showing whether it’s Required on this device, its state, and when the tool last saw the device.
• Timeline: when each tool reported the device over time. Switch between System Timeline and Timeline Fingerprint.
• Details (the drawer on the right): the device’s Issues, Software, Cloud Applications and Notes.
• User card (on the left): the device’s user, with their job title and department, last successful login, the Accounts they hold and their Recent Devices. Click a recent device to open it.

Minimise the window to keep a device to hand: it stays as a tab at the bottom right of the screen until you close it.

​

Searching, filtering and saving

​

Searching

The search bar takes plain text, such as a name prefix (ACS-31-), a query in the query language (os:Windows AND tags:End-User) or a question in natural language.

​

Active, inactive and other devices

The Active menu at the start of the search bar chooses which devices the grid shows: A device is inactive when no connected tool has seen it for longer than the Inactive device threshold in Settings → Misc (30 days by default). There’s no field for this in the query language.

​

Saving a view

When you change the grid, by searching, sorting, adding columns or grouping, the view name changes to Custom *. To keep it:

1. Click the save icon next to Custom * in the bottom toolbar.
2. Give the view a name.
3. Choose who can see it: Only me or Everyone. Tick Make this my default view to open Devices on it.
4. Click Save.

Saved views are listed in the views menu next to Devices at the top of the screen (⇧ V). Scheduled Reports and Tracked Views both start from a saved view.

​

Rename or delete a saved view

1. Open the view from the views menu next to Devices (⇧ V).
2. In the bottom toolbar, click the edit icon (pencil) next to the view’s name. The Edit current view panel opens.
3. To rename the view, change its name and click Save.
4. To delete the view, click Delete, then Yes to confirm.

You can’t change who can see a view after it’s created. To share a private view, or make a shared view private, save a new view with the visibility you want, then delete the old one. Make this my default view is only available for views that are visible to Only me.

​

Group rows

New in 3.3 Group the device list by any column, such as operating system or a tag, to see devices under collapsible headers with a count for each group. Drag in a second column to group within each group, for example OS and then OS Build to see how many Windows devices are on each build. Drag the columns up or down in Row Groups to change the order. You can group by a Vital column too. For example, group by CrowdStrike to see how many devices are Healthy, Misconfigured, Not Functioning, Not Required or Not Deployed, then add OS underneath to see where the gaps are. Save it as a view to come back to it. To go back to a flat list, click the × next to each column in Row Groups. Grouping changes the view, so the view name shows Custom * until you save it or discard the changes. Save the view to keep the grouping. Default View always opens ungrouped.

​

Acting on several devices

Click Bulk Actions in the bottom toolbar, select devices with the checkboxes, then choose an action from Select Action. The ⋯ menu in the toolbar also has Tag by CSV, for tagging a list of devices from a file.

​

Tracking devices to a fix

To follow a group of devices until each one is fixed, click Track View in the bottom toolbar. Tracking records when each device enters and leaves the view, and reports progress and time to fix. See Tracked Views. From a tracked view you can then build a flow in Action Center to email people or raise tickets as devices enter it.

​

Exporting

Click Export in the bottom toolbar to download the current view, with its columns, filter and sort. For a regular export, save the view and add it to a Scheduled Report. For very large sets, use the API.

​

Where the data comes from

Every connected tool reports its own view of a device, and a single device often appears in five or more tools. ThreatAware matches these into one device record, with every tool’s data attached. Hover an integration column to see which tools report a device, or open X-Ray for the full breakdown.

​

How devices are matched

Matching uses these signals:

​

Next steps