Skip to main content
Tier note: this guide walks you through the full set of features available in the Protect tier (Vitals, Issues, Action Center, User & Software Inventory). If you’re on Connect or Discover, some sections won’t apply to your tenant yet — they’re marked per-page. See your account team about upgrading.
This guide picks up where Onboarding leaves off. You have integrations connected, devices flowing in. Now what?

​
Hour 1: Walk the product

1

Run the in-product tour

Your initials → Help for this page → Restart tour. Nine screens, two minutes, every Dashboard panel explained. Tour covers the full content.
2

Open Device Explorer

/device-explorer. Look at the globe — does it match your geographic footprint? Look at the integration sync row — every integration Now or under 2 hours?
3

Open Devices and click around

Click into 5-10 random device rows. Use the X-Ray tab on each. Do you see data from multiple integrations? Are timestamps fresh?
4

Visit Issues

/issues. Sort by severity. Click into a few Critical or High Issues to understand the format. Don’t act yet — just absorb.
5

Visit Action Center

/action-center. Likely empty on day one — that’s expected. You’ll create your first Action in Hour 6.

​
Hours 2-4: Review the data

​
Estate sanity check

The Dashboard’s Estate Summary shows your total device count. Compare against:
  • Your AD device count
  • Your Endpoint Detection and Response (EDR) tool’s device count
  • Your Mobile Device Management (MDM) tool’s device count
  • Your IT spreadsheet (if any)
If Protect’s count is substantially different from all sources, three likely causes:

​
Tag the estate

Open Settings → Tags. For each tag:
  1. Review the Logic Engine rule
  2. Check device count looks plausible
  3. Open Coverage Explorer to find devices in zero tags
Common day-one tag work:
  • Create regional tags if not present (EMEA, NA, APAC)
  • Refine the End-User rule to exclude devices that aren’t truly end-user (servers in disguise, stock devices)
  • Add a Stock tag for devices not yet deployed (so they don’t fail Vitals)
See Tags & Logic Engine for design patterns.

​
Hours 5-8: Configure your first Vitals

Vitals are useless without configuration — they have nothing to compare against. Start with EDR.
1

Open Devices in Vitals view

/devices → footer toggle Vitals (not Deployment).
2

Find your EDR column

Likely CrowdStrike, Defender, or SentinelOne. Click its column header gear → Enter Configure Mode.
3

Set tag requirements

Tick End-User, Server, VM. Leave BYOD and Stock unticked.
4

Choose configuration checks

Start light:
  • ✓ Agent reporting in last 7 days
  • ✓ Sensor status = Online
  • (skip Prevention policy for now — add later once you understand the noise)
5

Exit Configure Mode

The column repaints. Sort it to see your gaps and the healthy population.
6

Spot-check 10 devices

Click 10 unhealthy devices in turn, open X-Ray, confirm the unhealthy state has a real cause. If you find false positives, return to Configure Mode and adjust.
Repeat for one MDM (Intune or Jamf) and one identity check (Multi-Factor Authentication (MFA) enrolment).

​
Hour 6-8: Save useful views

Build the queries you’ll come back to: For each: build in Devices → Save View → name → Team visibility.

​
Day 2: First Action and first Scheduled Report

​
Your first Action

Start small. Build a Continuous Action with email-only automation:
1

In Devices, build the query

tags:End-User AND system.crowdstrike.required:true AND system.crowdstrike.deployed:false
2

Click Create Action

Footer button.
3

Configure

  • Name: End-User Laptops Missing CrowdStrike
  • Type: Continuous
  • Priority: Important
  • Owner: your SecOps team
  • Minimum time in view: 24 hours
  • Resolution: system.crowdstrike.deployed:true AND system.crowdstrike.functioning:true AND system.crowdstrike.configuredCorrectly:true
4

Automation: Email

Recipients: yourself + security ops shared mailbox. Subject: Device {DeviceName} missing CrowdStrike — needs deployment.
5

Save and watch

The Action goes live. Within the next sync cycle, devices matching the trigger will start to surface. After 24 hours of being in view, emails begin.
Validate that the emails look right before adding additional channels (tickets, webhooks).

​
Your first Scheduled Report

Take the first saved view you created (e.g. “End-User Without EDR”) and schedule it:
  1. Settings → Scheduled Reports → + Create Report
  2. Saved view: pick your saved view
  3. Format: CSV
  4. Schedule: Weekly, Monday 8am
  5. Recipients: your immediate team (3-4 people max)
  6. Save
The first delivery is the following Monday.

​
Days 3-5: Iterate and expand

​
Refine Vitals based on real data

After 48 hours of operation:
  • Review the Vitals view sorted by unhealthy count
  • For each integration where you see noise: tighten requirements, add grace periods, exclude transient states
  • For each gap pattern (e.g. all of one office failing): create a Snapshot Action to drive a campaign

​
Expand integrations

Add Phase 2 integrations:
  • Vulnerability scanner (Qualys, Rapid7, Tenable)
  • Patch management (System Center Configuration Manager (SCCM) via PowerShell Relay)
  • Network scanning (Lansweeper, PDQ)
  • ITSM (ServiceNow / Jira / Halo for ticket automation)

​
Wire more Actions

Once email Actions are stable:
  • Layer ServiceNow ticket creation onto the same triggers (Phase 2 of an Action)
  • Build broken-agent Recovery Action (system.crowdstrike.deployed:true AND system.crowdstrike.functioning:false with 48-hour debounce)
  • Create a Snapshot Action for any in-flight project (OS migration, decommissioning wave)

​
Explore Reporting

Reporting editor → click + New. Build a small dashboard:
The AI builds it in 60-90 seconds. Iterate on what you’d want leadership to see.

​
Week 1 retrospective

By the end of week 1 you should have:
  • ✓ 5-10 integrations connected and syncing
  • ✓ Tag taxonomy in place
  • ✓ Vitals configured for EDR, MDM, encryption
  • ✓ 5-10 saved views
  • ✓ 2-3 Continuous Actions running
  • ✓ 1-2 Scheduled Reports going out
  • ✓ A starter Studio dashboard
  • ✓ A clearer picture of your gaps than any single tool gave you

​
Week 2-4: Maturity

​
Common first-week questions

Three usual causes:
  1. Protect deduplicates across tools (right answer; total will look lower than the sum of all tool counts)
  2. Active vs. Inactive filter (Protect defaults to Active)
  3. The tool itself counts archived / deleted devices that Protect filters out
Use X-Ray on a specific device to see exactly which tools see it.
Hourly from every integration. Processing takes 5-30 minutes after the sync. To force a sync now, go to Settings → Integrations → click the integration → Sync Now.
No — and that’s intentional. Protect reflects reality from your tools. If a device should be gone, decommission it in the source tool; it’ll drop out of Protect within the Inactive threshold.
Protect detected that the device is active elsewhere (recent activity in other tools) but this specific agent hasn’t reported in too long. This is silent-failure detection — the agent is probably broken. Investigate via X-Ray.
Build a saved view → Export from the footer (CSV / JSON / XLSX). Or schedule it as a Scheduled Report. For programmatic / very large exports, use the API.
Probably — contact your account manager with the vendor name + their API documentation. Typical turnaround for a new integration is 2-4 weeks.

​
Success metrics

​
See also

Platform Overview

The conceptual map

Tour

Restart the in-product tour

Glossary

Every term, defined

Vitals Configuration

Setup deep-dive

Action Center

Automation patterns

Troubleshooting

Common issues