> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Stealth Devices

> Beta capability that surfaces full-kernel-OS devices (desktops, laptops, servers, VMs) on your network that no management platform is tracking

<Info>
  **Tier:** Stealth Device Detection is included in the **Protect** tier. Customers on Connect or Discover do not see this surface.

  **Beta feature.** Stealth Devices is in active development. Interpret results with care — the identification logic continues to improve and some classifications may shift between releases. The toggle is off by default on new tenants.
</Info>

## What it is

**Stealth Devices** surfaces **full-kernel-OS devices** — Windows, macOS, Linux desktops, laptops, servers, and VMs — that are visible to network-scanning / discovery integrations (Lansweeper, Qualys, PDQ Inventory, etc.) but **not visible** to any of your management platforms — EDR, MDM, identity provider, RMM. In other words, *real computers on your network that nothing is managing*.

Scope is intentionally narrow. Stealth Devices does **not** cover:

* Printers, projectors, smart-display kit
* IoT — sensors, building management, lab equipment
* Network gear — switches, routers, access points
* Mobile devices (phones, tablets — these belong to the separate mobile inventory)

Those device classes are out of scope for ThreatAware's kernel-level matching model. The point of Stealth Devices is the *manageable-but-unmanaged* gap — boxes that *should* be in EDR / MDM / RMM but aren't.

Typical stealth devices in scope:

* Corporate laptops that slipped out of EDR or MDM enrolment
* Servers (physical or virtual) not in any management tool
* Workstations missing from inventory
* VMs spun up outside change control
* Decommissioned-but-still-pinging servers or laptops
* Shadow IT — full-OS workloads stood up outside change control

These are the boxes that fall through the cracks of an EDR-centric inventory: they're real, they're on the network, and no security control owns them.

## How to enable

<Steps>
  <Step title="Open Settings → Misc">
    [Settings → Misc](/settings/misc) from the left rail.
  </Step>

  <Step title="Toggle 'Enable Stealth Devices'">
    The product copy reads: *"Try ThreatAware's new stealth detection capability, designed to identify devices outside of existing management platforms. This feature is in development - interpret results with care."*
  </Step>

  <Step title="Open Network Inventory">
    Stealth-identified devices surface in [Network Inventory](/network-inventory) — `/network-device-inventory`.
  </Step>
</Steps>

The toggle is tenant-wide. You'll need a role with permission to edit Misc settings.

## Where it surfaces

| Surface                                 | What you see                                                                                          |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| [Network Inventory](/network-inventory) | The operational home — devices the network scanners see but management tools don't                    |
| [Device Explorer](/device-explorer)     | A **Stealth** count surfaces in the integration sync row with a delta indicator (e.g. `60 ↗ +100.0%`) |
| [What's New](/whats-new)                | Feature announcement and capability updates                                                           |

The [Network Inventory](/network-inventory) page is the canonical place to investigate individual stealth devices. From there you can:

* Filter by OS, by detecting integration, or by IP range
* Toggle Grouped-by-IP view to find IP ranges full of unmanaged kit
* Cross-reference any row against the [Devices](/device-management) grid to confirm it's genuinely unmanaged

## How to use the findings

Each stealth device is one of:

| Classification                                                                     | What to do                                                                      |
| ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
| **Should be managed** — corporate laptop / server that's slipped out of EDR or MDM | Enrol it; this is the most valuable finding                                     |
| **Decommissioned** — device removed from management but still on the network       | Clean up the residual network presence                                          |
| **Contractor laptop** (corporate-class device, not enrolled)                       | Confirm against your contractor policy; either enrol or remove from the network |
| **Shadow IT** — VMs or servers spun up outside change control                      | Investigate provenance; route through change control                            |

A common operational pattern: create a [Snapshot Action](/actions-snapshot) over a frozen list of stealth devices for a campaign to bring them into management, with a deadline and explicit resolution criteria.

## Caveats

<AccordionGroup>
  <Accordion title="Beta — interpret with care">
    Identification logic is evolving. A device classified as Stealth in one release may classify differently in the next as the matching engine improves. Treat individual classifications as advisory, not authoritative.
  </Accordion>

  <Accordion title="You need network-scanning integrations connected">
    Stealth Devices is computed from the gap between network-scanner discovery and management-tool inventory. If you have no network scanners connected (Lansweeper, Qualys, PDQ Inventory, similar), there's no signal to compute against.
  </Accordion>

  <Accordion title="Some 'stealth' is intentional">
    Not every unmanaged corporate-class device is an immediate finding. Standalone lab machines or air-gapped VMs may be unmanaged by design. The point isn't to drive the count to zero — it's to make sure the population is *known* and accounted for.
  </Accordion>

  <Accordion title="Cross-check via X-Ray">
    For any device that surfaces as Stealth, [X-Ray](/x-ray) shows which sources do see it. If management tools *do* have it but matching failed, that's a matching issue, not a true stealth case.
  </Accordion>
</AccordionGroup>

## Cross-references

<CardGroup cols={3}>
  <Card title="Network Inventory" icon="network-wired" href="/network-inventory">
    The operational home
  </Card>

  <Card title="Settings → Misc" icon="ellipsis" href="/settings/misc">
    Enable Stealth Devices toggle
  </Card>

  <Card title="Device Explorer" icon="globe" href="/device-explorer">
    Stealth count in the integration sync row
  </Card>

  <Card title="Snapshot Actions" icon="camera" href="/actions-snapshot">
    Drive a stealth-device clean-up campaign
  </Card>

  <Card title="X-Ray" icon="x-ray" href="/x-ray">
    Confirm a device is genuinely unmanaged
  </Card>

  <Card title="What's New" icon="sparkles" href="/whats-new">
    Capability updates
  </Card>
</CardGroup>