Skip to main content
New in 3.3 A Tracked View follows the devices in a Devices view over time and records each one as it’s resolved. Use it to drive a group of devices to a fix, such as laptops missing an EDR agent or servers still on an old OS, and to report on progress. You no longer need an Action to do this. A Tracked View is also the starting point for automation: track the view first, then attach a flow to it in Action Center to alert people or raise tickets as devices enter it.

​
Continuous or Snapshot

When you track a view, choose how tracking runs: These replace the Continuous and Snapshot Actions from ThreatAware 3.2.

​
Track a view

1

Pick the devices

In Devices, set your filters or query, or open an existing saved view. You can track a saved view, or a view you’ve just changed.
2

Click Track View

Click Track View in the toolbar at the bottom of the screen. The Track view panel shows the query you’re tracking under Criteria.
3

Fill in the details

  • Name: what you’re tracking, such as “End-User laptops without CrowdStrike”. The view is saved under this name.
  • Assign to: who owns it. The default is Everyone.
  • Description: optional.
  • Priority: Normal, Important or Critical.
4

Choose how tracking runs

Pick Continuous or Snapshot. For Snapshot, set a Deadline in the future.
5

Set extra options if you need them

  • Resolved when: by default, a device is resolved when it leaves the view. Add a query here if it must also meet another condition to count as resolved, for example that the agent is also functioning.
  • Project (Snapshot only): group this snapshot with other tracked views working towards the same deadline. Create a new project with a name, deadline and owner, or add it to an existing one. Each snapshot’s deadline must be before its project’s deadline.
6

Click Track view

The view is saved and tracking starts straight away.
You can’t track a view that a Scheduled Report uses. Delete the scheduled report first.
To track a view, or to edit or stop tracking, you need manage on the matching Tracked View Actions permission (Global, Team or Private, depending on who the view is shared with). Super Admin and Analyst have it by default. See Role permissions.

​
Follow progress

Once a view is tracked, the Devices grid shows two extra columns: Item Status (whether each device is resolved) and Detection Time (when it entered the view). The toolbar shows the view’s name with a Tracked badge and its type, and Track View becomes Edit Tracking. Click View tracking details in the toolbar to open the tracking page. It shows:
  • Unresolved, Success (the share of devices that have been resolved) and Day MTTR (mean time to resolve, in days) at the top
  • the tracking type, description, owner, priority and Resolved when rule
  • a chart of devices in the view over time
  • Tracked Devices, with Unresolved and Resolved tabs and an Export button
  • an audit log of changes to the tracking
Each tracked device has one of these states in Item Status: To find a tracked view again, open the views menu at the top of Devices. Tracked views are marked with a tracking icon.

​
Change, pause or stop tracking

From the ⋮ menu on the tracking page:
  • Edit: change the details. Changing what the view tracks recreates the tracking: the existing tracking is archived and a new one starts.
  • Pause tracking: stop updating device states and progress until you resume.
  • Archive: stop tracking but keep each device’s resolution history.
  • Delete: remove the tracked view and its history permanently. If you might need the history, archive instead.
Continuous and Snapshot Actions from ThreatAware 3.2 carry over as Tracked Views when your tenant moves to 3.3, keeping their history. On ThreatAware 3.2, tracking a view is done by creating a Continuous or Snapshot Action from it.

​
Next steps

Devices

Build the view you want to track

Action Center

Alert people or raise tickets from a tracked view

Scheduled Reports

Send progress to stakeholders on a schedule