> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tracked Views

> Follow a group of devices until each one is fixed, with progress, time to fix and an audit trail

Available on

New in 3.3 A Tracked View follows the devices in a [Devices](https://docs.threataware.com/device-management.md) view over time and records each one as it's resolved. Use it to drive a group of devices to a fix, such as laptops missing an EDR agent or servers still on an old OS, and to report on progress. You no longer need an Action to do this.

A Tracked View is also the starting point for automation: track the view first, then attach a flow to it in [Action Center](https://docs.threataware.com/automation.md) to alert people or raise tickets as devices enter it.

## Continuous or Snapshot

When you track a view, choose how tracking runs:

| | Continuous | Snapshot |
| - | - | - |
| **Which devices** | Any device that matches the view, now or later | Only the devices in the view when tracking starts |
| **End date** | None | A deadline you set |
| **Use it for** | Ongoing hygiene, such as "every End-User laptop has CrowdStrike" | Projects, such as an OS migration or a decommissioning wave |

These replace the Continuous and Snapshot Actions from ThreatAware 3.2.

## Track a view

**1. Pick the devices**

In **Devices**, set your filters or query, or open an existing saved view. You can track a saved view, or a view you've just changed.

**2. Click Track View**

Click **Track View** in the toolbar at the bottom of the screen. The **Track view** panel shows the query you're tracking under **Criteria**.

**3. Fill in the details**

* **Name**: what you're tracking, such as "End-User laptops without CrowdStrike". The view is saved under this name.
* **Assign to**: who owns it. The default is **Everyone**.
* **Description**: optional.
* **Priority**: **Normal**, **Important** or **Critical**.

**4. Choose how tracking runs**

Pick **Continuous** or **Snapshot**. For **Snapshot**, set a **Deadline** in the future.

**5. Set extra options if you need them**

* **Resolved when**: by default, a device is resolved when it leaves the view. Add a query here if it must also meet another condition to count as resolved, for example that the agent is also functioning.
* **Project** (Snapshot only): group this snapshot with other tracked views working towards the same deadline. Create a new project with a name, deadline and owner, or add it to an existing one. Each snapshot's deadline must be before its project's deadline.

**6. Click Track view**

The view is saved and tracking starts straight away.

> [!NOTE]
>
> You can't track a view that a [Scheduled Report](https://docs.threataware.com/scheduled-reports.md) uses. Delete the scheduled report first.

To track a view, or to edit or stop tracking, you need **manage** on the matching **Tracked View Actions** permission (Global, Team or Private, depending on who the view is shared with). Super Admin and Analyst have it by default. See [Role permissions](https://docs.threataware.com/reference/role-permissions.md#device-inventory).

## Follow progress

Once a view is tracked, the Devices grid shows two extra columns: **Item Status** (whether each device is resolved) and **Detection Time** (when it entered the view). The toolbar shows the view's name with a **Tracked** badge and its type, and **Track View** becomes **Edit Tracking**.

Click **View tracking details** in the toolbar to open the tracking page. It shows:

* **Unresolved**, **Success** (the share of devices that have been resolved) and **Day MTTR** (mean time to resolve, in days) at the top
* the tracking type, description, owner, priority and **Resolved when** rule
* a chart of devices in the view over time
* **Tracked Devices**, with **Unresolved** and **Resolved** tabs and an **Export** button
* an audit log of changes to the tracking

Each tracked device has one of these states in **Item Status**:

| State | Meaning |
| - | - |
| **Unresolved** | The device is still in the view |
| **Partial Resolved** | The device has left the view but doesn't yet meet your **Resolved when** query |
| **Resolved** | The device has been fixed |
| **Untracked** | Snapshot only: the device is no longer being tracked, for example because it was removed from ThreatAware |

To find a tracked view again, open the views menu at the top of **Devices**. Tracked views are marked with a tracking icon.

## Change, pause or stop tracking

From the **⋮** menu on the tracking page:

* **Edit**: change the details. Changing what the view tracks recreates the tracking: the existing tracking is archived and a new one starts.
* **Pause tracking**: stop updating device states and progress until you resume.
* **Archive**: stop tracking but keep each device's resolution history.
* **Delete**: remove the tracked view and its history permanently. If you might need the history, archive instead.

Continuous and Snapshot Actions from ThreatAware 3.2 carry over as Tracked Views when your tenant moves to 3.3, keeping their history.

On ThreatAware 3.2, tracking a view is done by creating a [Continuous](https://docs.threataware.com/actions-continuous.md) or [Snapshot](https://docs.threataware.com/actions-snapshot.md) Action from it. 

## Next steps

> **[Devices](https://docs.threataware.com/device-management.md)**
>
> Build the view you want to track

> **[Action Center](https://docs.threataware.com/automation.md)**
>
> Alert people or raise tickets from a tracked view

> **[Scheduled Reports](https://docs.threataware.com/scheduled-reports.md)**
>
> Send progress to stakeholders on a schedule


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.