ITAM / Endpoint Agent

Fleet Management

Monitor every enrolled endpoint from Agent Discovery, spot outdated agents, and run remote commands without SSH.

Real-world scenario

Carlos Reyes · IT Admin at Bluewave Labs

Friday afternoon Carlos filters Agent Discovery for Offline agents, triggers rescan on a degraded MacBook, and pushes Update agent to machines still on last week's build.

Before you begin

  • Permission to view agent health (ITAM)
  • manage:agent_commands for Run command actions

Overview

Agent Discovery is the fleet-wide view. Each enrolled endpoint agent links to a device record. Heartbeats update CPU, memory, disk, and last-seen timestamps used for status badges in the UI.

Agent status

  • Online: heartbeat received within the offline threshold (about 2 minutes)
  • Degraded: online but CPU above 90% or disk above 90% full
  • Offline: no recent heartbeat; may still show last known vitals

Why an agent stays offline

Laptop asleep, agent service stopped, wrong profile server URL, firewall blocking HTTPS, or VPN down. Carlos runs workverge-agentctl status on the endpoint before assuming server-side failure.

Day-to-day workflow

  1. 1

    Open ITAM → Agent Discovery

    Fleet health lists all enrolled agents with online, degraded, and offline counts. Filter by platform, search hostname, and open a row for details.

  2. 2

    Check version and Outdated chip

    Each row shows agentVersion. An Outdated chip appears when the endpoint runs an older build than the server bundle (GET /api/atx/v1/agent/version).

  3. 3

    Open device Health tab

    From a device record, the Health tab shows vitals, last heartbeat, installed app count, command history, and Run command actions.

  4. 4

    Dispatch remote commands

    Rescan apps, shell, check OS package updates, update agent, or uninstall an application. Commands queue server-side and the agent picks them up on its next poll (about 60 seconds).

Remote commands

CommandWhat it does
Rescan appsImmediate software inventory sync
ShellRun an approved shell command (stdout returned to WorkVerge)
Check for updatesQuery brew/winget/apt for package updates
Update agentIn-place bundle update from the connected server
Uninstall applicationRemove a named app with optional grace period and user notification

Permissions

Run command requires manage:agent_commands. Viewing fleet health uses agent health view permissions configured in your org RBAC.

Related articles