View and manage endpoint devices connected to a workspace.
Managed Service Provider (MSP) admin users with sufficient permissions can also use the global devices page to view and manage protected devices across parent (channel) and child workspaces.
Use the devices page to:
- View a list of endpoint devices registered with Coro.
- See details for a selected device.
- Filter the display by:
- User association: Devices associated with protected users.
- Groups:
- Status: Device connectivity status.
- Agent health: Devices with impaired Agent functionality due to required restarts, security software conflicts, or outdated Agent versions.
- Labels: Assigned device labels.
- OS version: The operating system (OS) running on the device.
- Coro version: The installed Coro Agent version.
- Vulnerability: Detected vulnerabilities on the device.
- Search for a specific device using linked ticket IDs or perform a free text search to find devices.
- Encrypt a single drive on a selected device.
- Add and remove device group labels.
- Perform device actions such as remotely scanning for sensitive data or malware, updating the Coro Agent, or exporting a list of devices to a CSV file.
To access the Devices page:
From the Actionboard, select the Protected Devices panel:
Coro displays the Devices page:
Devices connected to your workspace might be subject to a protection limit depending on your Coro subscription and workspace status. You can protect up to the maximum number of devices allowed within your workspace limit, and Coro can prevent you from adding more devices if you go over this limit.
Coro displays your current device Protection limit in the banner at the top of the page, with each device showing its individual protection status:
If you need to protect more devices than permitted, unlicense or disable protection for unused devices, or contact your sales representative to discuss options for increasing your limit.
To add a new device for protection in Coro, select + ENROLL DEVICES:
Coro displays the Enroll devices dialog:
Choose from:
- Install it for your users: Download the Coro Agent installation package, typically for mass deployment of the Coro Agent.
- Let users install it for themselves: Get a URL for the Agent installer, usually to share with specific end users for direct installation on their devices.
To learn more, see Agent deployment.
The left-hand pane displays a list of all protected devices.
Each entry in the device list displays the following information:
Device username
Device name
Connectivity status
Devices are marked offline if they have not connected to Coro in the past 24 hours, for example, if they are powered off or disconnected from the internet.
Device OS
Protection indicator (only for workspaces with a device protection limit):
- Protected: The device is protected by Coro.
- Unlicensed: The device is not protected by Coro (either protection was disabled or the device was unlicensed).
Additionally, indicators against each device identify if the device:
Has unresolved issues, for example outstanding tickets or the installed Coro Agent version is out of date. Hover over the indicator to view the issue.
Has no open tickets.
Belongs to any custom labelled groups.
The Global devices page provides additional details for unresolved device issues, including issue descriptions and a total issue count when multiple issues are detected on a device.
The right-hand pane contains details for the selected device, including but not limited to:
| Attribute | Description |
|---|---|
| Model & ID | Device details, including manufacturer, model, and unique identifiers. |
| OS | The OS installed on the device. |
| Hostname | The hostname of the device. |
| Last known IP | The most recent IP address reported by the device. |
| Coro Network Status | The last time the device connected to the Coro Network service. Coro displays this for Windows, macOS, and Android devices assigned to the VPN or ZTNA. |
| Coro Protection | The installed Coro Agent version, build number, the date the device was added to Coro protection, and other Agent activity related to the device. |
Malware Scan | Details about the most recent manually-activated or scheduled malware scan on the device. Coro shows the last scan date, number of files scanned, status, and results of the scan. Coro displays an indicator for any threats discovered, with a link to review the scan results in the device activity log. |
Sensitive Data Scan | Details about the most recent manually-activated or scheduled sensitive data scan on the device. Coro shows the last scan date, number of files scanned, status, and results of the scan. Coro displays an indicator for any sensitive data discovered by the scan, with a link to review the scan results in the device activity log. |
| Last seen | The last time the device communicated with Coro. |
| Labels | Predefined and custom labels representing the groups to which this device belongs. |
Drives | Information about the previous eight connected internal and external drives, including:
If a non-removable drive has no name, Coro displays Local Disk. If a removable drive has no name, Coro displays USB Drive. You can perform single-drive encryption from the Drives section. |
| Open tickets | Displays a list of outstanding open tickets. Select a ticket to open the Ticket Log and take remediation actions. If the affected device is online, select RESOLVE to open the Ticket Log and take remediation actions. Select All open tickets to view and remediate all unresolved tickets for the device. |
| Recently logged in users | Displays a list of recently logged-in device users. |
| Activity Log | Displays event entries related to the device. Select All activity to view the complete Activity Log. |
Coro displays device details based on the device's OS, Agent activity, drive encryption status, and available data.
Coro provides an ACTIONS menu for each device in the right-hand pane and for selected devices in the left-hand pane. Available actions are:
| Action | Description |
|---|---|
| Add label | Add this device to a label group. For more details, see Device labels. |
| Allow no encryption | Allow this device to have unencrypted drives without triggering an Unencrypted Endpoint Drive ticket. |
| Close related tickets | Mark all open tickets related to this device as closed and remediated. |
| Collect logs | Retrieve Agent logs from the device. |
Disable protection | Deactivate Coro protection for this device and mark it as Unlicensed. To re-enable protection, go to the Activity Log, find the relevant log entry, and select the Undo link. |
| Download logs | Download a ZIP archive of Agent logs retrieved from the device. |
| Export CSV | Export a list of selected devices to a CSV file. See Exporting endpoint device lists to CSV. |
| Isolate from network | Isolate the device from the network. While isolated, the device can’t access the internet or local network resources, but Coro remains connected. |
License device | License and protect the device. This option applies only if your workspace subscription has protection limits in place for devices. You can only license a device if there is an available free slot within your current protection limit. The banner at the top of page shows this information. |
Open remote shell | Start a command prompt on the device to run commands remotely. See Using the remote shell to access endpoint devices for more details. |
| Reboot device | Send a remote reboot command to the device. |
Remote scan for malware | Scan the device's drives for malware. Coro notifies users through the Agent and logs any detections as Malware on endpoint tickets. |
Remote scan for sensitive data | Scan the device's drives for sensitive data. Coro creates a ticket for each scanned drive listing any detected sensitive files. See Regulatory sensitive information types. |
Send message via Coro agent | Send a custom message to the device (maximum length 200 characters). Messages appear to end-users as notifications via the Coro agent. This action applies only for devices running Coro agent version 3.8.3 and later. |
| Shut down device | Send a remote shut down command to the device. |
| Stop remote scan for malware | Stop an active remote malware scan. |
| Stop remote scan for sensitive data | Stop an active sensitive data scan. |
| Uninstall Agent | (Windows devices) Send an uninstall command to the device. See Uninstalling Windows devices. |
Unlicense device | Remove the device from protection and reliniquish the license for use with other devices. The device remains in the list marked as Unlicensed. This option applies only if your workspace subscription has protection limits in place for devices. To reinstate the device, use the License device action. Alternatively, go to the Activity Log, find the relevant log entry, and select the Undo link. |
| Update Agent to latest stable version | Remotely update the Coro Agent to the latest stable version for your workspace. |
| View details | Show relevant tickets in the Ticket Log if this device has open tickets. |
The Linux Agent currently supports the following device actions on supported distributions:
- Close related tickets
- Collect logs
- Disable protection
- Download logs
- Remote scan for malware
Available actions depend on the device’s connectivity status. If the device is offline, some actions might be unavailable or delayed until it reconnects.