Devices
View and manage protected endpoint devices connected to a workspace.
Important
Managed Service Provider (MSP) admin users with sufficient permissions can also use the global devices page to view and manage protected devices across parent (channel) and child workspaces.
Use the devices page to:
- View a list of protected devices.
- See details for a selected device.
- Filter the display by label, operating system (OS), Coro Agent version, and detected vulnerabilities.
- Search for a specific device using linked ticket IDs or perform a free text search to find devices.
- Encrypt a single drive on a selected device.
- Add and remove device group labels.
- Perform device actions such as remotely scanning for sensitive data or malware, updating the Coro Agent, or exporting a list of devices to a CSV file.
Accessing the devices page
To access the Devices page:
- Sign in to the Coro console .
-
From the sidebar, select
Views > Devices
:
Coro displays the Devices page:
Device information and options
The left-hand pane displays a list of all protected devices.
Each entry in the device list displays the following information:
- Device username
- Device name
-
Connectivity status
note
Devices are marked offline if they have not connected to Coro in the past 24 hours, for example, if they are powered off or disconnected from the internet.
- Device OS
Additionally, indicators against each device identify if the device:
-
Has unresolved issues, for example outstanding tickets or the installed Coro Agent version is out of date. Hover over the indicator to view the issue.
-
Has no open tickets.
-
Belongs to any custom
labelled groups
.
note
The Global devices page provides additional details for unresolved device issues, including issue descriptions and a total issue count when multiple issues are detected on a device.
The right-hand pane contains details for the selected device, including but not limited to:
| Attribute | Description |
|---|---|
| Model & ID | Device details, including manufacturer, model, and unique identifiers. |
| OS | The OS installed on the device. |
| Last known IP | The most recent IP address reported by the device. |
| Coro Protection | The installed Coro Agent version, build number, the date the device was added to Coro protection, and other Agent activity related to the device. |
| Last seen | The last time the device communicated with Coro. |
| Labels | Predefined and custom labels representing the groups to which this device belongs. |
| Drives | Information about the previous eight connected internal and external drives, including: - Name: The display name of the drive. - Status: The current encryption status for a drive: - Encrypted: Drive is encrypted by third-party software. - Encrypted by Coro:Drive is encrypted by Coro. - Not Encrypted: Drive is not encrypted. - Encryption Failed: Drive encryption failed. See Troubleshooting encryption failures. - Encryption Suspended: (Windows drives only) Drive encryption is suspended. - Encryption In Progress: Drive encryption is in progress. - Recovery key: Unique key used to unlock an encrypted drive. - Model: Full name and storage capacity of the drive. - Serial key: Manufacturer-assigned unique identifier for the drive. Note: If a non-removable drive has no name, Coro displays Local Disk. If a removable drive has no name, Coro displays USB Drive. Note: You can perform single-drive encryption from the Drives section. For more information, see Encrypting endpoint device drives. |
| Open tickets | Displays a list of outstanding open tickets. Select a ticket to open the Ticket Log and take remediation actions. If the affected device is online, select RESOLVE to open the Ticket Log and take remediation actions. Select All open tickets to view and remediate all unresolved tickets for the device. |
| Recently logged in users | Displays a list of recently logged-in device users. |
| Activity Log | Displays event entries related to the device. Select All activity to view the complete Activity Log. |
note
Coro displays device details based on the device’s OS, Agent activity, drive encryption status, and available data.
Coro provides an ACTIONS menu for each device in the right-hand pane and for selected devices in the left-hand pane. Available actions are:
| Action | Description |
|---|---|
| Add label | Add this device to a label group. For more details, see Device labels. |
| Allow no encryption | Allow this device to have unencrypted drives without triggering an Unencrypted Endpoint Drive ticket. |
| Close related tickets | Mark all open tickets related to this device as closed and remediated. |
| Collect logs | Retrieve Agent logs from the device. |
| Disable protection | Deactivate Coro protection for this device. To re-enable protection, go to the Activity Log, find the relevant log entry, and select the Undo link. |
| Download logs | Download a ZIP archive of Agent logs retrieved from the device. |
| Export CSV | Export a list of selected devices to a CSV file. See Exporting endpoint device lists to CSV. |
| Isolate from network | Isolate the device from the network. While isolated, the device can’t access the internet or local network resources, but Coro remains connected. |
| Open remote shell | Start a command prompt on the device to run commands remotely. See Using the remote shell to access endpoint devices for more details. |
| Reboot device | Send a remote reboot command to the device. |
| Remote scan for malware | Scan the device's drives for malware. Coro notifies users through the Agent and logs any detections as Malware on endpoint tickets. |
| Remote scan for sensitive data | Scan the device's drives for sensitive data. Coro creates a ticket for each scanned drive listing any detected sensitive files. See Regulatory sensitive information types. |
| Shut down device | Send a remote shut down command to the device. |
| Stop remote scan for malware | Stop an active remote malware scan. |
| Stop remote scan for sensitive data | Stop an active sensitive data scan. |
| Update Agent to latest stable version | Remotely update the Coro Agent to the latest stable version for your workspace. |
| View details | Show relevant tickets in the Ticket Log if this device has open tickets. |
Important
The Linux Agent currently supports the following device actions on supported distributions:
- Close related tickets
- Collect logs
- Download logs
- Remote scan for malware
Important
Available actions depend on the device’s connectivity status. If the device is offline, some actions might be unavailable or delayed until it reconnects.