Product guide

Endpoint Management

Manage your device fleet, users, agent profiles, updates, automations, remote operations, baseline drift, and policy enforcements.

Overview#

Endpoint Management is the operational core of the platform. Everything you know about a device - its hardware, software, users, network, health, and security posture - is collected here and kept in one place per endpoint.

The module is built around the endpoint detail page. Fleet lists help you find the right device; the detail page is where you understand it and act on it.

Moftgate fleet overview screen — Center with cross-module security posture, needs attention cards, critical incidents, and fleet signals.

Fleet Management#

The fleet view is the entry point. It is designed for large environments, so every list is paginated on the server and every column can be searched, sorted, and filtered.

Use the advanced filter drawer to build a filter from the model columns and save it for later reuse.
Filter by operating system, status, group, tag, and profile to narrow a large fleet quickly.
Use the date range picker when you are looking for recently changed or recently seen devices.
Open the endpoint by selecting its name; the detail page is the single source of truth for that device.
Two views are available: Fleet Table (paginated device list) and Mesh Topology Map (visual network mesh).

Endpoint fleet intelligence table — Fleet table with OS/status/device type/security/RAM filters, tags, mesh topology, and per-endpoint actions.

Endpoint Detail Page#

The endpoint detail page is the single source of truth for a device. It aggregates hardware, software, network, activity, DLP posture, patch status, and agent health in one view, and exposes every action you can take on that endpoint.

Endpoint detail overview tab — Endpoint detail Overview tab with hostname, agent version, last seen, device type, and device actions (Sync, Restart, Remote, Files).

The detail page has 13 tabs, each showing a different aspect of the endpoint:

Tab	What it shows
Overview	Hostname, agent version, last seen, device type, device actions
System	OS details, hardware specs, CPU, RAM, disk, battery
Applications	Installed software, versions, publishers, vulnerability status
Users	User sessions, login history, active status
Updates	Available updates, deployment policies, patch history
Automations	Automation runs, scheduled and triggered actions
Network	Network interfaces, IP addresses, MAC, DNS
Active Connections	Live socket connections, remote endpoints, ports
Performance	CPU/RAM/disk usage trends, boot time, crashes
Monitoring	Monitor policies applied to this endpoint, active alerts
Security	Firewall, antivirus, encryption, USB block, password policy
Configuration Drift	Baseline comparison, drift events, compliance status
File Integrity	FIM events, file changes, additions, deletions

Endpoint detail System tab — System tab: OS details, hardware specs, CPU, RAM, disk, and battery information.

The System tab has its own sub-navigation with six sub-tabs:

Sub-tab	What it shows
Overview	OS, CPU, RAM, disk, battery summary
Hardware	Hardware components: CPU, RAM, disk, GPU, battery
Devices	Connected devices: USB, Bluetooth, audio, cameras
Network	Network interfaces, IP, MAC, DNS, routes
Software	Installed software, versions, publishers
Activity & Logs	System events, log entries, crash reports

Endpoint detail System Hardware sub-tab — System > Hardware: CPU, RAM, disk, GPU, and battery components with specs.

Endpoint detail System Devices sub-tab — System > Devices: connected USB, Bluetooth, audio, and camera devices.

Endpoint detail System Network sub-tab — System > Network: network interfaces, IP addresses, MAC, DNS, and routes.

Endpoint detail System Software sub-tab — System > Software: installed software list with versions and publishers.

Endpoint detail System Activity & Logs sub-tab — System > Activity & Logs: system events, log entries, and crash reports.

Endpoint detail Applications tab — Applications tab: installed software with versions, publishers, and vulnerability status.

Endpoint detail Updates tab — Updates tab: available updates, deployment policies, and patch history for this endpoint.

Endpoint detail Network tab — Network tab: network interfaces, IP addresses, MAC addresses, and DNS configuration.

Endpoint detail Monitoring tab — Monitoring tab: monitor policies applied to this endpoint and active alerts.

Endpoint detail Security tab — Security tab: firewall, antivirus, encryption, USB block, and password policy status.

Endpoint detail Configuration Drift tab — Configuration Drift tab: baseline comparison, drift events, and compliance status.

Endpoint detail File Integrity tab — File Integrity tab: FIM events with file changes, additions, and deletions.

The following actions are available from the endpoint detail page:

Action	What it does
Sync	Trigger a manual telemetry sync from the agent. The agent pushes queued data and pulls updated policies.
Restart	Send a restart command to the endpoint. The agent executes it on next check-in if offline.
Approval	Approve or reject a newly discovered endpoint. Unapproved endpoints do not receive policies.
Reset agent key	Regenerate the agent authentication key. The old key is invalidated immediately.
Assign profile	Assign an agent profile to a single endpoint or bulk-assign to multiple endpoints.
Assign group	Assign the endpoint to an endpoint group. Bulk group assignment is supported.
Device action	Execute a device-level action: isolate, wake-on-LAN, or custom action.
Wake (WoL)	Send a wake-on-LAN packet to bring the endpoint online if it supports WoL.
Tag sync	Add or remove tags on the endpoint. Tags are used as targeting criteria in policies and automations.

Bulk operations

Profile and group assignments support bulk operations. Select multiple endpoints from the fleet table and use the bulk action bar to assign profiles or groups in one request.

Remote Operations#

The platform supports live remote operations on connected endpoints. All remote sessions are deliberate, visible, recorded, and attributed to the operator.

Operation	Description
Remote desktop	Start a full remote desktop session. Opens in a separate window with live screen streaming.
File browser	Browse the endpoint filesystem remotely. Start/stop a file browser session on demand.
Registry explorer	Browse the Windows registry remotely (Windows endpoints only). Start/stop on demand.
Upload session	Upload files to the endpoint during a remote session.
Remote session recordings	All remote desktop sessions are recorded. View and manage recordings from the Remote Sessions page.

Remote session recordings screen — Remote session recordings with endpoint, initiator, duration, and recorded-at timestamp.

Session visibility

The endpoint user can see when a remote session is active. Sessions are never silent. This is a deliberate design choice for trust and compliance.

Baseline & Drift Detection#

A baseline is a saved snapshot of the endpoint configuration - registry settings, firewall rules, service states, password policies. Once a baseline is created, the platform continuously compares the current state against it and flags drift.

Create a baseline from the endpoint detail page to capture the current known-good configuration.
Verify drift to compare the current state against the baseline and list deviations.
Delete an outdated baseline when the endpoint role has changed and the old reference no longer applies.
Drift events feed into Policy Enforcements compliance scoring and the Security Posture report.

Module Areas#

The module contains eight working areas:

Area	What you can do
Fleet overview	Endpoint counts, status distribution, and the devices that need attention.
Endpoint inventory	Hardware, operating system, software, network, and health detail per endpoint.
Users & groups	Device users and the groups used as targets in policies and automations.
Agent profiles	Security, visibility, and agent behaviour standardised by profile.
Patch and software management	Available updates, installation runs, and update automation rules.
Monitoring and telemetry	CPU, memory, disk, network, process, and file-integrity signals per endpoint.
Agent deployment	Organisation-specific agent packages for Windows, macOS, and Linux.
Remote operations and scripts	Restarts, script execution, software actions, and remote sessions.

The Fleet Overview page is organised as nine tabs, each rendering a different dashboard:

Tab	Route	Content
Fleet Overview	/em	Online/offline/maintenance counts, patch compliance, agent health
Assets	/em/assets	Hardware inventory, manufacturer/CPU/RAM distribution, driver updates
Security & Posture	/reports/security	CVE tracking, policy drift, certificate expirations
Vulnerabilities	/em/vulnerabilities	CVE threat matrix, severity distribution, exposure telemetry
Compliance	/reports/compliance	ISO 27001 / SOC 2 aligned compliance scoring
Hardware Health	/em/hardware	Predictive failure diagnostics (CPU/RAM/disk/battery/crashes)
Software & Apps	/em/software	Shadow IT/AI detection, app crashes, browser extensions
Network & Sockets	/em/network	Rogue device detection, DNS anomalies, open ports, ISP distribution
Activity Logs	/em/activity	Login activity, shell commands, remote sessions, process anomalies
Digital Experience	/em/dex	DEX score, boot latency, SaaS connectivity, self-healing

Hardware and asset intelligence screen — Assets tab: hardware inventory, manufacturer distribution, driver updates, and component health.

Vulnerability intelligence screen — Vulnerabilities tab: CVE threat matrix, severity distribution, and exposure telemetry.

Hardware and resource health screen — Hardware Health tab: predictive failure diagnostics for CPU, RAM, disk, battery, and crashes.

Software and application ecosystem screen — Software & Apps tab: Shadow IT/AI detection, app crashes, and browser extensions.

Network and socket connectivity screen — Network & Sockets tab: rogue device detection, DNS anomalies, open ports, and ISP distribution.

Endpoint activity telemetry screen — Activity Logs tab: login activity heatmap, shell commands, remote sessions, and process anomalies.

Digital employee experience screen — Digital Experience tab: DEX score, boot latency, SaaS connectivity, and self-healing resolutions.

Patch Management overview screen — Patch status, critical patches, deployment policies, and execution summary.

Automations#

Automations are triggered by schedules, device events, or manual execution. Each automation has a pipeline of actions that run sequentially. The pipeline editor works in edit mode: all changes are local until you press Done, which saves the entire pipeline in one transaction.

Agent actions are sent via NATS and the agent reports back with success or failure status. If the agent is offline or NATS is unreachable, the action run fails immediately. If no response arrives within 10 minutes, the run is marked as failed by the scheduled command checker.

Action type	Description
run_script	Execute a script from the script library on the target endpoint(s).
install_software	Install a software package on the target endpoint(s).
uninstall_software	Remove a software package from the target endpoint(s).
restart_device	Restart the target endpoint.
shutdown_device	Shut down the target endpoint.
send_notification	Send a notification to the endpoint user.
http_request	Make an outbound HTTP request from the platform.
set_custom_field	Set a custom field value on the endpoint (local action).
apply_tag / remove_tag	Add or remove a tag on the endpoint (local action).
delay	Wait for a specified duration before continuing the pipeline.
wait_approval	Pause the pipeline until a human approves the next step.

Pipeline edit mode

In edit mode: action drag & drop reorder, toggle on/off, add/edit/delete actions are all local until Done. Triggers can be toggled in view mode for quick operations. Variables can be stored per automation for parameterised scripts.

Monitoring & Alerts#

Monitor policies watch endpoint resources, disks, event logs, and uptime. Each policy has monitors (the conditions to check), targets (which endpoints to watch), and recipients (who gets notified). Alerts can also trigger remediation automations.

Monitor policies screen — Monitor policies with monitors, devices, active alerts, and status.

Create a monitor policy and add monitors for CPU, memory, disk, event logs, or uptime.
Sync targets to select which endpoints, groups, profiles, or tags the policy applies to.
Add recipients to define who receives alert notifications.
Toggle individual monitors on/off without editing the whole policy.
Resolve alerts from the policy page when the condition has been addressed.

Policy Enforcements#

Policy enforcements monitor and verify native system policies across all enrolled endpoints: firewall state, antivirus protection, USB device control, password constraints, account lockout, and legal notice banners.

Policy	Type	Description
Enforce Endpoint Firewall	Firewall Management	Enforces native OS firewall state on all assigned endpoints.
Enforce Windows Defender / Antivirus	Antivirus & Protection	Enforces real-time malware protection on all assigned endpoints.
Block USB Mass Storage Devices	Device Control	Prevents unauthorized removable storage devices on endpoints.
Minimum Password Length Policy	Local Security Policy	Restricts local system account minimum password lengths.
Account Lockout Threshold	Local Security Policy	Locks host login after multiple invalid authentication attempts.
Corporate Legal Notice Logon Banner	Local Security Policy	Displays customizable security banner on local user login screens.

Each policy shows a compliance rate, assigned host count, and baseline status (Enforced or Drifted). The Verify action triggers an immediate compliance check against the endpoint.

Scripts#

The script library holds reusable scripts for automations, monitors, and ad-hoc device runs. Scripts are organised into groups (Get Started, Maintenance, Network, Security) and support filtering by language and OS.

Script	Language	Description
macOS - Uninstall Action1 Agent	Shell	Removes the Action1 agent (migration).
macOS - Uninstall Level.io Agent	Shell	Removes the Level.io agent (migration).
Linux / macOS / Windows - Erase Device	Shell / PowerShell	DESTRUCTIVE: remote device wipe for compromised, lost, or stolen devices.
Linux / macOS / Windows - Gather Intel	Shell / PowerShell	Collects OS details, IP configuration, wireless networks, and ARP table.
macOS / Windows / Linux - Cleanup Disk Space	Shell / PowerShell	Cleans temporary files, logs, caches. Reports total space saved.
Check Firewall Status	Shell	Verifies firewall on Linux (ufw/firewalld/iptables) and macOS (socketfilterfw/PF).
Clear DNS Cache	Shell	Flushes the DNS resolver cache on Linux or macOS.
Check Open Ports	Shell	Lists all listening TCP/UDP ports and associated processes.
Restart Print Spooler - Windows	PowerShell	Restarts the Windows print spooler service.

Destructive scripts

Erase Device scripts are destructive. They require explicit confirmation and are recorded per endpoint in the audit log. Use only when a device is compromised, lost, or stolen.

Patch Management#

Automated software vulnerability patching, OS update policies, and silent deployment orchestration. The page has four tabs: Patch Overview, Outdated Software, Deployment Policies, and Patch History.

Patch history tab — Patch deployment history with version transitions, timestamps, and completion status.

Patch Overview shows fleet compliance, outdated apps, critical patches, success rate, and total executions.
Outdated Software lists applications with current and latest available versions.
Deployment Policies define which patches are applied automatically and on what schedule.
Patch History logs every deployment with endpoint, version transition, timestamp, and status.
The Software List page (/em/software-list) provides the full fleet inventory with vulnerability tracking.

Software list screen — Fleet software inventory with version, publisher, category, and vulnerability status.

Agent Deployment#

The Sensor Deployment Gateway provides pre-compiled, organisation-configured agent binaries for Windows, macOS, and Linux. Connection parameters and the Gateway Setup Key are embedded directly into the binaries - no extra command-line keys needed during deployment.

Windows: MSI package for silent enterprise deployments (msiexec /i moftgate-agent.msi /qn) or raw EXE for manual startup.
macOS: PKG package installer for enterprise deployment.
Linux: Raw binary for package managers or shell scripts.
PowerShell retrieval scripts are copy-paste ready for each platform.
The Gateway Setup Key links newly installed sensors to database entities during first sync check-in.
Heartbeat telemetry sync runs at 30-second cycles: endpoints push log parameters and retrieve updated policies.

Offline queue monitor screen — Agent sync status with pending uploads, queue size, and last reported time per endpoint.

Operations#

1
Find the endpoint
Use the fleet view search, status, or group filters to locate the device. Every list supports server-side search, sorting, and filtering.
2
Review the details
Check inventory, the last signed-in user, agent health, and the last-seen time before you act.
3
Apply a controlled action
Apply a profile, install an update, run a script, or start a remote session from the endpoint detail page.
4
Verify the result
Confirm the new state in the endpoint detail or in the activity log. Bulk actions are recorded per endpoint.

Before bulk actions

Verify the target scope and the selected endpoint list before you run a bulk action. Target selection always uses groups, profiles, tags, or individual endpoints.

Offline endpoints

An endpoint that cannot reach the server stores its telemetry locally (up to 3 days or 1 GB) and sends it gradually when the connection returns - without flooding the network. Check the last-seen time before you assume a device is offline permanently.

Frequently Asked Questions#

How is a new endpoint added?

Download the correct agent package from Agent Deployment and follow the installation instructions for that operating system. The endpoint appears in the fleet as soon as the agent completes its first check-in. Newly discovered endpoints can be auto-approved if the setting is enabled in System Settings.

When does a profile change apply?

The endpoint receives the updated profile during its next connection and policy exchange (30-second heartbeat cycle). No restart is required for policy changes.

What can I do for an endpoint that is not connected?

Check the last-seen time and agent health in the endpoint detail. Queued actions run when the endpoint reconnects, unless the action has a time limit. The agent stores telemetry locally for up to 3 days (or 1 GB) and delivers it gradually when the connection returns.

What is the difference between baseline and drift?

A baseline is a saved snapshot of the endpoint configuration. Drift detection compares the current state against the baseline and flags deviations. You can create a baseline, verify drift, and delete an outdated baseline from the endpoint detail page.

How do automations work?

An automation has triggers (schedule, device event, or manual) and a pipeline of actions. In edit mode, all changes are local until you press Done, which saves the entire pipeline in one transaction. Agent actions (run_script, install_software, etc.) are sent via NATS and the agent reports back with success/failure status.

Are remote sessions recorded?

Yes. All remote desktop sessions are recorded and attributed to the operator. The user can see that support is connected. Recordings are managed from the Remote Sessions page.