Understanding offline state

An endpoint is marked offline when the platform has not heard from its agent within the configured offline threshold. The threshold is a service-level setting, and its value is a judgement about noise: set it too tight and laptops that close their lids at lunchtime generate constant state changes; set it too loose and a genuinely dead server sits unnoticed for most of a working day.

Offline is a statement about the connection, not about the machine. An offline endpoint may be powered down, asleep, disconnected, behind a network fault, blocked by a newly deployed firewall rule, or running fine with a stopped agent service. The console cannot distinguish these, because by definition it cannot reach the thing that would tell it.

Triage a list of offline endpoints by looking for shape rather than working through it machine by machine. Several endpoints at one site going offline together is a site problem — connectivity, power, or a network change — and chasing individual machines wastes the hour in which someone could have called the site. Endpoints across many sites going offline together points at something in the middle: a proxy change, a certificate, a DNS change, or something on your side.

A single endpoint offline alone is the genuinely per-machine case. Check its health history first. A machine that flapped repeatedly before disappearing usually has a local fault; a machine that was steadily online and then simply stopped is more often powered off or disconnected.

Be honest with yourself about the long tail. Every estate accumulates endpoints that have been offline for weeks — machines that were decommissioned without anyone resolving the record, or laptops belonging to people who left. They cost nothing operationally but they poison the offline list as a signal. Clear them out periodically so that the list stays short enough to be read rather than skimmed.

Note that AegisOne does not notify anyone when an endpoint goes offline. There is no alerting engine in the product. Offline state is surfaced across the dashboards and available through the API, and monitoring it is a matter of someone looking, or of you polling the API from something that already pages your team.