Hosts table
The MDR > Monitored Assets > Hosts page lists all endpoints (workstations, servers, and mobile devices) monitored by the MDR service. Each host represents a device on which an EDR agent (CrowdStrike, SentinelOne, or Microsoft Defender) has been deployed.
Hosts table
Each row in the table displays the following information:
Status
Whether the host is Active, Inactive, or Uninstalling. See the Statuses section below for details.
Name
The hostname of the device as reported by the EDR agent.
Platform
The operating system family (e.g. Windows, macOS, Linux).
OS Version
The specific version of the operating system running on the device.
Last Seen
The date the EDR agent last reported activity to the provider.
First Seen
The date the EDR agent was first detected on the device.
Type
The device category as reported by the EDR provider, such as Workstation, Server, Domain Controller, or Mobile.
The email address associated with the device, if available.
Username
The last user who logged into the device, if available.
You can search for a specific host by name using the search bar at the top of the table. You can also filter hosts by status, platform, OS version, and type using the filter options.
Statuses
The status of a host reflects the state of the EDR agent on the device. It is determined by combining the agent's activity status from the EDR provider with any pending actions initiated from Stoik Protect.
Active
The EDR agent is online and reporting normally. The device is actively monitored.
Uninstalling
An uninstallation has been triggered from Stoik Protect. The agent is in the process of being removed. For CrowdStrike, this status is set as soon as the uninstallation process is confirmed, even if the actual removal has not yet completed on the device.
Inactive
The EDR agent has been removed or has not reported activity for 30+ days. Inactive hosts are no longer actively monitored.
Exporting host data
You can export the full list of monitored hosts as a file. The export includes all columns except Status: name, platform, OS version, first seen, last seen, type, email, and username.
Uninstalling an EDR agent
For hosts with an Active status, you can trigger an uninstallation directly from the Hosts table using the action button on the right side of the row. This feature is available for CrowdStrike and SentinelOne endpoints. For more details, see How to uninstall an EDR host?.
Last updated
Was this helpful?