Introduction

If you are a partner user, you can use the steps below using both the client and partner views. To learn more about client view and your partner view, see our help center article on the organization selector.

Some of our features, specifically Active Response and Agent Protection, are applied at a global level. This means that once these features are enabled and configured, they are applied to every endpoint in your organization. 

While this approach helps ensure that your entire fleet is protected as soon as the feature is enabled, scenarios may arise that require you to disable or modify these features on a specific set of endpoints. This may be an individual endpoint, a small set, or a larger set of devices. 

Example scenarios may include: 

• Agent Protection:
  • You are offboarding legacy equipment and need to uninstall the endpoint the specific device(s). 
• Active Response:
  • You may want to apply an Aggressive response policy to some endpoints, while applying the Balanced response policy the majority (or vice versa).
  • You may want to apply a mixture of the Limited, Balanced, and Aggressive response policies across distinct groups of endpoints.  
• DNS Firewall:
  • You may want to enable/disable Roaming protection for a one, or a set of, endpoint devices(s). 
  • You may want to exclude a set 

Who can perform bulk edits? 

A bulk edit can be initiated by either a member of your organization, or by the Field Effect MDR team. 

As we continually deliver the Field Effect MDR service, scenarios may arise that impact one or more of your endpoint devices. If we confidently detect activity that corelates with a compromised device, we may set the response policy to Aggressive and enable Agent Protection to contain the potential compromise. There may also maintenance-related reasons that Field Effect MDR may bulk edit an endpoint device(s), if it is not operating as intended.

Bulk edits are performed can bulk edit endpoints from Devices page (Cyber Risk section) to accomplish this, and this article walks through the process.

Bulk editing endpoint devices

From the Devices page (Cyber Risk section), click Bulk Edit in the upper right.

Checkboxes will appear in the table, and the Bulk Edit Endpoints pane will expand on the right. Use the check boxes to select the endpoints you want to edit. Once selected, make your configuration changes in the Edit pane and click Submit to confirm. 

Bulk Edit Statuses 

Features that support Bulk Editing (currently Active Response and Agent Protection) leverage visual "pills" that signal whether a feature is being affected by a bulk edit, and whether your organization or Field Effect initiated the edit. 

If the endpoint device is using the default configuration as set by your organization, the column will simply show that configuration in plain text. In the example below, the endpoint device is using the organization's default response policy - Limited. So, there is no pill indicating that the feature is being affected by a bulk edit.

User Edit Statuses

When submitting a bulk edit (see above), the change will take place the next time the endpoint agent refreshes. While waiting for the refresh, a grey pill will be shown, signaling that the change is pending.

In the example below, the user has confirmed a bulk edit changing the device's response policy from Limited to Off. The grey pill signifies that the change is pending, while simultaneously showing the pre and post edit states (Limited -> Off). 

Once the change is made to the endpoint, the following pill will be shown, which signifies that; the change has taken place, the current state of the feature, and that the bulk edit was made by a user within your organization.

In the example below, Active Response was bulk edited on this device and set to the Off response policy. The user icon signifies that the bulk edit was made by a user within your organization. 

Field Effect Edits

If Field Effect MDR has edited an endpoint device(s) that has not been edited by your organization, you will see the default configuration as set by your organization in plain text, alongside a blue pill signifying that Field Effect MDR edited the endpoint device, and the state that Field Effect MDR set the endpoint to. In the example below, Field Effect changed the response policy on the endpoint device from Limited to Off. 

If Field Effect MDR needs to edit a device that has already been edited by your organization, the user edit pill (shown above) will remain visible but inactive (grey), and the Field Effect MDR edit will be visible alongside it. In the example below, the organization edited this endpoint device to use the Off response policy, but a scenario arose where Field Effect MDR needed to increase the response policy to Aggressive.