Get started Rolling out
Rolling out
Roll Oxelone out in three stages: pilot, monitor, enable. Each stage changes one thing, so if something looks wrong you know where to look.
| Stage | What you do | What it changes on a machine |
|---|---|---|
| Pilot | Enroll a few machines with an enrollment profile | The agent is installed and reports in |
| Monitor | Set your policies to Monitor | Nothing is stopped or altered. Hits are recorded |
| Enable | Set the policies you trust to Enabled | The policies take their actions |
1. Pilot
Start with a handful of machines you can reach: your own team's, or a group that uses AI tools heavily.
Choose what to capture
Every machine enrolls through an enrollment profile. The profile fixes the machine's capture strategies for its whole life, so choose it before you install anything. Choose Enroll machines on Inventory › Machines, then pick or create a profile. A new profile opens on Configure with four starting points:
| Starting point | What it runs |
|---|---|
| Full visibility (marked Recommended) | CLI & IDE tools, Network steering, TLS interception and Filesystem scan |
| Without interception | CLI & IDE tools and Network steering |
| Browser only | The browser extension and nothing else |
| Custom | Nothing until you choose the strategies yourself |
Nothing is preselected. You choose.
TLS interception and the browser extension cannot be enrolled together. Both read browser content, and the server refuses the pair. No starting point includes both.
Capture strategies says what each one sees and what it cannot see. What each strategy alters lists every change the agent makes on a machine, which is what a change-control board will ask you for.
Enroll the pilot machines
Choose One machine for each pilot computer, or Many machines (MDM) if you push the agent with an MDM tool. Deployment covers the command and Enrolling many machines covers the reusable secret.
Check that they reported in
A new machine is Installing until its first heartbeat, then Active. If no heartbeat arrives within 15 minutes it is Stuck. See Troubleshooting.
If the profile includes TLS interception, a machine reads Degraded until it trusts the interception certificate.
Tools that were already open pick up their hooks the next time they start.
2. Monitor
A new policy starts disabled, on no machine. Move it to Monitor first.
A policy in Monitor:
- records every hit;
- raises its alerts and opens its issues, because those are reports, not responses;
- stops and changes nothing. There is no block, redaction, question to the person, notice at the machine, fix, or action on a connected platform.
That makes Monitor the only way to see what a policy would do on real traffic. Simulate in the policy editor tests a policy against input you supply, and does not use real traffic.
Machines pick up a change of state on their next heartbeat.
Leave a policy in Monitor long enough to see a normal working pattern, then read what it caught:
- Detections › Alerts and Detections › Issues for what it raised;
- Governance › Runs for each decision it made.
Ask whether you would have wanted each hit stopped. If a policy catches too much, narrow its filter. If it catches too little, widen it. Then look again.
3. Enable
When a policy reads the way you want, set it to Enabled. Setting this
state needs the policies:publish permission.
Do it a policy at a time, and on a narrow set of machines first. A policy's Applies to picks the machines it runs on: every machine, only the machines of some enrollment profiles, or every machine except those.
A group of policies has one On / Off switch. Turning a group Off greys its policies out and keeps each one's own state, and turning it back On restores them.
If you need to stop policies acting quickly, see Halting enforcement.
4. Widen the pilot
Enroll the rest of your fleet with the same profile, or with others for other groups. Each profile has an Updates tab for moving its machines to the default agent build.
When you add a new kind of policy, repeat stage 2 for it. Monitor is the stage you go back to whenever a rule is new.