Skip Navigation
  1. BlackBerry Docs
  2. Cylance Endpoint Security
  3. Cylance Endpoint Security
  4. Cylance Endpoint Security Administration Guide
  5. Managing users, devices, and groups
  6. Manage CylancePROTECT Desktop and CylanceOPTICS devices

Manage
CylancePROTECT Desktop
 and
CylanceOPTICS
 devices

You can use the management console to view and manage devices with the
CylancePROTECT Desktop
 agent and the
CylanceOPTICS
 agent from the Assets > Devices screen. Devices appear on this screen if they have successfully installed the agent and therefore registered with the management console. You can search for devices, export a device report, and perform actions on them.  For example, you might want to export a list of devices that are running unsupported agents. Or, you can quickly add devices to another zone to ensure they are assigned an appropriate device policy according to their zone.
The following section describes the new device grid view on the Devices screen. The Devices screen offers a query-based search experience for greater flexibility to find the devices that you want, save and load queries, as well as the ability to adjust the density of information and pin columns for improved legibility.
Saved queries are used for constructing zone rules. You can load a saved query and verify the list of devices in the results before using it for zone rules. For more information, see Setting up zones to manage
CylancePROTECT Desktop
 and
CylanceOPTICS
 devices in the Setup content.
If you are in legacy view, click
Switch to new view
 on the top right of the screen to switch to the new device grid view.
  1. In the management console, on the menu bar, click
    Assets > Devices
    .
    A list of all devices is displayed.
  2. Optionally, customize the columns displayed in the device grid.
    • To add or remove columns, click The gear icon and select the columns that you want displayed. You can also use the slider to adjust the density of information displayed on the grid and click The Pin icon to pin columns.
    • To rearrange the order of the columns, drag the column names to the position that you want.
    • To sort by ascending or descending order, click the name of a column.
  3. To filter the list of devices, do any of the following:
    Task
    Steps
    Simple search for devices
    Enter any text in the empty search bar without specifying a column to perform a simple search. The simple search method quickly filters the results from the Device Name, DNS Name, IP Address, MAC Address, and Last Reported User columns. Saved searches marked with an asterisk indicate that the saved entry may be applied as a zone rule.
    The simple search uses the
    Text
     field but it cannot be used to filter results in combination with other fields. If you want to perform a search on other fields, perform an advanced search instead.
    Advanced search for devices
    1. Click on the search bar.
      A list of filterable fields appear. If you saved or recently performed a search, your saved and recent searches appear at the top of the list.
    2. Select a field that you want to filter.
    3. Select a comparison operator (for example,
      ~ = < :=
      ).
    4. Type a parameter value for the field that you are filtering. You can separate multiple parameters with a comma (for example,
      Platform ~ macOS, Windows
       or
      "IP Addresses" = 192.168.1.100, 192.168.1.101, 192.168.1.102
      ).
      For parameter values containing a string of multiple words, wrap the string with quotation marks (for example,
      "Windows 11"
      ).
      If you want to search for a range of IP addresses, enter two IP addresses to search between. If you want to add multiple ranges, click Add icon to add another IP address range.
    5. If you want to add another expression, add a Boolean operator (
      and or
      ) at the end of the query. Currently, when you select a Boolean operator, the subsequent Boolean operators in the query must be the same.
      For example,
      A=B and C=D and E~F
       is supported.
      In another example,
      A=B or C=D or E~F
       is supported.
      But
      A=B and C=D or E~F
       is currently not supported.
    6. Click
      Search
      .
    Save a query
    To save a query, the search bar must have a valid query.
    1. Perform a search to ensure the query is valid and produces the expected results.
    2. Click The Save icon on the search bar.
    3. Type a name for the query.
    4. Click
      Save
      .
    Load a saved or recent query
    You can load a saved query, or a query that you recently performed. Saved and recent queries appear only if the search bar is empty.
    1. Click the empty search bar. You can click The Cancel icon to clear it.
    2. At the top of the list, click a recent (The Recent icon) or saved (The Save icon) query. The query is loaded onto the search bar.
    3. Click
      Search
      .
    Rename a saved query
    1. Click the empty search bar. You can click The Cancel icon to clear it.
    2. At the top of the list, beside a saved query, click The Edit icon.
    3. Type a new name for the query. The query cannot be changed.
    4. Click
      Save
      .
    Delete recent and saved searches
    1. Click the empty search bar.
    2. Move your cursor to the recent search or saved search you want to delete, and click Delete icon.
    3. Click
      Delete
      .
    Export the results to a .csv file
    1. Click The Export icon.
    2. Type a name for the file.
    3. Click
      Export
      .
  4. To perform actions on devices, do any of the following:
    Task
    Steps
    View device details.
    Click a device name.
    Assign a device policy to devices.
    A device can be associated with one device policy only. If you assign a new device policy to a device, it replaces the previous device policy.
    1. Select one or more devices.
    2. Click
      Assign Policy
      .
    3. Click a device policy.
    4. Click
      Save
      .
    Add devices to a zone.
    You can use zones to manage the application of settings and a device policy to multiple devices. For more information about zones, see the Cylance Endpoint Security Setup content.
    1. Select one or more devices.
    2. Click
      Add to Zones
      .
    3. Select one or more zones.
    4. Click
      Save
      .
    Remove devices.
    When you remove a device, you unregister the
    CylancePROTECT Desktop
     agent and the data for that device is removed from the management console. The user receives a notification that the agent is not registered and they need to provide an installation token to register the agent again.
    1. Select one or more devices.
    2. Click
      Remove
      .
    3. Click
      Yes
       to confirm.
    Exclude devices from lifecycle management.
    If you have devices that you don't want to have automatically removed from the console due to inactivity, you can manually exclude these devices from the device lifecycle management. Inactive devices that are included in lifecycle management may be automatically removed.
    1. Select one or more devices.
    2. Click
      Lifecycle Management
      .
    3. Click
      Exclude From Lifecycle Management
       (or
      Include In Lifecycle Management
      ).
    4. Click
      Yes
       to confirm.
    You can configure lifecycle management settings to specify when the state of a device changes from offline to inactive and when inactive devices are removed.
    For more information, see Configure device lifecycle management.
    Reset the inactivity period for devices.
    This feature sets the device state to offline, resets the offline date counter, and sets the offline date to the current date. This does not affect devices that are online.
    1. Select one or more devices.
    2. Click
      Reset inactivity period
      .
    3. Click
      Yes
       to confirm.
    Start a background threat detection scan on a device
    (Legacy view only)
    You can start a background threat detection scan for a device on demand. This feature requires devices to be running
    CylancePROTECT Desktop
     agent version 3.2 or later. When you start a background scan with this option, any scan that is currently in progress on a device is terminated before the new scan is started.
    This feature is currently available in legacy view only.
    1. Select one or more devices.
    2. Click
      Background scan
      .
    3. Click
      Yes
       to confirm.
    The date and time that the most recent background scan completed is logged in the console. If recurring background threat detection is set in the assigned device policy, the next scheduled scan time is recalculated accordingly.
    Note that if background threat detection scans are running on several VM devices that are from the same VM host at the same time, device performance will be impacted due to resource sharing.