Send a notification when a decommissioned endpoint status changes

Issue

Our team would like to inquire about the process of decommissioning endpoints. Is this something that is done automatically or does it have to be a manual effort by someone on the team?

In addition, what is the criteria for Red Canary detecting if a sensor is decommissioned or not? Is this something we can receive more alerts on, and is it something our team should be looking out for?

We want to be alerted if a decommissioned endpoint comes back online so it can be reinstated.

Resolution

Any user with the Admin or Responder role can manually decommission endpoints. See Decommission endpoints.

What if a decommissioned endpoint comes back online?

An Admin or Responder can also reinstate a decommissioned endpoint by going to the endpoint object in Red Canary and clicking Reinstate. As long as the sensor software remains installed, the endpoint can continue sending telemetry to Red Canary. 

For further visibility, you can set up automation to alert your team when a decommissioned endpoint comes back online.

1. In the Automate page, create a new trigger to check when a decommissioned endpoint's status changes to "online."

Note: additional conditions can be added to include/exclude certain endpoints.

2. Create a playbook that executes from the trigger. As an example, this playbook sends an email to specified recipients stating that the endpoint should be reviewed and brought back online if necessary:

​​