Endpoints and servers

RMM-managed endpoints run EDR

Explanation
Definition

Each selected device should report an installed EDR agent.Part of Alignr Baseline (seeded).Applies toDevices reported as managed by an RMM.What the result tells youAgent installation is not agent health or recent reporting. Correlate the same endpoint across sources.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	Medium
Declared autonomy	One click

Population conditionDevice management (device_managed_by) equals "rmm".Expected evidence

EDR installed (edr_agent_installed) equals true.

Required predicates: device_managed_by, edr_agent_installed.

{
  "match": {
    "predicate": "device_managed_by",
    "object": "rmm"
  },
  "expect": [
    {
      "fact": "edr_agent_installed",
      "op": "eq",
      "value": true
    }
  ],
  "severity": "medium",
  "title": "RMM-managed endpoint has no EDR agent",
  "evidence": [
    "device_managed_by",
    "edr_agent_installed"
  ]
}

Managed endpoints check in regularly

Explanation
Definition

Each selected device should have a check-in timestamp within the configured day window.Part of Alignr Baseline (seeded).Applies toDevices reported as managed by an RMM.Default settings

Setting	Default	Allowed range
Must check in within (days)	`2`	1–30

Client overrides can change these values. Check the effective settings when interpreting a result.What the result tells youThe time window includes timestamps before or after now. Investigate unexpected future timestamps.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	Medium
Declared autonomy	Suggest only

Population conditionDevice management (device_managed_by) equals "rmm".Expected evidence

Last management check-in (device_last_checkin) is within this many days of now (past or future): parameter checkin_days.

Required predicates: device_last_checkin, device_managed_by.

{
  "match": {
    "predicate": "device_managed_by",
    "object": "rmm"
  },
  "expect": [
    {
      "fact": "device_last_checkin",
      "op": "within_days",
      "value": {
        "param": "checkin_days"
      }
    }
  ],
  "severity": "medium",
  "title": "Managed endpoint has not checked in recently",
  "evidence": [
    "device_managed_by",
    "device_last_checkin"
  ]
}

Managed endpoints are patch-compliant

Explanation
Definition

Each selected device should report a compliant patch status.Part of Alignr Baseline (seeded).Applies toDevices reported as managed by an RMM.What the result tells youThe expected state is the exact string compliant. Review the source’s patch scope; this does not prove absence of every vulnerability.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	Medium
Declared autonomy	Change ticket

Population conditionDevice management (device_managed_by) equals "rmm".Expected evidence

Patch state (patch_status) equals "compliant".

Required predicates: device_managed_by, patch_status.

{
  "match": {
    "predicate": "device_managed_by",
    "object": "rmm"
  },
  "expect": [
    {
      "fact": "patch_status",
      "op": "eq",
      "value": "compliant"
    }
  ],
  "severity": "medium",
  "title": "Managed endpoint is not patch-compliant",
  "evidence": [
    "device_managed_by",
    "patch_status"
  ]
}

MDM-enrolled devices are encrypted

Explanation
Definition

Each selected device should report encryption enabled.Part of Alignr Baseline (seeded).Applies toDevices with an MDM enrolment observation.What the result tells youReported encryption does not establish recovery-key custody or successful recovery.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	High
Declared autonomy	Suggest only

Population conditionMDM enrolment (mdm_enrolled_by) has an observation.Expected evidence

Device encryption (device_encryption_enabled) equals true.

Required predicates: device_encryption_enabled, mdm_enrolled_by.

{
  "match": {
    "predicate": "mdm_enrolled_by"
  },
  "expect": [
    {
      "fact": "device_encryption_enabled",
      "op": "eq",
      "value": true
    }
  ],
  "severity": "high",
  "title": "MDM-enrolled device is not encrypted",
  "evidence": [
    "mdm_enrolled_by",
    "device_encryption_enabled"
  ]
}

MDM-enrolled devices are compliant

Explanation
Definition

Each selected device should report a compliant MDM state.Part of Alignr Baseline (seeded).Applies toDevices with an MDM enrolment observation.What the result tells youCompliant means compliant with the MDM source’s configured policies, not every Alignr expectation.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	High
Declared autonomy	Suggest only

Population conditionMDM enrolment (mdm_enrolled_by) has an observation.Expected evidence

MDM compliance state (device_compliance_state) equals "compliant".

Required predicates: device_compliance_state, mdm_enrolled_by.

{
  "match": {
    "predicate": "mdm_enrolled_by"
  },
  "expect": [
    {
      "fact": "device_compliance_state",
      "op": "eq",
      "value": "compliant"
    }
  ],
  "severity": "high",
  "title": "MDM-enrolled device is not compliant",
  "evidence": [
    "mdm_enrolled_by",
    "device_compliance_state"
  ]
}

Managed devices check in

Explanation
Definition

Each selected device should have a check-in timestamp within the configured day window.Part of BIOS Endpoint and Server Health.Applies toDevices reported as managed by an RMM.Default settings

Setting	Default	Allowed range
Check-in window (days)	`2`	1–30

Setting	Value
Standard	BIOS Endpoint and Server Health
Severity	Medium
Declared autonomy	Suggest only

Population conditionDevice management (device_managed_by) equals "rmm".Expected evidence

Last management check-in (device_last_checkin) is within this many days of now (past or future): parameter days.

Required predicates: device_last_checkin, device_managed_by.

{
  "match": {
    "predicate": "device_managed_by",
    "object": "rmm"
  },
  "expect": [
    {
      "fact": "device_last_checkin",
      "op": "within_days",
      "value": {
        "param": "days"
      }
    }
  ],
  "severity": "medium",
  "title": "Managed device has not checked in",
  "evidence": [
    "device_managed_by",
    "device_last_checkin"
  ]
}

Managed devices are patch compliant

Explanation
Definition

Each selected device should report a compliant patch status.Part of BIOS Endpoint and Server Health.Applies toDevices reported as managed by an RMM.What the result tells youThe expected state is the exact string compliant. Review the source’s patch scope; this does not prove absence of every vulnerability.

Setting	Value
Standard	BIOS Endpoint and Server Health
Severity	High
Declared autonomy	Suggest only

Population conditionDevice management (device_managed_by) equals "rmm".Expected evidence

Patch state (patch_status) equals "compliant".

Required predicates: device_managed_by, patch_status.

{
  "match": {
    "predicate": "device_managed_by",
    "object": "rmm"
  },
  "expect": [
    {
      "fact": "patch_status",
      "op": "eq",
      "value": "compliant"
    }
  ],
  "severity": "high",
  "title": "Managed device is not patch compliant",
  "evidence": [
    "device_managed_by",
    "patch_status"
  ]
}

Managed endpoints run EDR

Explanation
Definition

Each selected device should report an installed EDR agent.Part of BIOS Endpoint and Server Health.Applies toDevices reported as managed by an RMM.What the result tells youAgent installation is not agent health or recent reporting. Correlate the same endpoint across sources.

Setting	Value
Standard	BIOS Endpoint and Server Health
Severity	High
Declared autonomy	Suggest only

Population conditionDevice management (device_managed_by) equals "rmm".Expected evidence

EDR installed (edr_agent_installed) equals true.

Required predicates: device_managed_by, edr_agent_installed.

{
  "match": {
    "predicate": "device_managed_by",
    "object": "rmm"
  },
  "expect": [
    {
      "fact": "edr_agent_installed",
      "op": "eq",
      "value": true
    }
  ],
  "severity": "high",
  "title": "Managed endpoint lacks EDR",
  "evidence": [
    "device_managed_by",
    "edr_agent_installed"
  ]
}

MDM devices are encrypted

Explanation
Definition

Each selected device should report encryption enabled.Part of BIOS Endpoint and Server Health.Applies toDevices with an MDM enrolment observation.What the result tells youReported encryption does not establish recovery-key custody or successful recovery.

Setting	Value
Standard	BIOS Endpoint and Server Health
Severity	High
Declared autonomy	Suggest only

Population conditionMDM enrolment (mdm_enrolled_by) has an observation.Expected evidence

Device encryption (device_encryption_enabled) equals true.

Required predicates: device_encryption_enabled, mdm_enrolled_by.

{
  "match": {
    "predicate": "mdm_enrolled_by"
  },
  "expect": [
    {
      "fact": "device_encryption_enabled",
      "op": "eq",
      "value": true
    }
  ],
  "severity": "high",
  "title": "MDM device is not encrypted",
  "evidence": [
    "mdm_enrolled_by",
    "device_encryption_enabled"
  ]
}

Review server hardening baseline

Review every 30 days · BIOS Endpoint and Server HealthReview local admin, service accounts, host firewall, secure protocols and approved exceptions using your approved runbook. Connector facts do not currently prove these settings.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Start here

Explore Alignr

Endpoints and servers

Automated controls

Manual checks

Investigate a result

Next steps

​Automated controls

​Manual checks

​Investigate a result

​Next steps

Automated controls

Manual checks

Investigate a result

Next steps