> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alignr.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Endpoints and servers
> Device reporting, patching, EDR, encryption and server hardening.
This category contains **9 automated control definitions** and **1 manual check** across the sources named below. Similar controls from different standards are listed separately because names, thresholds or severity can differ.
Whether the seeded Alignr Baseline is available depends on how your workspace was provisioned. Library templates are copied as disabled drafts. See [Choose a baseline](/controls/baselines/overview) before enabling anything.
## Automated controls
Expand a control to see the exact population, expectation and defaults. A pass requires usable evidence for the selected population. A known contrary observation can prove failure; missing observations or an empty population must not become a pass.
Each selected device should report an installed EDR agent.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Devices reported as managed by an RMM.
**What the result tells you**
Agent installation is not agent health or recent reporting. Correlate the same endpoint across sources.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | Medium |
| Declared autonomy | One click |
**Population condition**
**Device management** (`device_managed_by`) equals `"rmm"`.
**Expected evidence**
* **EDR installed** (`edr_agent_installed`) equals `true`.
**Required predicates:** `device_managed_by`, `edr_agent_installed`.
```json theme={null}
{
"match": {
"predicate": "device_managed_by",
"object": "rmm"
},
"expect": [
{
"fact": "edr_agent_installed",
"op": "eq",
"value": true
}
],
"severity": "medium",
"title": "RMM-managed endpoint has no EDR agent",
"evidence": [
"device_managed_by",
"edr_agent_installed"
]
}
```
Each selected device should have a check-in timestamp within the configured day window.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Devices reported as managed by an RMM.
**Default settings**
| Setting | Default | Allowed range |
| --------------------------- | ------- | ------------- |
| Must check in within (days) | `2` | 1–30 |
Client overrides can change these values. [Check the effective settings](/controls/parameters) when interpreting a result.
**What the result tells you**
The time window includes timestamps before or after now. Investigate unexpected future timestamps.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | Medium |
| Declared autonomy | Suggest only |
**Population condition**
**Device management** (`device_managed_by`) equals `"rmm"`.
**Expected evidence**
* **Last management check-in** (`device_last_checkin`) is within this many days of now (past or future): parameter `checkin_days`.
**Required predicates:** `device_last_checkin`, `device_managed_by`.
```json theme={null}
{
"match": {
"predicate": "device_managed_by",
"object": "rmm"
},
"expect": [
{
"fact": "device_last_checkin",
"op": "within_days",
"value": {
"param": "checkin_days"
}
}
],
"severity": "medium",
"title": "Managed endpoint has not checked in recently",
"evidence": [
"device_managed_by",
"device_last_checkin"
]
}
```
Each selected device should report a compliant patch status.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Devices reported as managed by an RMM.
**What the result tells you**
The expected state is the exact string compliant. Review the source’s patch scope; this does not prove absence of every vulnerability.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | Medium |
| Declared autonomy | Change ticket |
**Population condition**
**Device management** (`device_managed_by`) equals `"rmm"`.
**Expected evidence**
* **Patch state** (`patch_status`) equals `"compliant"`.
**Required predicates:** `device_managed_by`, `patch_status`.
```json theme={null}
{
"match": {
"predicate": "device_managed_by",
"object": "rmm"
},
"expect": [
{
"fact": "patch_status",
"op": "eq",
"value": "compliant"
}
],
"severity": "medium",
"title": "Managed endpoint is not patch-compliant",
"evidence": [
"device_managed_by",
"patch_status"
]
}
```
Each selected device should report encryption enabled.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Devices with an MDM enrolment observation.
**What the result tells you**
Reported encryption does not establish recovery-key custody or successful recovery.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | High |
| Declared autonomy | Suggest only |
**Population condition**
**MDM enrolment** (`mdm_enrolled_by`) has an observation.
**Expected evidence**
* **Device encryption** (`device_encryption_enabled`) equals `true`.
**Required predicates:** `device_encryption_enabled`, `mdm_enrolled_by`.
```json theme={null}
{
"match": {
"predicate": "mdm_enrolled_by"
},
"expect": [
{
"fact": "device_encryption_enabled",
"op": "eq",
"value": true
}
],
"severity": "high",
"title": "MDM-enrolled device is not encrypted",
"evidence": [
"mdm_enrolled_by",
"device_encryption_enabled"
]
}
```
Each selected device should report a compliant MDM state.
Part of **Alignr Baseline (seeded)**.
**Applies to**
Devices with an MDM enrolment observation.
**What the result tells you**
Compliant means compliant with the MDM source’s configured policies, not every Alignr expectation.
| Setting | Value |
| ----------------- | ------------------------ |
| Standard | Alignr Baseline (seeded) |
| Severity | High |
| Declared autonomy | Suggest only |
**Population condition**
**MDM enrolment** (`mdm_enrolled_by`) has an observation.
**Expected evidence**
* **MDM compliance state** (`device_compliance_state`) equals `"compliant"`.
**Required predicates:** `device_compliance_state`, `mdm_enrolled_by`.
```json theme={null}
{
"match": {
"predicate": "mdm_enrolled_by"
},
"expect": [
{
"fact": "device_compliance_state",
"op": "eq",
"value": "compliant"
}
],
"severity": "high",
"title": "MDM-enrolled device is not compliant",
"evidence": [
"mdm_enrolled_by",
"device_compliance_state"
]
}
```
Each selected device should have a check-in timestamp within the configured day window.
Part of **BIOS Endpoint and Server Health**.
**Applies to**
Devices reported as managed by an RMM.
**Default settings**
| Setting | Default | Allowed range |
| ---------------------- | ------- | ------------- |
| Check-in window (days) | `2` | 1–30 |
Client overrides can change these values. [Check the effective settings](/controls/parameters) when interpreting a result.
**What the result tells you**
The time window includes timestamps before or after now. Investigate unexpected future timestamps.
| Setting | Value |
| ----------------- | ------------------------------- |
| Standard | BIOS Endpoint and Server Health |
| Severity | Medium |
| Declared autonomy | Suggest only |
**Population condition**
**Device management** (`device_managed_by`) equals `"rmm"`.
**Expected evidence**
* **Last management check-in** (`device_last_checkin`) is within this many days of now (past or future): parameter `days`.
**Required predicates:** `device_last_checkin`, `device_managed_by`.
```json theme={null}
{
"match": {
"predicate": "device_managed_by",
"object": "rmm"
},
"expect": [
{
"fact": "device_last_checkin",
"op": "within_days",
"value": {
"param": "days"
}
}
],
"severity": "medium",
"title": "Managed device has not checked in",
"evidence": [
"device_managed_by",
"device_last_checkin"
]
}
```
Each selected device should report a compliant patch status.
Part of **BIOS Endpoint and Server Health**.
**Applies to**
Devices reported as managed by an RMM.
**What the result tells you**
The expected state is the exact string compliant. Review the source’s patch scope; this does not prove absence of every vulnerability.
| Setting | Value |
| ----------------- | ------------------------------- |
| Standard | BIOS Endpoint and Server Health |
| Severity | High |
| Declared autonomy | Suggest only |
**Population condition**
**Device management** (`device_managed_by`) equals `"rmm"`.
**Expected evidence**
* **Patch state** (`patch_status`) equals `"compliant"`.
**Required predicates:** `device_managed_by`, `patch_status`.
```json theme={null}
{
"match": {
"predicate": "device_managed_by",
"object": "rmm"
},
"expect": [
{
"fact": "patch_status",
"op": "eq",
"value": "compliant"
}
],
"severity": "high",
"title": "Managed device is not patch compliant",
"evidence": [
"device_managed_by",
"patch_status"
]
}
```
Each selected device should report an installed EDR agent.
Part of **BIOS Endpoint and Server Health**.
**Applies to**
Devices reported as managed by an RMM.
**What the result tells you**
Agent installation is not agent health or recent reporting. Correlate the same endpoint across sources.
| Setting | Value |
| ----------------- | ------------------------------- |
| Standard | BIOS Endpoint and Server Health |
| Severity | High |
| Declared autonomy | Suggest only |
**Population condition**
**Device management** (`device_managed_by`) equals `"rmm"`.
**Expected evidence**
* **EDR installed** (`edr_agent_installed`) equals `true`.
**Required predicates:** `device_managed_by`, `edr_agent_installed`.
```json theme={null}
{
"match": {
"predicate": "device_managed_by",
"object": "rmm"
},
"expect": [
{
"fact": "edr_agent_installed",
"op": "eq",
"value": true
}
],
"severity": "high",
"title": "Managed endpoint lacks EDR",
"evidence": [
"device_managed_by",
"edr_agent_installed"
]
}
```
Each selected device should report encryption enabled.
Part of **BIOS Endpoint and Server Health**.
**Applies to**
Devices with an MDM enrolment observation.
**What the result tells you**
Reported encryption does not establish recovery-key custody or successful recovery.
| Setting | Value |
| ----------------- | ------------------------------- |
| Standard | BIOS Endpoint and Server Health |
| Severity | High |
| Declared autonomy | Suggest only |
**Population condition**
**MDM enrolment** (`mdm_enrolled_by`) has an observation.
**Expected evidence**
* **Device encryption** (`device_encryption_enabled`) equals `true`.
**Required predicates:** `device_encryption_enabled`, `mdm_enrolled_by`.
```json theme={null}
{
"match": {
"predicate": "mdm_enrolled_by"
},
"expect": [
{
"fact": "device_encryption_enabled",
"op": "eq",
"value": true
}
],
"severity": "high",
"title": "MDM device is not encrypted",
"evidence": [
"mdm_enrolled_by",
"device_encryption_enabled"
]
}
```
## Manual checks
These are human reviews, not automated evidence. The interval below is the template default; review ownership, evidence and suitability for the client.
**Review every 30 days** · BIOS Endpoint and Server Health
Review local admin, service accounts, host firewall, secure protocols and approved exceptions using your approved runbook. Connector facts do not currently prove these settings.
**Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
## Investigate a result
Confirm the client and the account, device or other item being assessed. Check the source, observation time and effective settings, then compare the recorded evidence with the expectation. Missing evidence needs investigation; a change to the environment requires a separate review.
## Next steps
[Create a custom control](/controls/create-custom) · [Parameters and client overrides](/controls/parameters) · [Record a manual check](/controls/manual-checks)