Managing devices

info

The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.

This page is for administrators. It covers the console side of Takumi Agent: enrollment keys, which ecosystems each device enforces, agent updates, decommissioning a device, diagnostics, and tamper evidence. All of it is under Endpoint in the left navigation.

Everything on this page needs the Owner or Takumi Manager role (see Roles and Permissions).

Enrollment keys

An enrollment key registers a Mac as a device in your organization. Keys are listed under Endpoint → Enrollment Keys. Quickstart shows how to create one. Each key has a label, a maximum number of activations, and an expiry. The key itself is shown only once, when you create it.

Revoke on a key rejects new enrollments with it. Devices already enrolled with the key are unaffected.

The Capabilities toggles in the create dialog, grouped under Guard, limit what devices enrolled with the key get:

• npm install protection
• PyPI install protection
• RubyGems install protection
• Go modules install protection
• Composer install protection

Leaving them all on adds no restriction, so protections added in the future stay allowed too. A toggle marked Org-constrained is off for the whole organization, and turning it on for the key has no effect until the organization turns it on. You can change a key's capabilities later from its panel in the key list. Devices pick up the change without enrolling again.

Which ecosystems a device enforces

A device enforces an ecosystem only when all three of these allow it:

1. The organization. Under Endpoint → Settings → Protections, each protection from the list above has its own switch. Turning one off applies to every enrolled device at its next check-in: that traffic then goes straight to the registry without being checked.
2. The enrollment key the device enrolled with, as described above.
3. A per-device override, if you set one. Open the device, and in its Protection section click Override for this device…, turn a toggle off or on, then confirm with Apply override. The section then shows an Override badge. Clear override removes it.

When a protection is off, the device's Protection section shows which of the three turned it off. The egress lock (the network filter that blocks direct connections to the supported registries) follows the same settings: a device needs it as soon as it enforces at least one ecosystem. A device with ecosystems turned off still counts as protected, and the console shows it as Protected, N off by policy (see Device states).

Updates

The agent updates itself. New releases are downloaded and installed in the background, with no setup window and no new approvals, and reach every device within about an hour of release. No device is ever downgraded.

Decommissioning a device

Decommission a device that is no longer used, for example a returned Mac or one that was uninstalled. Open the device and click Decommission… at the bottom of its detail panel, then type decommission and click Decommission.

The device stops working immediately: its identity and every token issued to it are revoked. This can't be undone. To use the machine again, enroll it again with an enrollment key. The device then shows Revoked (see Device states).

Diagnostics

A user can send diagnostics from the Mac with Send to admin on the app window's Help page. In the console, the device's detail panel has a Diagnostics section listing what the device has sent, newest first, each with a Download button. Diagnostics contain the device's status and recent logs, with tokens and private keys removed.

Tamper evidence

A device can report evidence that its own health reporting was interfered with. The device then shows Not protected until an administrator acknowledges the evidence, and its detail panel gets a Tamper evidence section with what was detected and when it was First observed. Troubleshooting says what to do.

Acknowledging tamper evidence

Acknowledge the evidence once you have checked the Mac:

1. Open the device and click Acknowledge tamper… in Tamper evidence.
2. Enter a reason, for example what you checked on the Mac.
3. Click Continue, check the reason, then Acknowledge.

The evidence clears right away, and the device detail shows who acknowledged it, when and why.

Acknowledging clears the recorded evidence and nothing else. If the device reports tampering again, it turns Not protected again. A device that keeps reporting evidence after being acknowledged really is being tampered with: decommission it and investigate the machine.