Skip to main content
The Endpoints module is the central inventory of agent-monitored hosts across your infrastructure. An endpoint is a physical server, virtual machine, or workstation running the security monitoring agent, built on Wazuh agent infrastructure.

​
Key concepts

  • Agent-monitored hosts — devices reporting real-time system state, installed software, open ports, running processes, and security posture.
  • Connectivity status — an endpoint is either Connected (active and reporting) or Disconnected (agent unreachable or inactive).
  • OS and version — the agent collects specific distributions and versions, such as Ubuntu 22.04 LTS or Windows Server, rather than a generic OS name.
  • Background synchronization — opening the Endpoints view starts an automatic background sync reconciling database records against live agent telemetry. The server throttles this to run at most once every 15 minutes.

​
The “Syncing…” pill

A Syncing… badge appears next to the Endpoints heading while telemetry and database records reconcile. Because syncs are throttled to once every 15 minutes per tenant, the pill only shows during an active reconciliation cycle. If you reload the page inside that 15-minute window, expect not to see it — that is normal, not a failed sync.
  • Vulnerabilities — manage the security findings identified across your endpoints.
  • Compliance hardening — inspect the Security Configuration Assessment policy benchmarks evaluated on connected endpoints.
  • File integrity monitoring — monitor file system modifications and integrity checks.
  • Infrastructure — manage deployment configurations, cloud integrations, and asset groups.