Each background maintenance sweep's last successful run and any recent error. A sweep that silently stops running or starts failing shows up here instead of quietly taking a feature down with it.

Silence isn't clearance: a green dashboard proves the monitoring found nothing, not that it would. This verifies every alertable event type routes to at least one channel that reaches a human, and flags the silent gaps — an alert kind you've muted on every channel, sandbox mode left on, or a recover event that can never close its alert. Documentation

When a new device enrols, the first matching rule stamps its group / site / tags automatically — by hostname (regex) or source-IP range (CIDR). Enrolment-token defaults always win: a rule only fills a group left empty and merges extra tags. Rules never touch already-enrolled devices.

A named bundle of per-device settings — poll interval, watched systemd units, log watches, drift-watched files, metric thresholds. Applying a profile stamps those fields onto the devices you pick; it's a one-shot copy, so each device stays individually editable afterwards.

A saved fleet query whose membership is re-evaluated every ~60s. Use it as a targeting scope — reference it as smart:<name> in alert-routing, auto-patch, report and service-baseline scopes. It doesn't change a device's real group.

Model your racks and place assets in them (set rack, bottom U and height on an asset in the CMDB). Overlapping units are flagged. Front elevation view. Documentation

Define subnets; occupancy is derived from known device addresses (device IP + CMDB interfaces incl. NAT) plus static reservations. A duplicate IP across two devices raises an ip_conflict alert. Documentation

Flag hosts whose pending updates have gone unpatched too long. Set a maximum age (days) for security and/or all updates, scoped to a group, tag, or the whole fleet — first matching rule wins. Breaches raise a patch_sla_violation alert. Reporting only; nothing is auto-installed.

Vulnerabilities found in the images of running containers, grouped by image across the fleet. Enable per-fleet in Settings → Security (needs trivy on the hosts). Trivy re-scans every ~24h; Scan now triggers it on the next heartbeat.

Group CVEs into an owned, deadlined effort and track the affected-host burn-down. Scope by severity/KEV or an explicit CVE list. A campaign completes (and fires campaign_completed) when zero hosts remain affected. Burn-down is sampled daily.

A baseline watches a default set of systemd units across every device its scope covers — merged with each host's own list, so you don't edit each host. Also reachable from a device's Configure watched services → Edit baselines.

A rule matches a class of lines, so one routine message re-fires forever. Clearing a line stops it counting toward the rule's threshold — a genuinely different message still alerts. Un-clear one to hear about it again. Documentation

Attach a KB article to an alert type. When an alert of that type fires, operators see a one-click Runbook link on it in the Alerts inbox — straight to your response procedure.

Edges inferred from actual outbound connections between your devices (private IPs only). Accept adds a real depends_on link (used for downstream alert suppression); dismiss hides it.

Verifies each declared depends_on edge against observed traffic (agent peer-conns and the NetFlow/IPFIX receiver). A Broken edge carried traffic before and went silent while both hosts stayed online — a firewall/route/service break the offline alert never catches. Enable alerting under Settings → Alerts.

Physical neighbor links discovered via LLDP (needs lldpd on the hosts). Accept sets a connected_to edge (a manual/physical link that always wins over inferred ones); dismiss hides it.

Hosts seen by agents that ran a LAN scan (device drawer → Health & Hardware → Scan LAN) and that aren't enrolled in RemotePower.

Appliances allowed to talk to this KMIP server. Each holds a client certificate issued here; revoke to cut an appliance off, re-issue to replace a lost certificate without losing its keys.

Managed objects held for the clients above — metadata only; key material is never shown. Destroying a key that an appliance still needs makes its encrypted data permanently unrecoverable. A destroyed key stays listed as a record until you remove it.

Estimated monthly energy cost per group and per tag, from each host's measured draw × your price/kWh above. A rough allocation for showback/chargeback — instantaneous watts projected to a 30-day month.