Skip to main content
Use Fleet Device Management actions in workflows to automate device health monitoring, security compliance checks, software inventory management, and device recovery operations.

​
Actions

Retrieves all hosts associated with a user from Fleet, returning basic host information for each device. Use this to identify user devices before performing other Fleet operations.Common use cases:
  • List all devices assigned to a user
  • Verify device ownership before granting access
  • Identify which device to target for Fleet operations
  • Gather device inventory for a user
Checks comprehensive device health metrics including battery status, disk encryption, MDM enrollment, OS updates, and uptime. Use this to ensure devices meet security and compliance requirements.Common use cases:
  • Verify security compliance before access approval
  • Check device health for troubleshooting
  • Ensure disk encryption is enabled
  • Validate MDM enrollment status
Lists all software installed on a user’s device with version information and vulnerability details. Optionally filter to show only software with known vulnerabilities for security auditing.Common use cases:
  • Audit installed software for compliance
  • Identify vulnerable applications
  • Track software inventory
  • Security risk assessment
Executes custom osquery SQL statements or predefined diagnostic queries on user devices to gather specific system information. Use this for advanced troubleshooting and system analysis.Predefined query types:
  • System information
  • OS version details
  • Logged in users
  • Running processes
  • Network interfaces
  • Disk space usage
  • Recent items
Common use cases:
  • Advanced device troubleshooting
  • Custom system information gathering
  • Security investigation queries
  • Performance diagnostics
Locks devices remotely through Fleet MDM to secure lost, stolen, or compromised devices. Returns an unlock PIN for each locked device that can be shared with the user.Input fields:
  • hosts - Array of hosts to lock (from Get User Hosts action)
Output data:
  • hosts - Array of locked hosts with their unlock PINs
Common use cases:
  • Lock lost or stolen devices immediately
  • Secure compromised devices during security incidents
  • Enforce device security policies for non-compliant devices
  • Remotely secure devices during employee offboarding
Retrieves the disk encryption key for hosts that have escrowed their encryption keys with Fleet. Use this to help users recover access to encrypted devices.Input fields:
  • hosts - Array of hosts to retrieve encryption keys for (from Get User Hosts action)
Output data:
  • hosts - Array of hosts with their encryption keys and the timestamp when the key was last updated
Common use cases:
  • Help users recover access to encrypted devices
  • Retrieve escrowed encryption keys for device recovery
  • Support disk recovery scenarios when users forget their password