Getting started First steps

Home › Overview is the first screen after you sign in: it shows what needs attention for your active profile, the inventory numbers, charts of the last 14 days and, in a new company, the First steps

checklist. From any screen you can open help (the Help button in the screen header or the ? button in the top bar), and Admin › Template gallery starts common tasks already filled in.

For the full walkthrough — from the first agent to collectors, scans, cloud, licenses, alerts and dashboards — see How to start — step by step.

The home page has four parts:

Everything respects the active profile: a person without permission for alerts does not see alert cards.

The panel shows " of  done" and a progress bar. The next pending step is marked Next; click Open assistant to open its wizard (finished steps show Open again). Hide checklist hides it ("Checklist hidden. It remembers where you stopped."); Show first steps brings it back.

To open a dashboard as your home page, open the dashboard and choose Use as home page. Home then opens that dashboard, with the link Open the standard home page to come back.

Help › Help center and manual shows the contents by section, the article and a search box (Search the manual).

Admin › Template gallery lists ready-made starting points: access profiles, API accounts, integrations, reports, dashboards, alert rules, monitoring templates, agent profiles, compliance, deployments and hardware lifecycle.

Copies made by your company show the Company template pill.

Marina, the license manager at Aurora, wants to see how many Microsoft 365 licenses are bought but unused.

Rafael has just been invited as Platform administrator of a new company.

A colleague sends the link /asset/123 (a typo). Hive shows Page not found — "This address does not exist in Hive." — with the button Go to Home. If the address exists but your profile cannot see it, the message is instead "This screen is not available for your profile", with the hint to ask an administrator or switch profile.

This guide takes a new Hive installation from zero to daily operation in 13 steps. The How to start button in the top bar (the play icon with "done/total") opens the same steps in a side sheet that stays open while you move between screens. Each step marks itself as done from real evidence — there is no "mark as done" click — and has two links: Go to the screen and See in the manual (this page). The order matters: the collector comes before the directory and the scans because it is the collector that reads Active Directory, scans the networks, reads hypervisors and installs agents in batch. To configure, use a profile with administration rights (for example Platform administrator); people who only look things up need a read profile.

Worked example used throughout this guide: the company Aurora S.A. has a head office in São Paulo ( 10.10.0.0/16 ), a factory in Campinas ( 10.30.0.0/16 ), the domain corp.local , a vCenter and about 400 computers.

Where: Discovery › Structure. Create the sites, then the buildings and floors inside each site, and link each subnet to its site. Hive uses the subnet to place every asset (and every scan result) in the right site. Done when: at least one site exists. The guide shows the number of sites. Example: site São Paulo HQ with Floor 1 and Floor 2 and subnet 10.10.0.0/16 ; site Campinas Factory with 10.30.0.0/16 . See Company structure and Tags and groups.

Where: Assets › Agents › Install a collector (3-step wizard). A collector is an agent with the collector role on a server that is always on inside the network. It only makes outbound HTTPS calls to Hive.

Install one per site or per isolated network. Done when: at least one collector agent exists and is not revoked. The guide shows the number of collectors. Example:COL-SP-01 , a Linux VM at 10.10.0.20 that reaches 10.10.0.0/16 and dc01.corp.local:636 ; COL-CPS-01 in Campinas. The installer is single use and valid for 8 hours. See Step by step: create a collector.

Where: Integrations › Directory › Connect directory. Connect each Active Directory domain (one connection per domain, each read through the collector that reaches it) or Entra ID. Hive imports people, groups, departments and the computers of the OUs you choose; the Machines tab lists computers that still have no agent. Done when: at least one directory source exists (or an Active Directory, Entra ID, Google or Okta connection exists in the Integrations Center). The guide shows the number of sources. Example:corp.local read by COL-SP-01 , OUs Workstations-SP and Servers , synchronised every 60 minutes. See Step by step: connect Active Directory and Directory.

Where: Assets › Agents › New agent (7-step wizard). Choose the systems, the ring and the class, and generate the installer. Install it on one test machine first and check that it appears in Assets › All assets with inventory within a few minutes. Done when: at least one agent that is not a collector exists and is not revoked. The guide shows the number of agents. Example: a Windows installer for the notebooks of the IT team, tested on IT-NB-001 . See Step by step: create an agent.

Where: Assets › Agents › Installers tab, and Integrations › Directory › Machines/Batches. Methods: the Windows MSI (silent and transparent: no hosts file, JSON or script to edit), GPO, Intune, WinRM and ADMIN$ over SMB by IP range, the last ones through the collector. Done when: at least 80% of the active computers, notebooks, desktops and servers have an agent that is not revoked. The guide shows the coverage in percent. Example: GPO for the OU Corp/Workstations-SP ; ADMIN$ for 10.30.1.10–10.30.1.200 in the factory through COL-CPS-01 ; machines that already have the agent are skipped, so running a batch again is safe. See Rolling out the agent.

Where: Discovery › Discovery › New scan. Save the credentials (SNMP, SSH, WinRM) in Integrations ›Credentials, choose the ranges and the collector, and schedule the scan. Printers, switches, appliances and machines without an agent become assets; machines without an agent can be installed from the run's Without agent tab. Done when: at least one scan exists. The guide shows the number of scans. Example: weekly scan of 10.10.0.0/16 on Sunday 02:00 with SNMP v3, SSH and WinRM credentials, run by COL-SP-01 . See Discovery.

Where: Discovery › Virtualization, Discovery › Cloud and Discovery › Kubernetes. Connect vCenter, Hyper-V, Proxmox or Nutanix; AWS, Azure, GCP or OCI accounts; and Kubernetes clusters. Hosts, VMs (including powered-off ones), cloud resources and cluster workloads become assets linked to their platform. Done when: at least one hypervisor connection, cloud account or Kubernetes cluster exists.

The guide shows the total of connections. Example: the vCenter vcenter.corp.local with a read-only account, plus a read-only AWS account. See Virtualization, Cloud and Kubernetes.

Where: Monitor › Rules. Start from the templates (disk, CPU, memory, services, agent without contact) and adjust thresholds and scope; add maintenance windows where needed. Done when: at least one alert rule exists. The guide shows the number of rules. Example: "Disk above 90% on servers" from the Windows server template, scoped to the tag Servers . See Alerts and Step by step: alerts.

Where: Monitor › Channels and Monitor › On-call. Create the channels (e-mail, Teams, Slack, webhook, Telegram, WhatsApp or SMS), attach them to the rules, and set the on-call rotation with its escalation.

Done when: at least one notification channel of those kinds exists. The guide shows the number of channels. Example: a Teams channel for the NOC, SMS only on the rules whose severity is Critical, and a weekly on-call rotation for the infrastructure team. See Channels and on-call.

Where: Delivery › Packages and Delivery › Patches. Create the first package (or import one from the Third-party catalog) and a patch policy with a pilot ring; deployments and patches go through approval by another person in Delivery › Approvals. Done when: at least one Store package or one patch policy exists. The guide shows their total. Example: the 7-Zip MSI published in the catalog, and a "Patch Tuesday" policy tested for 3 days on the tag patch-pilot before production. See Packages, Patches and Deployments.

Where: Governance › Licenses and Governance › Contracts. Register purchases by SKU (or import them) and contracts with their notice period; Hive compares them with what is installed and used. Done when: at least one license entitlement or contract exists. The guide shows their total. Example: 200 Microsoft 365 E3 licenses and the support contract SUP-2026-014 with 90 days' notice. See Licenses and Contracts.

Where: Admin › Users. Invite each person with the profile that matches the job (service desk, security, auditor…); profiles decide which screens and actions each person sees. Done when: besides the person who installed Hive, at least one more user exists who is not disabled (invited or active). The guide shows the number of people. Example: Ana Souza invited as "Service desk L1". See Users and invitations and Profiles.

Where: Governance › Dashboards. Start from the ready-made dashboards (NOC, SOC, Infra…), edit a copy, share it with a profile or set one as your home page; the Home screen and Decisions show what needs attention each day. Done when: at least one dashboard of your own exists (ready-made dashboards do not count). The guide shows the number of dashboards. Example: a copy of the NOC dashboard with the widget "open alerts per site", set as the home page of the NOC team. See Reports and dashboards.

Hive has its own sign-in page at your company address. It shows only the ways to sign in that your company turned on, and the password, authenticator code, invitation and password reset all happen on that page. Only Sign in with your company account (SSO) sends you to your identity provider and back. After signing in, Account security (user menu) is where you manage your password, the authenticator app and your open sessions.

Sign in with the company account (OIDC or SAML), with your Hive account (e-mail and password) or with your domain user and password.

Confirm with the 6-digit code of an authenticator app, or with a recovery code.

Accept an invitation and create your password; reset a forgotten password.

Install Hive as an app from the sign-in page.

In Account security: change the password, register or change the authenticator app, generate new recovery codes and end sessions open in other browsers.

Switch the active profile from the user menu.

Profiles marked as privileged (for example Platform administrator, Security analyst and Auditor) always require the authenticator app. If you do not have it yet, Hive shows Register the authenticator app:

Open the user menu › Account security.

Buttons: Register the app (or Change phone), New recovery codes, and Turn off (only when your profile does not require it). New recovery codes and Turn off ask for the current code of the app; Change phone shows a new QR code, asks for the code of the new app and hands over new recovery codes.

If you have more than one profile, open the user menu › Switch active profile and choose one. Permissions and data scope change right away ("Active profile: … Permissions changed right away.").

Bruno was invited with the Security analyst profile (privileged).

Bruno loses his phone on a trip.

The New agent wizard (Assets › Agents › New agent) generates an installer already configured for your company: you choose the system, the class of machine, the modules, the network path and how it will reach the machines, and at the end you download a ready package with a one-line command. It needs the Manage agents permission. The wizard saves a draft as you go, so you can go back to any step without losing anything.

Platform. Choose the Operating system (Windows 10/11 and Server 2016+, Linux with systemd, macOS 12+), the Machine class (Workstation, VDI / RDS host, Server, Tier 0) and the Availability (Agent heartbeat, Ping by the collector, or Do not follow). The agent checks the class of the machine and refuses to enroll if it differs. Older systems such as Windows 7 are covered without agent, by the collector. On macOS, grant Full Disk Access to the agent with an MDM profile for the complete inventory.

Destination. Give the Installer name (for example "Finance notebooks"), the Initial tags every machine receives and the Update ring (Pilot, Early or General). The ring decides when the machine receives new agent versions and cannot be changed later without reinstalling.

Modules and resource use. Tick the modules: hardware and software inventory, change detection, software usage metering, monitoring and alert rules. Run with low priority is on by default; you can also limit the CPU cores (0 = no limit) and the upload in KB/s (0 = no limit) for thin links or VDI. Expected use: inventory about 1% of CPU for a few seconds every 4 hours and 40 MB of memory.

Connectivity. Check the Gateway address (detected): it must start with https:// , be a name the machines reach and be in the gateway certificate — "localhost" only works on the server itself. Fill Proxy (host:port) only if the machines go out through a proxy; empty uses the system proxy. Test proxy runs from the Hive server and confirms the proxy answers and opens the tunnel to the gateway.

Privacy.Ask consent before every remote session is on by default. Replace user names with stable pseudonyms keeps the same code (user-…) for the same person, so reports still work, but the name does not leave the machine.

Distribution. Choose how the agent reaches the machines: download the package, one-line command, GPO, SCCM / ConfigMgr, Intune or Jamf Pro. Set How many machines can use this installer and the Installer validity (1, 7, 30 or 90 days). For Server and Tier 0 the installer serves one machine only and its validity is in hours (1 to 24, default 8). Optionally lock it to one machine name or to one network (for example 10.0.9.0/24 ).

Review. Check the summary and, if you want to reuse these choices, type a name in Save these choices as a profile. Click Generate installer.

The last screen shows Agent package ready, the download button, the one-line command (PowerShell as administrator on Windows; terminal with sudo on Linux and macOS), how many installations are allowed and until when the token and the link are valid (the download link works for 2 hours). Below it, the guide of the method you chose (for GPO it points to the directory; for SCCM, the install, uninstall and detection commands; for Jamf and Intune on macOS, the script), plus Link by e-mail and, when Microsoft Entra ID is connected, Publish to Intune.

On Windows the file is hive-agent.msi , already configured: double-click and confirm, or run msiexec /i hive-agent.msi /qn . On Linux and macOS, extract the package and run sudo sh install.sh . The agent runs as a service (HiveAgent on Windows) and only talks outbound; the machine shows Online in Assets › Agents in about a minute, and the full inventory arrives in a few minutes.

A collector is an agent with the collector role, installed on a server inside the network. It scans networks without agents (ICMP, ports, SNMP, SSH, WinRM, TLS), reads Active Directory by LDAPS, receives NetFlow, sFlow and IPFIX, and installs agents remotely. It only makes outbound calls to Hive: nothing opens from the internet to it. Create it with Assets › Agents › Install a collector (permission Manage agents).

Where it runs. Choose the Operating system (Windows 10/11 and Server 2016+, or Linux with systemd) and give the Collector name, for example COL-SP-01 . Use a server or VM inside the network, always on, that reaches the domain controllers on port 636 and the networks you want to scan.

Connection to Hive. Check the Gateway address (detected): a name the server reaches and that is in the gateway certificate. The collector only opens outbound HTTPS to the gateway, with a certificate per device. Installer validity is shown, but a collector installer always serves one server only and its token is valid for 8 hours.

Review. Check the summary and click Generate collector installer. The last screen shows Collector package ready, the download, the one-line command and the button Connect the directory.

Install the package on the server (on Windows the MSI or the PowerShell command as administrator; on Linux the terminal command with sudo). In a minute the server shows in Assets › Agents › Agents with the Collector label, and in Integrations › Directory › Connections under Collectors with its system, version and tasks in the queue. From then on it can be chosen in a scan (Discovery ›Discovery › New scan), in Connect directory and in batch installations.

The Connect directory wizard (Integrations › Directory › Connect directory) sets up the import of people, groups and computers from Active Directory, read by a collector inside the network over LDAPS, or from Microsoft Entra ID, through the administrator consent. It needs Connect and manage integrations. The server, base DN, account and password live in an Active Directory / LDAP connection of the Integrations Center; the wizard uses it.

Directory. Choose Active Directory (through a collector in the network, with LDAPS and the account in the vault) or Microsoft Entra ID (people, groups, joined devices and Intune, through the cloud, without collector), then the Connection. You can connect both; start with the one the company uses the most.

Connection. Choose the Collector that reaches the domain controllers (same network as the DCs, port 636) and click Test connection. Each step shows its result. The certificate presented by the server appears with issuer, validity and SHA-256 fingerprint; Trust this certificate and test again pins it, so only this certificate is accepted from then on. You can only move on after a successful test.

What to import. Click Read OUs and groups: the collector lists the OUs (with people and computers in each), the groups and a sample of people. Tick OUs — none ticked means the whole domain; an OU inside another one is already included. Tick groups — none means all groups. Will be imported shows the counts before you confirm.

Attributes. Map the directory attributes that enrich the asset and its owner: Department ( department ), Manager ( manager ), Site / office ( physicalDeliveryOfficeName ), Cost center ( extensionAttribute1 ), Employee ID ( employeeID ) and Job title ( title ). Use the LDAP attribute name.

Synchronization. Choose the Frequency (every 5, 15, 60 — recommended —, 240 or 1440 minutes) and whether to Import automatically (off: imports only when you click Sync now). Only what changed is read (uSNChanged); departed people with assets become an event and computers are matched to assets by name and serial.

Review. Check the connection, collector, OUs, groups, attributes, frequency and certificate fingerprint, then Save and import (Active Directory) or Import now (Entra ID). The first import is full; the done screen follows it and offers See machines without agent.

Consent (Entra ID). Click Open administrator consent: the Microsoft portal opens with read-only permissions (User.Read.All, GroupMember.Read.All, Device.Read.All, DeviceManagementManagedDevices.Read.All) and, optionally, DeviceManagementApps.ReadWrite.All to publish the agent to Intune. An Entra administrator approves and comes back to Hive automatically —there is no secret to copy.

In Hive each kind of traffic has its own path. Agent data (inventory, metrics, events, task results) always goes from the agent to the gateway over outbound HTTPS, never through a collector. Package delivery (Store and deployments) can go through a collector in each location: it downloads the installer once and serves the machines of that network, which is what saves the branch link. This guide covers both: adding collectors as distribution points and making sure the agents of each office reach the gateway.

This guide takes one program from the installer to the people who use it. Each package goes through a pilot test and the approval of another person before reaching the Store or a deployment. You work in Delivery › Packages; people install from the store on their computer.

This guide takes you from zero to a working alert in four stages: where notices go, who is on call, the rule itself and the first alert. Everything is in the Monitor workspace.

The ERP servers have the tag ERP . The team wants a Teams card when CPU stays above 90% for 10 minutes, and the on-call person called if nobody reacts in 15 minutes.

This guide builds a dashboard in Governance › Dashboards and widgets: start from scratch or from a copy of a ready-made dashboard, add widgets, arrange them, share the dashboard and put it on a TV. You need reports:write to create dashboards; people who only have reports:read see the dashboards shared with them.

The IT manager wants one screen for the board: devices, critical risk, cloud cost and contracts, visible only to the Manager / executive profile.

This guide takes a contract from the paper to Hive: the contract in Governance › Contracts, the SKU lines that become rights of use in Governance › Licenses, the documents, and the alerts and the renewal decision before the notice deadline. You need the licenses:admin permission (the License manager profile has it).

The company signs an enterprise agreement EA-7781 with the reseller Alfa Software for 200 Microsoft 365 E3 and 30 Visio Plan 2 licenses, from 01/01/2026 to 31/12/2028, notice period 60 days.

The box shows "Notice deadline: 01/11/2028 (60 days before the end)." 4. SKU lines: Add line with MSFT-M365-E3 , Quantity 200, Unit price 180. Add line again with the reseller code VIS-P2-ALFA , Quantity 30, Unit price 95.

SAM (software asset management) answers "what did we buy, what do we use and where are we short"; HAM (hardware asset management) answers "what hardware do we have, where, and what covers it". In Hive the numbers come from Governance › Licenses and Governance › Contracts, the hardware from the inventory and Governance › Lifecycle, and the reports from Governance › Report builder, where any list can be exported or sent by e-mail on a schedule.