Monitoring and security Decision queue and approvals

Screen: Decision queue and approvals (1/2)



Screen: Decision queue and approvals (2/2)

Hive asks a second person before anything risky reaches the devices: package versions, store requests, deployments, scripts, playbooks, patch policies and privilege elevations. Home › Decisions gathers everything waiting for a decision you can take, most urgent first, and holds the emergency brake. Delivery › Approvals lists the delivery items waiting for approval, grouped by type.

See, in Decisions, everything waiting for you: approvals, critical alerts without an owner, contract notices, leasing returns, AI recommendations and more.

Filter the queue by type and open each item where it is decided.

Pull or release the emergency brake (administrators).

Check the Divergent state and the Shift summary tabs.

In Approvals, see the delivery items by type and turn self-approval on or off (settings administrators).

Home › Decisions (tab Waiting for you) lists what waits for a decision you can take: deployments, patch policies, store requests and package versions, scripts, remote access, incident response, USB exceptions, temporary administrators, removal rules, workflow steps, risk acceptances where you are the approver, AI recommendations, critical alerts without an owner for more than 15 minutes, contract notice deadlines in the next 30 days without a renewal decision, leasing returns and purchases to curate.



Each line shows the type, the title, the detail, how long it has been waiting and the deadline. Click the title to open the place where you decide.

The chips on top filter by type ("All · N").

What you prepared yourself does not show: someone else decides.

A deadline within 7 days moves the item up. The number next to Decisions in the menu updates every minute.

Delivery › Approvals groups what waits for approval: Package versions, Store requests, Deployments, Scripts, Playbooks, Patch policies and Privilege elevations, oldest first. Each line says who prepared it and when, with Decide (opens the item) or, for what you prepared, the mark "You prepared it — someone else approves" and Open. You only see the groups your profile can approve.

The option Whoever prepares may approve their own package version or deployment (settings administrators) is off by default: another person approves (separation of duties). Turned on, small teams can approve their own package versions and deployments, and each self-approval is recorded in the audit trail. Scripts, patch policies and store requests always need another person.

Pull the emergency brake (administrators) stops every automation of the company at once: deployments do not advance, patch policies do not create deployments, alerts do not run automatic fixes, workflows hold and configuration profiles only check, without correcting. Nothing already done is undone. A reason is required; it goes to the audit trail and to the alert channels, and a red notice shows on every screen until someone clicks Release the brake, also with a reason. Automations resume where they stopped.

Divergent state lists devices where Hive or the directory disagree with what the device reports: retired but still reporting, active but silent for 7 days, disabled in AD/Entra but in use, and a different serial number, main user, name or Windows version. Fix the wrong source and the line disappears.

Shift summary counts what happened in the last 4 to 24 hours in your scope: alerts opened, resolved and still open, the rules that fired most, deployments, device changes, silent devices and decisions waiting. With the AI on, Summarize with the AI writes the handover text from these numbers only.

Lucas prepares the deployment "VPN client 7.4 – Recife" for 115 devices; Rafael is the other store administrator.

At 21:10 the service desk reports printers failing on the machines that just got a driver package.

The queue only shows what your profile can decide; an empty queue reads "Nothing waiting for you."

Self-approval covers only package versions and deployments.

The emergency brake does not undo anything already applied.

Deployments

Packages and store catalog

Scripts and signing

Patches

Software store

Audit trail



Screen: Alerts, rules and monitoring templates (1/4)

Screen: Alerts, rules and monitoring templates (2/4)



Screen: Alerts, rules and monitoring templates (3/4)

Screen: Alerts, rules and monitoring templates (4/4)

Alerts tell you when something on a device needs attention: a full disk, a stopped service, a forbidden change, an outdated agent. Everything lives in the Monitor workspace: Monitor › Alerts and events is the work queue, Monitor › NOC wall is the screen for the wall display, and Monitor › Alert rules holds the rules, the monitoring templates, the change policy and the maintenance windows. Known errors opens from the header of the Alerts screen.

Work the alert queue: acknowledge, take ownership ("I'm on it"), comment, escalate, resolve, close or open a ticket.

Watch the NOC wall in TV mode on a big screen.

Record what solved a problem as a known error, so the solution is suggested on the next matching alert.

Create alert rules with the 7-step wizard, with an impact preview before saving.

Apply monitoring templates (Windows server, Linux server, Workstation, SQL Server, Web server) to a tag or group, with exceptions per asset.

Choose which device changes raise alerts (Change policy) and schedule maintenance windows.

The queue shows alerts sorted by severity and then by age, and refreshes every 30 seconds. The KPI strip at the top counts Open, Critical, Acknowledged and Flapping alerts.

How events are formed:

Occurrences. Each detection of a rule on the same device and target joins the event that is still open or acknowledged; the counter (×N) goes up. Only after Resolve or Close does the next detection open a new event. Occurrences are kept for 90 days.

Flapping. If the same alert was resolved or closed twice or more in the last 30 minutes, the new one opens as Flapping: it does not notify, escalate or run the automatic fix. It stays like that until someone acknowledges, resolves or closes it.



Grouped (parent down). When a device above in the dependency path (VM → host → access switch → uplinks) has the "Device unavailable" alert open, the alert of the device below opens without notifying or escalating, linked to the parent. When the parent comes back, alerts that are still failing are released and notified. Security detections (EDR, IOC, Defender) are never grouped.

Situations. Below the queue, Situations groups alerts that started together: the same business service (2+ devices within 30 min), the same site (3+ devices within 15 min) or the same rule (3+ devices within 15 min).

Monitor › NOC wall brings together what needs action now and refreshes every 30 seconds:

tiles Critical, Major, Warnings, Agents offline (offline/total), Ports with new errors and Snapshots older than 7 days;

Open alerts (the 12 most severe and newest), Devices with most alerts, Ports with errors and Datastores above 85%.

The wall counts only new (open) alerts; acknowledged and flapping ones are not shown. TV mode takes the whole screen; Leave TV mode returns.

A known error is a problem signature plus the solution that worked. When a new alert matches it, the solution appears in the alert detail as a suggestion. A known error does not silence, acknowledge or resolve alerts.

Known errors (button in the Alerts header, or All known errors in the alert) lists all of them with Signature, Solution that worked and Uses, with Edit and Remove. New known errors are created only from an alert.

Monitor › Alert rules has four tabs: Rules, Monitoring templates, Change policy and Maintenance windows.

On the Rules tab, filter by layer (In the agent, On the inventory), turn each rule on or off with the On switch (with Undo), and see scope, condition, severity, actions and open alerts. Rules that come from a template, the change policy rule and platform rules (such as Device unavailable) are locked: change templates in the template, and for platform rules use Who to notify to choose channels, on-call and escalation. Deleting a rule resolves its open alerts; its versions stay in the history.

Describe in words builds a rule from a sentence with the AI; review it in the wizard before saving.

Scope. Choose All assets, By group (dynamic or static groups) or By tag (type the exact tag, like "Department: Finance", and press Enter). Assets that join later also get the rule.

What to watch.A metric (CPU, memory, disk, service, process, ping, TCP port, web address, certificate, database, web and application server), Combined condition (up to 6 conditions with AND/OR/NOT and "no data for N minutes"), A change on the device, The state of the inventory (no contact, no owner, outdated agent, no agent, no antivirus, firewall off, disk not encrypted, KEV vulnerability, license problems and more), Software usage, A port policy, Network traffic (flows) or Applications (OpenTelemetry).

Condition. Built by choosing, with the sentence "The rule reads:" updated as you go. For a metric: Metric, Which one (C:, /var, * = any), Fires when above/below, Warning at, Critical at (optional), Returns to normal at (optional hysteresis) and For at least (minutes; 0 = right away).

Severity. Info, Warning, Major or Critical. For a metric with thresholds, the alert opens as Warning when it passes Warning at and raises to Critical by itself above Critical at.

Actions.Notify on (channels of Monitor › Notification channels), Open a ticket on (ITSM connections), Automatic fix on the device (restart, start or stop a service, flush DNS, clear temporary files, update group policy, reboot, collect inventory, antivirus scans and signatures, a published playbook or an approved signed script; at most 3 times a day per device and rule; Resolve the event when the fix works) and Escalation (on-call at opening and up to 5 levels).

Impact preview. Click Run the preview (required): Hive shows how many assets in the scope would fire today, with up to 10 examples. Metric rules can also Simulate the last 7 days. More than 150 hits shows "Too many hits".

Review and save. Type the Rule name, keep Turn on when saving on (off saves without evaluating) and click Create rule (or Save new version when editing). Agents get metric rules at the next check-in (up to 1 minute) and evaluate them locally, even offline; the platform evaluates the other kinds every minute or when the inventory reports changes.

A template is a set of items applied to a tag or group; each item becomes a locked rule named "Template · Item", and new assets with the tag get the rules by themselves.

Open Monitor › Alert rules › Monitoring templates and click New template.

Ready template. Start from Windows server, Linux server, Workstation, SQL Server or Web server, or choose Blank and add the items one by one.



Apply to.By tag (for example "Servers") or By group. There is no "all assets" option for templates.

Items. Each item becomes a rule. Adjust Item name, Metric, target, Fires when, Warning at, Critical at, For at least and Severity (or "Same as the template"); use Add item and Remove item. The warning must come before the critical threshold.

Review and save. Type the Template name, Description, Default severity and Notify on, keep Template on and click Create template (or Save template). Saving creates or updates one rule per item.

To treat one machine differently, use Exception for one asset: choose the item and the Asset, then either change Warning, Critical, Clears at or For at least (empty fields inherit the template) or tick Turn this rule off on this asset (its open alerts on that asset are resolved). The Reason is required. Exceptions apply to metric items; service items can only be turned off.

Change policy lists each kind of change (software, services, ports, operating system, hardware, network, identity, security) with a switch and a severity. Restore recommended brings back the default; Exceptions by group override it for a group (when several groups apply, the strictest setting wins). Save policy applies from the next inventory.

Maintenance windows › New window: Name, Scope (tags), Sites, Devices, When (Once with start and end, or Every week with day, start and Duration (minutes)), then Schedule window. Nothing chosen = all devices. Inside the window a detection is recorded only as an occurrence: no event, no notification, no ticket, no automatic fix. An event already open on a device that enters a window shows In maintenance: it leaves the NOC wall and the escalation until the window ends.

Central IT wants a warning when any Windows server's C: drive passes 90% for 10 minutes, and critical at 95%. The servers carry the tag Servers .

Worked example: a recurring alert, a known error and silencing the asset

The print spooler of PRN-SRV-03 stops every Monday and the "Spooler" service rule fires.

Viewing alerts needs permission to read alerts; acknowledging, resolving, rules, templates and windows need permission to administer alerts.

A known error never silences an alert; use a maintenance window, a template exception or an automatic fix.

Escalation stops only when the alert is acknowledged (Acknowledge or I'm on it). Flapping alerts and alerts grouped under a down parent do not escalate.

Automatic fixes run at most 3 times a day per device and rule, and not when the device has no agent.

Combined conditions: at most 6, evaluated every minute; values older than 15 minutes do not count.

Template rules are changed only in the template; rule-level edits are refused.

Maintenance windows: up to 1000 devices; weekly duration up to 10080 minutes.

Notification channels and on-call

Step by step: create alerts

ITSM tickets



Business services

Playbooks

Screen: SOC wall

The SOC wall is the security twin of the NOC wall: one screen for the TV in the security room that answers "are we under attack, and what do we fix first?". Open Monitor › SOC wall. It refreshes every 30 seconds and the numbers are recalculated at most every 15 seconds, so many screens can stay open at the same time.

See the open security alerts by severity (EDR, Defender, indicators of compromise, decoys, agent tampering and blocked applications).

Follow the detections of the last 24 hours against the 24 hours before, and the trend by hour (24 h) and by day (7 days).

Read the Latest detections feed and the Most affected devices (7 days).

Work the Needs attention now list, most serious first; each line opens the screen that solves it.

Put the wall in TV mode on a big screen (full screen, larger type).

Critical security alerts, Major security alerts, Security warnings: security alerts that are not resolved or closed and not in maintenance.



Detections (24 h): native EDR detections (except false positives), new Defender threats, indicator hits, vendor EDR alerts, decoys touched and agent tampering. Below: how many are critical, on how many devices, and the change against the previous 24 hours.

Defender off: Windows devices with Defender off or without real-time protection, out of the Windows devices that reported Defender status.

Defender outdated: Defender signatures older than 3 days.

Open KEV vulnerabilities: distinct CVEs from the CISA KEV catalog still open on active devices; below, how many are past the CISA due date.

Choke points: the fixes that break attack paths to crown jewels, from the last calculation of Attack paths.

MTTA and MTTR: average time to acknowledge and to resolve the security alerts opened in the last 30 days.

Lia starts her shift and looks at the TV in the security room.

Viewing the wall needs alerts:read . Defender and cloud posture need assets:read ; KEV, choke points and external surface need vulnerabilities:read ; admins without MFA need users:read . What you cannot see is simply not shown.

With a data scope (sites, tags or groups) only the devices in the scope count; cloud, external surface, identities and attack paths are shown only to people who see the whole company.



Choke points come from the last calculation of attack paths (hourly); the wall does not recalculate them.

Defender threats count once, when Hive first sees them; the same threat repeated in later reports does not count again.

Indicator hits from network flows without an identified device appear in the feed but not in Most affected devices.

MTTA and MTTR show "—" when no security alert was acknowledged or resolved in the last 30 days.

Alerts

Detection and hunting

Microsoft Defender

Indicators of attack

Attack paths

Vulnerabilities

Identities

Screen: Notification channels, on-call and personal notifications (1/3)



Screen: Notification channels, on-call and personal notifications (2/3)

Screen: Notification channels, on-call and personal notifications (3/3)

Alerts reach people in three ways: notification channels shared by the team (Monitor › Notification channels), the on-call schedule that says who answers now (Monitor › On-call), and push notifications on each person's own phone or computer (user menu › Notifications on my devices). Each channel is a connection of the Integrations Center, with a test and a history.

Connect e-mail (SMTP), Microsoft Teams, Slack, webhook, Telegram, WhatsApp and SMS channels, and send a test.

See which rules use each channel ("Used by").

Create on-call schedules that rotate people daily or weekly, and cover a period for a shift swap or vacation.

Turn on push notifications on your own devices, with your severities and quiet hours.



Channels notify when an alert opens, changes severity and is resolved; an escalation level sends only to its own channels.

The first covers the current shift; the queue starts over after the last. Only active users who can see alerts appear.

Cover a period puts someone else over the queue: choose the Person, From, Until (default 12 hours) and a Note, such as "vacation". The cover replaces only the person on call; the backup stays the next in the queue.

In the rule wizard (Actions › Escalation) or in Who to notify of a platform rule:

On-call at opening: a schedule and Who (On call or Backup), called when the alert opens.

Add escalation level (up to 5): Without acknowledgment after (min), counted from the opening, an On-call schedule with Who, and channels in Escalate to. Each level waits longer than the one before (1 to 1440 minutes) and must call a channel or the on-call person.

The on-call person gets a push on all their devices, titled "[On call] …", even in quiet hours and whatever severities they chose, plus the e-mail through the schedule's channel. Acknowledge (or I'm on it) stops the escalation; Escalate now runs the next level.

Only the alert title and a short text go in the notification; tapping it opens the alert. If you can administer alerts on that asset, the notification has an Acknowledge button. On iPhone and iPad it needs iOS 16.4 or later with Hive added to the home screen (Safari › Share › Add to Home Screen).

Channels have no severity filter of their own: severity comes from the rule. So send the critical cases through rules whose severity is Critical.



Connecting and testing channels needs permission to administer integrations; schedules and covers need permission to administer alerts.

Telegram, WhatsApp and SMS go to the fixed destinations of the connection, never to the on-call person; the on-call person is reached by push and by the schedule's e-mail.

The test of Telegram, WhatsApp, SMS and e-mail does not send a message; the first real alert confirms the delivery.

A schedule that rules escalate to cannot be deleted; change those rules first.

Platform rules such as "Device unavailable" appear in the rules list after their first alert.

There is no button to remove a cover; it ends at its Until time.

Quiet hours hold all your personal pushes, including critical ones, except on-call calls.

Hive does not call internal network addresses from the cloud; webhooks need a public https address.

Alerts, rules and monitoring templates

Step by step: create alerts

Integrations Center

Screen: Digital experience



Digital experience (Monitor › Digital experience) shows how the devices feel for the people who use them. The agent sends, with each inventory, the start-up time, the applications that crashed or hung, system crashes, the network quality and the heaviest processes; Hive turns that into a score from 0 to 100 per device, points to the probable cause and lets you put a message on the users' screens.

See the Average score, how many devices are Good (80+), fair (60–79) and Poor (below 60), and the Average start-up.

See the network of the estate: Weak Wi-Fi, Latency to the gateway, Slow network and On VPN.

Follow the Average score, last 30 days.

Find the Devices with the worst experience and read What lowers it and the Probable cause.

List the Blue screens, kernel panics and unexpected shutdowns (30 days).

Compare the Score by department and the Score by application.

See employee sentiment next to the score (Sentiment beside experience), when surveys have answers.

Announce on screen: send a message to the devices of chosen sites or tags.

On each device, see the Digital experience panel in the asset's Monitoring tab.

Each device starts at 100 and loses points for what the agent reports (never below 0):

Where the data comes from: on Windows, the Event Log (application crashes and hangs, BugCheck blue screens with their code, Kernel-Power 41 unexpected shutdowns); on Linux, systemd (start-up time, core dumps) and pstore for kernel panics; on macOS, the diagnostic reports, including panic reports. The agent also reads the active Wi-Fi (network, signal, rate, channel), VPN adapters that are up, and pings the default gateway. Only program names, counts and numbers are sent — no command lines, window content or addresses visited.

The lowest score of each day is kept for the trend.



On Monday the help desk gets three calls from the Finance team about Excel closing by itself.

The VPN concentrator of the São Paulo office will be restarted at 18:00.

The page is empty ("No experience data yet.") until agents send the experience with the inventory; devices without an agent have no score.

Only active assets count; the lists follow the scope of your profile.

Probable cause appears only when an application crashed at least twice; Hive looks at the software changes of that device in the last 10 days, the one that names the application first. It is a hint, not a proof.

Average start-up comes from Windows and Linux.

Score by department needs devices assigned to departments in Discovery › Structure; without that it says "Assign devices to departments in Structure to compare them."

Score by application counts "where it is installed" by matching the application name with the installed software, so the share is approximate.

Announce on screen needs the alerts administration permission. It needs at least one site or tag, and the message has up to 500 characters of plain text. Sites are matched by name; with sites and tags together, a device must match both. Only devices with an agent receive it; if none matches, Hive answers "No device with an agent matches the targets."

Devices with the worst experience shows the 20 lowest scores; the system crash list shows the last 50.

Employee sentiment

Alerts and rules

Recorded playbooks

Deployments

Organization structure



Screen: Employee sentiment surveys

Monitor › Employee sentiment asks people short questions about their computer and IT — every few weeks, right after a ticket is resolved or after a patch or deployment — and shows the answers as a 0 to 100 score next to the digital experience score. The question appears on the person's computer through the agent and opens a small survey page; no sign-in is needed.

Create campaigns of three kinds: Pulse (periodic), After a ticket and After a change.

Choose 1 to 3 questions answered with a Score 1 to 5 or an Emoji, and allow an optional comment.

Decide the Anonymity: Identified (only with the person's consent), Department only or Anonymous.

Target an Audience by departments, groups and tags, and check How many devices? before sending.

Follow the Overview: score, response rate, trend, results by department, by app and by device, and comments.

See the Results of each campaign and the verdict of each change in After changes.



In Campaigns, each row shows the kind, the number of questions, the Status, the Anonymity, the Response rate (answered of invited) and the Sentiment. The buttons are Results, Edit, Activate, Pause, Send now (active pulse only), Close and Delete.

With nobody signed in, the survey waits in the local store portal under Quick surveys from IT.

Overview (last 90 days): Sentiment score (0 to 100, with the average "of 5"), Response rate, Answers and Active campaigns (with how many were skipped by users), the weekly Trend, By department with the experience score beside it, By app, By device (identified answers) and the latest Comments.

Results of a campaign: the average and the 1 to 5 distribution of each question, By trigger, By department, the trend and the comments. Below the minimum of answers, only the count is



shown.

After changes: each patch or deployment followed by an After a change campaign, with Invited, Answers, Sentiment and the Verdict: Good (average 3.5 or more), Mixed, Bad (below 2.5) or Waiting for answers.

On the device page, Monitoring shows the Employee sentiment panel with the identified answers, the latest surveys and, when there is one, the date until which the user asked not to be surveyed. Monitor › Digital experience shows Sentiment beside experience.

The 0 to 100 score is the 1 to 5 average on the experience scale: 1 = 0, 3 = 50, 5 = 100.

The IT manager wants to hear the Finance team every quarter, without exposing anyone.



Viewing needs permission to read assets; creating, editing, activating, pausing, sending, closing and deleting campaigns need alert administration.

Only active devices with a workstation or VDI agent are surveyed. Servers, decoy devices, devices whose user chose Don't ask on this computer (90 days) and devices surveyed within the Rest days per device are skipped.

Send now works only for an active pulse; it respects the rest days and restarts the Every (days) count from that moment.

Every (days) goes from 1 to 365, Rest days per device from 0 to 180, Wait before asking (minutes) up to 10,080 (7 days) and Open for (days) from 1 to 30.

Once a campaign has answers, its questions and anonymity cannot change; create a new campaign instead.

Close expires the invitations still open. Delete removes the campaign and all its answers and cannot be undone.

In Department only and Anonymous campaigns, groups with fewer answers than the minimum stay hidden, and the answer keeps only the day, not the time. Anonymous keeps no department either.

After a ticket only covers tickets linked to a device and resolved after the campaign was created (and in the last 3 days).

A computer that is off keeps the invitation queued; Hive retries the delivery (up to 12 attempts) until the survey is shown or the invitation expires.

Digital experience

ITSM tickets

Patches

Deployments