Check protection state
Confirm that an endpoint is enrolled, collecting, following your policy, and delivering findings.
What protection state means here
Recursift observes; it does not prevent. A healthy endpoint is one that is running, enrolled, collecting what your policy asks for, and delivering its findings. Check the four in order. Every command on this page is read-only.
cd /Applications/Recursift
export RECURSIFT_AGENT_HOME="$HOME/Library/Application Support/Recursift/native-agent"1. Presence in the console
The Agents page shows a presence dot for each endpoint and refreshes every five seconds. Green (online) means a heartbeat arrived within twice the poll interval plus ten seconds. Amber (away) means within three minutes. Gray (offline) means older, or never. Red means revoked. Presence shows that the service is reaching the console; it does not prove that a question will complete.
2. The service and its enrollment
launchctl print "gui/$(id -u)/com.recursift.agent" | grep -E "state|pid"
./recursift-agent statusLook for state = running, mode observe_only, and the expected server_url and agent_id. The policy field is the collection policy the endpoint last saved. telemetry and profileCollectedAt come from the last saved profile and may be older than the service's latest work.
3. Collection health
collection_health in the status output lists each collector with its capability, a health state of healthy, degraded, unavailable or stopped, the time it was last updated, and stale. stale is true when a running collector has not reported within three poll intervals. A status of unknown means health has not been recorded yet; unreadable means the health file is damaged. status still succeeds in both cases.
pendingDepth, oldestPendingAgeS, intakeBackpressure and findings_outbox describe processing and delivery backlogs, not whether a collector can see the machine. A growing backlog with healthy collectors points to processing or network trouble.
4. Posture and profile
The System tab on an agent's page shows its latest profile: identity, addresses, agent settings, runtime counters, six security posture checks and bounded inventories. Endpoints send a profile when they enroll, when the service starts, and every ten minutes by default. A check without evidence reads unknown, not passed.
5. Policy acknowledgement
The Policy page at /dashboard/policy holds the collection policy: poll interval (5 to 3600 seconds), profile interval (60 to 86400 seconds) and enabled checks. Each save increases the version. Changes reach each endpoint on its next heartbeat and take effect on its next poll. The Agent acknowledgements table shows every endpoint's acknowledged version and a policy state of Current, Awaiting acknowledgement, Policy drift or Revoked. It refreshes every 15 seconds.
Policy drift means the endpoint acknowledged an older version; check its presence first. A policy can only turn off checks the console knew about when it was saved; checks added to the agent later run until a newer policy decides about them. Collection policy cannot enable enforcement or change what the endpoint may do.
6. Findings, events and detection results
On the agent page, the Findings tab lists signed findings the console has verified, newest 50 first, and the Events tab lists compact event summaries, newest 200 first. Both refresh while open. The Detection page at /dashboard/detection shows scan and replay jobs under Scans & results.
An empty Findings tab on a quiet machine is normal; it is not proof of a clean machine. Read a detection result's coverage before its match: partial coverage cannot establish a complete non-match.