Triage health and incidents
Read events, findings, detection results and question states, and find the logs, without changing the endpoint.
1. Start with safe, read-only checks
These commands read state and never change the endpoint. Run them before anything that restarts, resets or re-enrolls.
cd /Applications/Recursift
export RECURSIFT_AGENT_HOME="$HOME/Library/Application Support/Recursift/native-agent"
./recursift-agent version
./recursift-agent status
./recursift-agent audit verify
./recursift-agent audit tail --n 20audit verify checks the local signed audit chain and prints verified with a record count. audit tail prints the newest records. To look at the machine itself, ask from the Conversation tab on the agent's page. Questions can only run fixed read-only checks; nothing asked this way can change the machine.
2. Read the logs
tail -n 100 "$HOME/Library/Application Support/Recursift/logs/com.recursift.agent.log"
tail -n 100 "$HOME/Library/Application Support/Recursift/logs/com.recursift.app.log"The first file is the background agent; the second is the menu bar app. The line enrollment revoked (HTTP 401); enroll again means the console no longer accepts this endpoint's key; see Recover an endpoint. Network failures are logged once and retried with backoff up to five minutes; they never stop local collection. The service restarts itself if it exits, at most once every 30 seconds.
3. An endpoint shows offline
Check, in order: that the Mac is awake and online; that launchctl print shows the service running; that status shows the expected server_url and agent_id; and that the log shows no revocation line. If status shows no agent_id, the service's folder was never enrolled; follow Install an endpoint from step 3. If the service is not running, start it:
launchctl kickstart -k "gui/$(id -u)/com.recursift.agent"4. Question states
| State | Meaning |
|---|---|
| queued | The endpoint was offline when asked. The question is delivered when it reconnects. After 24 hours it expires with “The endpoint did not reconnect within a day.” |
| pending | Waiting for the endpoint to pick it up. It expires if not picked up within 120 seconds. |
| dispatched | The endpoint has it. With no answer within three minutes it fails with “The agent did not return an answer within 3 minutes.” If the service restarted, the console hands it back up to twice. |
| answered | The endpoint returned an answer. |
| failed | The endpoint reported a failure or ran out of time. |
| expired | It never reached the endpoint in time. |
An expired or failed question tells you nothing about the machine. Treat that endpoint as unknown, not clean, and ask again once it shows online.
5. Events and findings
Events are compact summaries of what the endpoint escalated or hunted, not raw telemetry. The Events tab shows time, kind, summary, band, local and effective scores, and verdict. The effective score can change priority only; decisions about action read the local score. Findings are signed by the endpoint and verified by the console before they appear, with severity, confidence, the rules involved, indicators and the source event.
To see the evidence behind a finding, ask the endpoint about it from the Conversation tab. Answers carry no rows; the console fetches rows only when you request the data, and only while the endpoint still holds them.
6. Detection job results
Each job targets up to 100 endpoints. Before dispatch a job expires after 15 minutes by default; after dispatch it expires when its timeout plus 30 seconds passes. Revoked endpoints are refused. Results read Matched, No match, Unknown, Partial, Skipped, Expired, Failed or Unavailable. Only No match with complete coverage means the rules did not match the files scanned; Unknown, Partial and Unavailable mean the answer is not known.
7. When it looks like an incident
Recursift gives you evidence; your team decides and acts. It will not isolate the machine, stop a process or quarantine a file; those actions are refused. Preserve the endpoint before you change it: do not uninstall, reset evidence keys or re-enroll a machine you are investigating, because each of those can remove local evidence. Follow your own incident process, and see Support and escalation for what Recursift can help with.