Documentation menu
Operate / v0.1

Triage health and incidents

Read events, findings, detection results and question states, and find the logs, without changing the endpoint.

Reviewed September 27, 2026 · Current implementation

1. Start with safe, read-only checks

These commands read state and never change the endpoint. Run them before anything that restarts, resets or re-enrolls.

Terminal
cd /Applications/Recursift
export RECURSIFT_AGENT_HOME="$HOME/Library/Application Support/Recursift/native-agent"
./recursift-agent version
./recursift-agent status
./recursift-agent audit verify
./recursift-agent audit tail --n 20

audit verify checks the local signed audit chain and prints verified with a record count. audit tail prints the newest records. To look at the machine itself, ask from the Conversation tab on the agent's page. Questions can only run fixed read-only checks; nothing asked this way can change the machine.

2. Read the logs

Terminal
tail -n 100 "$HOME/Library/Application Support/Recursift/logs/com.recursift.agent.log"
tail -n 100 "$HOME/Library/Application Support/Recursift/logs/com.recursift.app.log"

The first file is the background agent; the second is the menu bar app. The line enrollment revoked (HTTP 401); enroll again means the console no longer accepts this endpoint's key; see Recover an endpoint. Network failures are logged once and retried with backoff up to five minutes; they never stop local collection. The service restarts itself if it exits, at most once every 30 seconds.

3. An endpoint shows offline

Check, in order: that the Mac is awake and online; that launchctl print shows the service running; that status shows the expected server_url and agent_id; and that the log shows no revocation line. If status shows no agent_id, the service's folder was never enrolled; follow Install an endpoint from step 3. If the service is not running, start it:

Terminal
launchctl kickstart -k "gui/$(id -u)/com.recursift.agent"

4. Question states

StateMeaning
queuedThe endpoint was offline when asked. The question is delivered when it reconnects. After 24 hours it expires with “The endpoint did not reconnect within a day.”
pendingWaiting for the endpoint to pick it up. It expires if not picked up within 120 seconds.
dispatchedThe endpoint has it. With no answer within three minutes it fails with “The agent did not return an answer within 3 minutes.” If the service restarted, the console hands it back up to twice.
answeredThe endpoint returned an answer.
failedThe endpoint reported a failure or ran out of time.
expiredIt never reached the endpoint in time.

An expired or failed question tells you nothing about the machine. Treat that endpoint as unknown, not clean, and ask again once it shows online.

5. Events and findings

Events are compact summaries of what the endpoint escalated or hunted, not raw telemetry. The Events tab shows time, kind, summary, band, local and effective scores, and verdict. The effective score can change priority only; decisions about action read the local score. Findings are signed by the endpoint and verified by the console before they appear, with severity, confidence, the rules involved, indicators and the source event.

To see the evidence behind a finding, ask the endpoint about it from the Conversation tab. Answers carry no rows; the console fetches rows only when you request the data, and only while the endpoint still holds them.

6. Detection job results

Each job targets up to 100 endpoints. Before dispatch a job expires after 15 minutes by default; after dispatch it expires when its timeout plus 30 seconds passes. Revoked endpoints are refused. Results read Matched, No match, Unknown, Partial, Skipped, Expired, Failed or Unavailable. Only No match with complete coverage means the rules did not match the files scanned; Unknown, Partial and Unavailable mean the answer is not known.

7. When it looks like an incident

Recursift gives you evidence; your team decides and acts. It will not isolate the machine, stop a process or quarantine a file; those actions are refused. Preserve the endpoint before you change it: do not uninstall, reset evidence keys or re-enroll a machine you are investigating, because each of those can remove local evidence. Follow your own incident process, and see Support and escalation for what Recursift can help with.

Continue readingRecover an endpoint →