Endpoints And Live View

The Endpoints area supports two connected operator jobs:

inventory and current-state review from the endpoint list and detail page
live investigation from the endpoint session workspace

Where It Lives

Use Endpoints in the Operations navigation group.

The main routes are:

/endpoints for the endpoint inventory
/endpoints/<endpoint-id> for endpoint details
/endpoints/<endpoint-id>/sessions for endpoint-scoped session context

Step 1: Find A Machine In The Endpoint List

The list page is the starting point for choosing the right machine.

Use it to:

search by hostname, computer ID, or OS hint
filter by operating system
sort by hostname, OS, architecture, or Last Seen
open Connect a computer to create install codes, send the getpharaoh.com download instructions, and verify whether the current code connected a computer
open an endpoint detail page

Filtered endpoint inventory showing the operator narrowing the list before opening a machine.

Older install codes are managed from the separate Install codes page behind Manage install codes in the connect flow.

When no rows match, Pharaoh keeps you on the same page and shows an explicit empty state. Clear filters, broaden the search term, or confirm enrollment before choosing another endpoint.

Step 2: Review Endpoint Details

The endpoint detail page is the static current-state view for one machine.

Use the header to confirm:

hostname
Computer ID
OS, architecture, and agent version
Last Seen
Open Sessions

Endpoint details page with identity, Sentinel context, detail tabs, and the Open Sessions handoff.

Use this page when you need to understand what Pharaoh already knows before starting interactive work.

Step 3: Check Sentinel And Detail Tabs

The Sentinel panel summarizes self-healing context for the endpoint. It can show latest status, summary, Last run, duration, version, policy, active session or thread links, pending escalations, accepted knowledge, and pending proposals.

The tab set breaks endpoint state into:

Overview
Self Healing
Diagnostics

Use Self-healing from the Sentinel panel to open the endpoint self-healing page. Use History when you need Sentinel history for the endpoint.

Step 4: Decide Static Details Or Live View

Stay on endpoint details when the operator needs:

inventory facts
collector freshness
Sentinel state
security, software, or diagnostic summaries
proof that an endpoint is stale before attempting live work

Move to live view when the operator needs:

a guarded conversation with the endpoint
fresh frame or transport evidence
commands or remediation under policy
a session worklog for the investigation

Step 5: Open Live View From The Session Workspace

The live screenshot-style context does not live on the endpoint detail page. It appears in the endpoint session workspace after Open Sessions.

That workspace includes:

Agent worklog with turn-grouped conversation and execution history
Follow-up for the next operator prompt
Live endpoint intelligence with latest frame state, evidence ledger, safety posture, and lifecycle controls
recent-session recovery
session controls such as Send turn, Stop active turn, and Close session

Dark endpoint session workspace showing live endpoint intelligence, policy posture, evidence ledger, and active turn controls.

Treat Endpoints as the inventory and detail surface. Treat the session workspace as the live view surface attached to that endpoint.

Step 6: Interpret Stale Or Missing Live Evidence

A missing frame, stale frame, waiting transport, or disabled send control does not prove the endpoint is healthy or unhealthy. It only describes the current live-session evidence.

Use this order of operations:

Compare the live workspace state with endpoint Last Seen.
Check Diagnostics for stale collectors or domain errors.
Check Sentinel for recent failures, stale checks, or active self-healing ownership.
Decide whether to wait, stop the active turn, close the session, or route the incident outside Pharaoh.