When deploying the ControlUp macOS agent via ControlUp for Digital Experience (CU4D), users may encounter a system prompt asking for approval related to a Network Content Filter extension. This prompt is legitimate and a standard security feature of macOS. Apple requires explicit user or Mobile Device Management (MDM) approval for network extensions because they run in the background and have the capability to inspect network traffic.
The specific prompt appears due to the agent’s use of a network extension to facilitate Unified Communications and Collaboration (UC&C) live monitoring. While the agent itself continues functioning without this approval, enabling the extension is necessary to capture and provide real-time UC&C data, which is vital for comprehensive digital employee experience monitoring focused on communication tools and services.
Deployment of the ControlUp macOS agent often involves using remote control utilities like ScreenConnect, and configuration of these network extension approvals can be managed through MDM solutions such as Jamf or Microsoft Intune. By applying configuration profiles through MDM, administrators can reduce or prevent these approval prompts from appearing to end users, streamlining the deployment process and improving user experience.
For further details and step-by-step instructions on deploying the macOS agent and handling configuration profiles in MDM environments, refer to ControlUp’s official documentation at https://support.controlup.com/docs/configuration-profiles-for-mdm-deployment. This article has been validated with recent versions of Jamf and Intune, ensuring compatibility and applicability in modern macOS management setups.
Read the entire article here...
Security Related Training & Support Archives
Security training and support-related archives from inside the ControlUp Community on Slack.
Understanding the Absence of Window Title Data in ControlUp’s app_focus Index with End User Activity Module Enabled
In ControlUp's app_focus index, users may notice that the Window Title column does not populate any data despite the End User Activity module being enabled. This was raised by a community member whose security team was interested in accessing window title information for monitoring purposes. The inquiry sought to clarify whether this behavior is expected or if the Window Title should be displaying active window titles as part of its collected data.
Upon investigation, it appears that this behavior reflects a current limitation within the product rather than a configuration issue. The absence of window title data in the app_focus index under the End User Activity module is identified as a gap in functionality. No special settings or additional steps are needed to enable this feature presently because it is not yet supported.
ControlUp's support team acknowledged this shortfall after a preliminary check and initiated the process to address it via a support ticket, indicating the company's commitment to enhancing the module to meet user needs in the future. For now, users requiring detailed window title data for security or monitoring purposes will need to consider this limitation.
For further insights on the End User Activity module and its current capabilities, users can consult the official ControlUp documentation at https://docs.controlup.com or reach out to ControlUp support for updates on feature enhancements.
Read the entire article here...
Read the entire article here...
How to Fix 400 Errors Caused by Using _id Sorting in ControlUp Edge API Queries
A PowerShell script that queries device data from the ControlUp Edge API using paginated search_after calls experienced failures starting Sunday, returning a 400 Bad Request error. The error message indicated that sorting or aggregations on the _id metadata field were no longer supported, specifically stating that "Using the _id metadata field in aggregations, sorts, scripts, or top-level field loads... is not supported because it loads fielddata into the heap." This change caused calls sorting by the internal OpenSearch/Elasticsearch document _id to fail.
The root cause was an upstream change implemented over the weekend by ControlUp. The API now blocks the use of the _id metadata field in queries to prevent severe OpenSearch JVM issues such as Out of Memory (OOM) conditions, which were observed when sorting or aggregating on large indexes by _id. This protective measure was applied after discovering more widespread usage of _id sorting than previously expected. In response to the problem and customer impact, ControlUp temporarily disabled this restriction for affected tenants, including the user’s tenant, to restore functionality while addressing the underlying stability concerns.
The resolution for the user’s scripts was to update their pagination logic to sort and search_after using a real mapped field, such as device name, instead of the internal _id metadata field. This change immediately restored proper API operation without requiring further modifications. The user’s initial script had been generated with assistance from a language model but required this adjustment due to the updated API behavior.
The discussion also raised the topic of API change notifications. ControlUp has yet to provide advance announcements or subscription-based alerts for breaking API changes, which users expressed interest in receiving. ControlUp may consider this feedback to improve communication about future updates.
For users facing similar errors, it is essential to avoid using the internal _id metadata field for sorting or pagination in ControlUp API queries. Instead, rely on indexed, mapped fields to ensure compatibility with recent security and stability improvements to the ControlUp Edge API backend built on OpenSearch.
Relevant ControlUp resources include the official documentation on the Edge API and pagination techniques, available at https://docs.controlup.com, and the ControlUp Academy at https://cuacademy.controlup.com for learning best practices with API integration.
Read the entire article here...
Read the entire article here...
Troubleshooting Missing Description Field in ServiceNow Tickets Created by ControlUp Templates Due to ACL Permissions
When using ControlUp's built-in templates for creating ServiceNow tickets, such as the Battery/Hardware Replacement Request, users may encounter an issue where the ticket is generated correctly with the appropriate short description, priority, and assignment group, but the detailed description field (result) is not populated. While the description input is visible during the creation process, the corresponding field in ServiceNow remains empty despite the ticket's successful creation.
This symptom typically indicates a permissions-related issue rather than a problem with the template or ControlUp’s integration logic. Specifically, the root cause is often related to Access Control List (ACL) settings in ServiceNow. The integration user account configured in the ControlUp-ServiceNow connection might have the necessary permission to create records but lacks write access for certain fields, such as the Description field on the Incident table. When ServiceNow receives the ticket creation request, it accepts the record creation but silently skips the fields that the user cannot update, leading to the description field being omitted without any error message.
To resolve this, verify that the user configured for the ServiceNow integration has full write permissions to all the required fields on the Incident table, including the Description field. This may involve adjusting ACL rules and permissions in ServiceNow’s user roles and security settings. Testing with an account verified to have full write access confirmed that the Description field populated correctly, indicating the problem indeed lies in ServiceNow’s ACL settings rather than ControlUp itself.
For further troubleshooting, gathering detailed logs from the ServiceNow side and submitting a support ticket along with this diagnostic information can help ControlUp support investigate more complex cases. More information on configuring and troubleshooting ServiceNow integration permissions can typically be found on official ControlUp resources and ServiceNow documentation.
Read the entire article here...
Read the entire article here...
Managing Unassigned Machines in Citrix Cloud Connections for MSP Environments with ControlUp
When setting up a Citrix Cloud connection in ControlUp within an MSP environment, an issue can arise where unassigned machines—those not part of any Delivery Group—are still appearing in client views even when the "Include Unassigned Machines" checkbox is unchecked. This behavior can cause security and privacy concerns, especially in a Citrix CSP (Cloud Solution Provider) model where multiple clients share the same CSP tenant but must not see each other’s resources.
The key insight is that the "Include Unassigned Machines" checkbox does not control whether unassigned machines are collected in ControlUp; rather, it controls ownership assignment. Unchecking this box only indicates that a particular connection does not own those unassigned machines. If no other connection claims ownership, ControlUp will assign all unassigned machines for that customer ID to the last available Citrix Cloud connection by default, causing them to appear in that connection’s view regardless.
Since filtering by Delivery Group names (for example, using exclusion rules like "*") does not affect unassigned machines—which by definition have no Delivery Group—this method is ineffective for hiding these machines from clients.
The recommended solution is to use a dedicated MSP-only Citrix Cloud connection for unassigned machines. This involves adding a second Citrix Cloud connection using the same Customer ID but naming it something clearly internal, such as "CSP-Unassigned." On this connection, the "Include Unassigned Machines" checkbox is checked, while on all client-facing connections it remains unchecked. By placing this MSP-only connection in a folder or with permissions that clients cannot access, unassigned machines are effectively segregated and hidden from end clients. This setup ensures clients only see Delivery Groups and connectors specific to them, while unassigned machines remain visible only to the MSP’s internal team.
In rare cases where the connector setup itself does not behave as expected—such as when unassigned machines do not show even when the "Include Unassigned Machines" box is checked—it may be necessary to contact ControlUp support for assistance.
For more details on configuring Citrix Cloud connections and collection rules, refer to ControlUp official documentation at https://docs.controlup.com and the ControlUp Academy at https://cuacademy.controlup.com.
Read the entire article here...
Read the entire article here...
Resolving Permission and Custom Field Issues When Creating ServiceNow Records via ControlUp Flows
When attempting to create an event in ServiceNow via a flow, a common issue encountered is the error message stating, "You don't have permission for this action(edit_ai_agent)." Despite this message, extra fields can be added in the flow, but these custom fields do not appear in the REST message received by ServiceNow. This issue is often accompanied by the problem where fields such as short description, description, or custom fields (e.g., "company") show up empty or without values on the created record, especially when the target is a custom table extended from the task table.
The root cause of the permission error "edit_ai_agent" was identified as a bug on the integration side, which was scheduled to be fixed in an upcoming release. Importantly, this error itself does not affect the actual payload sent to ServiceNow. Rather, the missing field values within ServiceNow are typically due to two main configuration issues on the ServiceNow instance side. First, custom fields must be referenced using their internal column names, which start with the prefix "u_" (for example, "u_company") rather than their field labels. ServiceNow ignores unknown or incorrectly named fields silently without showing an error. Second, the integration user account used by the flow requires proper Access Control List (ACL) permissions: specifically, it needs create ACL rights on the custom table and write ACLs on the individual fields. Without these permissions, ServiceNow will create the record but omit values for fields lacking write permissions, resulting in empty fields.
To validate what data is actually received by ServiceNow, administrators can use the inbound REST transaction logs (found under System Logs > Transactions) to inspect incoming requests. If there are errors like "ACL Exception Insert Failed" in the flow's run history, it confirms that ACL permissions need adjustment for the integration user. Ensuring these conditions—correct internal field names with the "u_" prefix and appropriate ACL permissions—will allow custom fields to populate correctly in ServiceNow records created via the flow.
Relevant documentation for working with ServiceNow's field naming conventions and ACL settings can be found in ServiceNow's official resources, and for troubleshooting integration issues, ControlUp's knowledge base and support channels offer further guidance. The fix for the "edit_ai_agent" permission bug was targeted for the next product release following this report.
Read the entire article here...
Read the entire article here...
Automating Detection and Remediation of Stuck BitLocker Encryption on Windows 11 Endpoints with ControlUp Real-Time Automation Engine
When deploying hundreds of Windows 11 endpoints managed by Intune, a common issue with BitLocker encryption is that the process sometimes becomes stuck at a certain percentage completion. While manually pausing and restarting the encryption process resolves the issue within minutes, automating this detection and remediation can save considerable time and ensure consistent endpoint security.
Using ControlUp Real-Time Automation Engine (CU4D), such automation is achievable by leveraging scripted detection and remediation. One approach is to create a single script that both detects the encryption status and initiates a restart of the encryption process if it remains stuck at the same percentage. This script can be deployed across all affected devices and scheduled to run periodically, for example, once per day, to identify any stuck BitLocker jobs and resolve them promptly.
A more modular approach involves creating two separate scripts: a detection script and a remediation script. The detection script would check the current encryption percentage, and if it identifies a stuck state, it writes the status to a custom index attribute within ControlUp. An alert can then be configured based on the value of this custom attribute. When the alert triggers due to a stuck encryption status, the remediation script executes automatically to restart the BitLocker encryption, ensuring a timely resolution without manual intervention.
This method harnesses ControlUp's ability to store custom scripted outputs in custom indices and link those to alert triggers, thus providing a robust, automated way to handle encryption stalls on Intune-managed Windows 11 devices. For further details on configuring custom scripts, custom indices, and alerts in ControlUp, administrators can refer to ControlUp's documentation at https://docs.controlup.com and explore automation capabilities in the ControlUp Academy at https://cuacademy.controlup.com.
Read the entire article here...
Read the entire article here...
How to Report Horizon Client Versions Across User Sessions Using ControlUp
A common requirement for managing VMware Horizon environments is the ability to report on the endpoint client versions—referred to as "HZ Client Version"—used by users to connect to the Horizon infrastructure. This need becomes particularly important in hybrid environments where users connect from both managed internal devices and unmanaged BYOD (Bring Your Own Device) endpoints. Tracking client versions helps administrators identify devices running outdated Horizon clients that require upgrades to ensure security, compatibility, and optimal performance.
Within ControlUp, the Horizon client version information can be accessed via several mechanisms. The VDI - Details view in the ControlUp console displays the HZ Client Version associated with each session, providing a straightforward way to see the current client version used. For programmatic or historical data extraction needs, ControlUp also offers a real-time data API (https://api.controlup.io/reference/gettables) which can retrieve live session details including client versions. Additionally, the "initial HZ client version" field recorded in the Session Activity report captures the client version that was used to start the session. This field, although labeled as "initial," effectively serves as a snapshot of the client version at session start.
However, because users in hybrid scenarios may connect multiple times throughout the week from different devices or update their Horizon client between sessions (for example, by disconnecting, updating, and reconnecting), it is important to consider that the client version can vary across sessions. The "initial HZ client version" is tied to each individual session start, so accumulating this information over a period allows administrators to identify all versions in use and target users on outdated clients. Pulling session activity reports over time and correlating the client versions used enables identification of BYOD devices needing updates even if the same user connects from multiple endpoints.
In summary, the "initial HZ client version" contained in ControlUp’s Session Activity reports is the key field for tracking Horizon client versions across user sessions. The ControlUp real-time data API further facilitates custom querying and automation for this reporting. For detailed exploration of session data, the VDI - Details view complements these options with an at-a-glance interface. Using these tools, administrators in hybrid environments are able to efficiently monitor and manage Horizon client versions on both managed and BYOD devices, ensuring compliance and performance consistency.
Read the entire article here...
Read the entire article here...
How IP Restrictions Affect REST API Access and How to Configure the IP Allow List in ControlUp
When IP Restrictions are enabled in a ControlUp organization, they apply not only to user sign-in at app.controlup.com but also to REST API calls that use API keys or tokens for authentication. Initially, there was confusion about this behavior, with one party assuming that IP Restrictions only affected user sign-ins via the web application and would not restrict API calls. However, further investigation clarified that IP Restrictions do indeed apply to API requests.
The key issue encountered was that reporting workflows that fetch machine statistics via the REST API started returning "Unauthorized" errors after IP Restrictions were enabled. Although the API tokens used for authentication were verified as valid and not expired, the requests failed due to the IP restriction settings.
The resolution involves adding the public egress IP addresses of the systems making the API calls (such as those running the reporting workflows) to the organization's IP Allow List in ControlUp. This setting is accessible under Settings → Security → IP Allow List in the ControlUp management console. Once the calling system’s IP addresses are added to the allow list, API calls from those IPs will be authorized, provided a valid API token is also used.
For more detailed guidance, official ControlUp documentation and references include the API endpoint for managing IP allow lists (https://api.controlup.io/reference/orgipallowlistpubliccontroller_create) and the knowledge base article on IP Allow Lists (https://support.controlup.com/docs/ip-allow-list). These resources offer comprehensive instructions for configuring the IP Allow List to control API access securely.
Read the entire article here...
Read the entire article here...
Widget Wednesday #25: Building Dashboard Widgets with Audit Log Data
This week’s Widget Wednesday introduces a new data source for ControlUp Dashboards: the Audit Log.
Read the entire article here...
Read the entire article here...