How to do things in BE Hub.

Sign in to BE Hub

Username and password, or Google / Microsoft if the hub has those turned on.

Read the dashboard

One screen: who is online, what needs attention, open alerts, BE AI spend.

Change the dashboard chart range

Fleet over time is the last day, the last week, or the last month. The highlighted button is the range on screen.

See which disks are filling up

The dashboard lists disks that will be full within 90 days at the rate of the last week.

Install the agent on a machine

One line per platform. It downloads the signed agent, installs the service, and connects.

Hand someone the install page

A page they can open without signing in. The one-liner in the console is a different address.

Install by hand when the one-liner cannot run

Windows and Linux list the same three steps the script would have done.

Install the agent on a firewall or a router

OPNsense and pfSense, Teltonika and OpenWrt, and VyOS. Each is one line, run as root.

Change how often a machine reports

The install line can ask for a heartbeat shorter than five minutes. Graphs update sooner. The machine sends more.

Re-point a machine that is already installed

Tick Apply. The same one-liner rewrites the agent's configuration and keeps its machine id.

Turn on a remote shell at install

Tick Remote shell before you copy the line. The hub cannot switch it on afterwards.

Turn on a shell for proxied devices

Tick the proxy shell before you copy the line. It is the proxy's own switch, and the hub cannot set it later.

Find a machine and open it

Fleet is every machine in the company. Open one to see health, checks, files, patches.

Search the fleet

The find box matches a name, a hostname, an address, a site, or a tag.

Choose how the fleet is drawn

List, cards, or exceptions. The same machines, three ways to read them.

Show the fleet as one list

By group folds machines under site and role. Flat list is every machine in one list. The choice stays in this browser.

Focus the fleet on one site

The site picker on the fleet list shows one site. Approvals follow. Clear puts every site back. The choice stays in this browser.

Show only machines that need attention

The Needs attention tick on the fleet list hides machines that are fine. Clear it to see the whole company again.

Show only machines that are online

The online tick on the fleet list keeps machines that are up and included in alerts.

Change how groups are drawn

On the list view, group headings can be light, bold, or blocks. The machines stay the same.

Open or close every fleet group

Site headings start closed. Expand all opens them. Collapse all closes them again.

Find a critical machine

Critical sits at the top of Fleet. It is every machine with an open critical alert.

See a machine that is not in a group

A new machine with no tag sits in Onboarding at the top of Fleet until you give it a group.

Use BE Hub on a phone

Devices, Alerts, Inbox and More sit on a bottom bar. One screen at a time.

Work an open alert

Ack, discuss, resolve, or accept a condition that is known and fine.

See resolved alerts on the alerts page

Open + acked hides anything that already cleared. Resolved brings those rows back.

Acknowledge an alert

Ack means a person saw it. The alert stays open. A comment is optional.

Resolve an alert by hand

Resolve closes an alert when the hub has not noticed the condition cleared. A comment is optional.

Leave a comment on an alert

Ack, resolve and release ask for a comment. The row keeps the thread for the next person.

Accept a known condition

Disk always 92%? Say so. Alerts stay recorded; nobody is paged; BE AI stops proposing.

Accept a condition until a date

Until is a way back. On that date the alert re-opens, even if the disk never got worse.

Accept a disk until free space falls

A free-GB floor is a way back. The alert re-opens when free space drops under that number.

Release an accepted condition

Release puts a known condition back in the queue. Investigations and notifications resume.

Tell someone when a machine needs attention

Add a notification rule — who gets email, SMS, a call or a webhook when an alert opens.

Tell them when an alert clears

A rule can send a second message when the condition clears. That is on until you clear the box.

Turn an alert rule off

Off takes the rule out of the list. Alerts still open. Nobody is told by that rule until you turn it on.

Delete an alert rule

Delete removes the rule. The first press asks you to confirm. Alerts already open stay open.

Change an alert rule

Edit opens the same rule. Save changes keeps the row. Test sends one synthetic message and does not open an alert.

Send a test of an alert rule

Test sends one synthetic message to the rule's contacts. It does not open an alert on a machine.

Limit an alert rule to servers

Tick a machine type and the rule covers only those machines. Empty still means every type.

Limit an alert rule to workstations

Tick a machine type and the rule covers only those machines. Empty still means every type.

Limit an alert rule to laptops

Tick laptop. The rule covers only those machines. Empty still means every type.

Limit an alert rule to network devices

Tick network device. The rule covers only those machines. Empty still means every type.

Limit an alert rule to hypervisors

Tick hypervisor. The rule covers the host. A guest is a machine of its own type.

Limit an alert rule to printers

Tick printer. The rule covers only machines whose type is printer. Empty still means every type.

Limit an alert rule to type other

Tick other. The rule covers only machines whose type is other. Empty still means every type.

Limit an alert rule to one site

Tick a tag. The rule covers that tag and everything nested under it. A machine with no tag is left out.

Limit an alert rule to one role

Tick a role tag. The rule covers that path and everything nested under it. A machine with no tag is left out.

Limit an alert rule to servers in one role

A type and a tag combine. The machine has to be both. Two types, with no tag, means either type.

Only tell them about disk alerts

Tick disk on a rule and the other kinds stay quiet. Empty still means every kind.

Only tell them about downtime

Tick downtime on a rule and disk, checks, and the other kinds stay quiet.

Only tell them when the network path changes

Tick network path on a rule. A new external IP or a WAN failover is the message. The other kinds stay quiet.

Only tell them about a Docker app

Tick Docker app on a rule. An unhealthy or restarting app is the message. The other kinds stay quiet.

Only tell them about a failing check

Tick checks on a rule. A check that fails is the message. The other kinds stay quiet.

Only tell them about a reboot

Tick reboots on a rule. A machine that restarted is the message. The other kinds stay quiet.

Also tell them about a notice

The floor starts at warning and above. Info and above includes a notice, such as a routine reboot.

Only tell them about a custom metric

Tick custom metric on a rule. A post that goes down, or a missed post, is the message. The other kinds stay quiet.

Send an alert to Slack or Teams

A webhook contact posts the alert as JSON to Slack, Teams, Discord, PagerDuty, or your own URL.

Send an alert as your own JSON

Custom format is a webhook contact whose body you write. Placeholders fill in the alert, the machine and the link.

Text or call when an alert opens

The same rule as email, with the channel set to SMS or a phone call.

See what an alert sent

Alerts › sent is every delivery: email, SMS, a call, or a webhook. Empty means nobody has been told yet.

Run a script when an alert opens

A trigger starts a saved script when an alert is announced — on that machine, or on a different one.

Run a script on the machine that raised the alert

Run on can be the machine that alerted, instead of a list you tick. Whoever matches is the target.

Run a script on every machine in a role

Run on can be a tag. Every machine with that path, or nested under it, is a target.

Run a script only when one machine alerts

When starts as any matching machine. Pick one name and only that machine's alerts can start the script.

Run a script only when a disk fills

Kinds start on downtime. Tick disk and clear downtime, and a full disk is the only alert that starts the script.

Run a script only when a check fails

Kinds start on downtime. Tick checks and clear downtime, and a failed check is the only alert that starts the script.

Run a script only when a machine restarts

Kinds start on downtime. Tick reboots and clear downtime, and a restart is the only alert that starts the script.

Run a script only when the network path changes

Kinds start on downtime. Tick network path and clear downtime, and a new external address or a WAN failover is the only alert that starts the script.

Run a script only when a Docker app is unhealthy

Kinds start on downtime. Tick Docker apps and clear downtime, and an unhealthy or restarting app is the only alert that starts the script.

Run a script only when a custom metric goes down

Kinds start on downtime. Tick custom metric and clear downtime, and a post that goes down, or a missed post, is the only alert that starts the script.

Run a script only when a machine goes offline

Downtime starts ticked. Clear every other kind, and a machine that stops reporting is the only alert that starts the script.

Run a script for one disk only

A key is one alert. disk:/ is the root volume. An empty key still means every disk of the kinds you ticked.

Wait before an alert script runs again

Cooldown starts at 900 seconds. The same alert on the same machine cannot start the script again until that wait is over.

Fill a script answer from the alert

A question on the script is answered on the trigger. Type it once, or copy a fact from the alert. The shape is checked before anything runs.

Only run a script for a critical alert

The floor starts at warn and above. Crit and above skips a warning. Info and above includes a notice.

Also run a script when the alert clears

Events start on opened. Tick resolved as well, and the script starts again when the condition clears.

Run a script only when the alert clears

Opened starts ticked. Clear it and tick resolved, and the script starts when the condition clears, not when it opens.

Also run a script when the alert gets worse

Events start on opened. Tick escalated as well, and a warning that becomes critical starts the script again.

Run a script only when the alert gets worse

Opened starts ticked. Clear it and tick escalated, and a warning that becomes critical is the only event that starts the script.

Turn an alert script off

Enabled starts ticked. Clear it and save, and the row stays, marked off. It does not run.

Change a script that runs when an alert opens

Edit opens the same trigger. Save keeps the row. The first press does not ask you to confirm.

Remove a script that runs when an alert opens

Delete removes the trigger. The first press asks you to confirm. Alerts already open stay open.

Add a disk or ping check

A check is a named test the agent runs on a schedule. Failures become alerts.

Choose how often a check runs, and how serious it is

Interval is 1m to 24h. Severity is info, warn, or crit, and that becomes the alert's severity.

Push checks to the agent

The list on screen is a draft. Push replaces the whole document on the machine, and it asks you to confirm.

Remove a check

Take it off the list, then push. Push sends the whole document, so a removed check stops being evaluated.

Check that a host answers a ping

A ping check fails when the host is silent or too slow. The same host is charted on every heartbeat.

Check that a URL answers

A simple HTTP GET. One address, a time limit, and one status code.

Check that a virtual machine is running

On a Proxmox or ESXi host, a guest you name fails the check when it is off.

Alert when a guest is stopped

A stopped guest stays quiet until you press alert on this. That writes a VM running check.

Check that a Docker app is running

A Coolify or Compose app you name fails the check when it is not running, or not healthy.

Check that a backup file is recent

A file-age check fails when the backup has not been written within the time you set.

Check that a file is large enough

A size check fails when the file is missing or smaller than the number of bytes you set.

Check a Windows registry value

A registry check fails when that key or value is missing, or when the value is not the one you named.

Only check during working hours

A time window wraps another check. Outside those hours the check does not fail.

Require every part of a check

all fails when any part fails. any fails only when every part fails. not flips one check.

Check that a service is running

A service check fails when that Windows service or Linux unit is not running.

Check that a process is running

A process check fails when that name is missing, or when fewer copies are running than you asked for.

Check that a file or folder exists

A path check fails when that file or folder is missing.

Check that a name resolves

A DNS check fails when this machine cannot resolve the name, or when it resolves to the wrong address.

Check that a share or port answers

A TCP check fails when this machine cannot open that host and port.

Check that a port is listening

A listening-port check fails when this machine is not accepting connections on that port.

Check that a printer is installed

A printer check fails when that printer is not installed on the Windows machine.

Check that a drive is mapped

A mapped-drive check fails when that letter is missing for the signed-in user, or when it points at the wrong share.

Check that someone is signed in

A sign-in check fails when nobody is at the machine, or when a named person is not.

Check that an app answers

An HTTP check on a URL. A failure becomes an alert, the same way a full disk does.

Check the Wi-Fi network

A Windows laptop can fail a check when it is on the wrong SSID, or when the signal is too weak.

Check that the Wi-Fi signal is strong enough

A Windows laptop can fail a check when the signal drops under a dBm floor.

Add a custom metric

A URL a command on the machine POSTs to. A speedtest reports a number back; the fleet shows it.

Add a yes or no custom metric

A command POSTs true or false. Yes means up, or down. No is the other state. There is no threshold row.

Change or remove a custom metric

Edit opens the same window. Rotate URL makes the old one answer 404. Remove deletes the metric.

Remove a custom metric

Remove asks you to confirm. The second press deletes the metric and the history the hub stored for it.

Read a machine overview

CPU, memory, disk, checks, patches, and whatever currently needs attention.

See which process is busiest

The overview names the top processes by CPU and by memory from the last heartbeat.

Name a machine and put it in a group

Display name, machine type, notes for BE AI, tags, site/role groups, and whether AI or alerts run here.

Change what kind of machine this is

Type is server, workstation, laptop, network device, hypervisor, printer, or other. Save keeps yours. This shot does not save.

Mark a machine VIP

A tag is a plain word, such as vip. An alert rule can require that word and a type together. This shot does not save.

Give a machine a display name

The name people see in the fleet. The hostname stays what the machine reported. This shot does not save.

Put a machine in a site

Pick a group such as site/Melbourne. The fleet, alert rules and roll-outs match that path. This shot does not save.

Put a machine in a role

Pick a group such as role/DC. Alert rules and roll-outs on that path then cover the machine. This shot does not save.

Tell BE AI about this machine

Notes on the machine are trusted instructions. BE AI reads them on the next run.

Leave a desktop out of offline alerts

A PC that shuts down at night still reports. It does not page anyone for being off.

Set a time when a machine reboots

A reboot inside its window is planned. No critical offline alert unless the machine is still down when the window ends.

Let the hub learn when a machine reboots

Three reboots at about the same time switch a window on by itself. Every reboot and every learned window stays in the history.

Ignore a drive that is full on purpose

A backup volume that is always nearly full. No disk alert for it, BE AI leaves it alone, and it is left out of disk max.

Take a machine out of every alert

Clear included in alerts. It still reports. Nothing is opened, emailed, or investigated.

Leave a machine out of BE AI

Questions, alert investigations and the nightly pass skip a machine you exclude. It still reports.

Skip the nightly pass on one machine

Leave the machine in BE AI, and turn off the daily pass, or turn off automatic investigations.

Stop automatic investigations on one machine

An open alert no longer starts a run on its own. Discuss and the nightly pass stay.

Write an internal note

A notepad on every screen. It remembers the machine you had open. BE AI does not read it unless you share it.

Find an internal note

The search box matches the title and the text of notes you can see. It does not hand them to BE AI.

Show notes for this machine

Here keeps the notes attached to the machine on screen and hides the rest. Untick it and the company list comes back.

Keep a note to yourself

Private to me hides the note from the rest of the company. It does not by itself give the text to BE AI.

Share a note with BE AI

The notepad is for people. Share copies one note into the machine's notes for BE AI, which the model does read.

Empty temp files when a disk fills

Per machine: leave temp alone, propose emptying it, or delete it when the score is confident.

See Docker apps on a machine

Coolify and Compose apps, named from labels. An unhealthy app is not an alert until you select it.

Restart or stop a Docker app

On a connected Docker host, restart, stop, and logs sit on the app row. Restart and stop ask you to confirm.

Read a Docker app's logs

Logs on a connected host asks the agent for the recent lines. They open under the list.

Stop a Docker app

Stop on a running app asks you to confirm, then tells the agent to stop that container.

Start a stopped Docker app

Start is the button on an app that is not running. It asks you to confirm, then tells the agent to start it.

See how a machine is connected

LAN address, router, DNS, external IP, and the neighbour table from this box.

Read traffic on each interface

Network lists receive, transmit, errors and drops per interface since the last heartbeat.

See when the external address changed

The external IP tile says since when this address has been current, and what it was before.

Read devices found on the LAN

A snapshot of this machine's subnet. Nothing here enrols a device.

Show only new devices on the LAN

The status menu hides every other row. The snapshot still remembers them.

Find a device on the LAN

The find box matches an address, a MAC, a hostname, or a vendor. Press enter. The other rows stay remembered.

Turn on the weekly LAN scan

Sundays at 02:00 Melbourne, on this machine's subnet. A device missing two weeks in a row is marked gone.

Probe the LAN instead of only listening

Tick active probe. The next scan you start pings each address and checks a short list of ports.

Ignore a device on the LAN

A printer or phone that keeps showing up as new can leave the suggestions. It stays in the snapshot.

Stop ignoring a device on the LAN

Stop ignoring puts the row back under suggested monitors. The device was still in the snapshot.

Add a ping check for a device on the LAN

Suggested monitors can add a ping check for an address that is not enrolled. The first press only asks you to confirm.

Copy the install line for a device on the LAN

Copy install puts this company's Linux one-liner on the clipboard. Nothing is enrolled, and the line is not shown on the page.

Watch a device that cannot run the agent

A firewall, switch, NAS or ESXi host is polled over SSH by a machine that does run the agent.

Link a virtual machine to its host

On a Proxmox or ESXi host, tie each guest to the enrolled machine that is that VM.

Tie a guest from its own page

On the guest, Work › actions › identity names the hypervisor and the vmid. Save stores the link.

Open a Proxmox guest's screen

Console on a running QEMU guest opens the same window as Control, through the host.

Start or shut down a linked virtual machine

When a guest is tied to its host, start, shut down, and force off go through the hypervisor.

Start or shut down a guest from the host

On the hypervisor's VMs tab, start and shut down sit on the guest row. Each one asks you to confirm.

Read a Wi-Fi machine

SSID, signal, a 24-hour score, roams and drops. Windows laptops first.

Read backup mobile on a router

Signal, operator and which uplink is carrying traffic, from the router's last heartbeat.

Ask BE AI about a machine

Discuss is a thread. BE AI looks, then proposes. You approve. It never runs a mutating tool on its own.

Start from a prepared question

The shortcuts under the composer fill the box. They do not send.

Ask BE AI about a group

One conversation for a site, a tag, or everyone in the company. It proposes. You approve.

Ask BE AI about one site

Discuss on a group row is that group only. The company header is everyone in view.

Ask BE AI about the machines in a report

Discuss on the report bar opens one conversation for that set. It proposes. You approve.

Approve or reject a proposal

BE AI files the exact command. A named person approves. The audit trail keeps both.

Retry a proposal that failed

Retry is on a row that never ran. The first press asks you to confirm. The second press runs it again.

Diagnose a command that failed

When a command ran and exited with an error, the card says diagnose the failure. That press sends the question.

Show only failed proposals

The status menu keeps failed, or executed, and hides the rest. Nothing runs.

Group the approval queue

Group by machine, tag, company, status, or the action. The rows do not change, and nothing runs.

Group proposals by a site

Group by tag lists a machine under every group it belongs to. The rows are the same, and nothing runs.

Group proposals by the action

Action type puts every run_shell under one heading. The rows stay, and nothing runs.

Collapse or expand the approval queue

Collapse all hides the rows and leaves the heading. Expand all opens them. Nothing is approved.

Reject every waiting proposal

On Proposals, reject all clears every proposal still waiting on that machine. The first press only asks you to confirm.

Read approvals beside the machine

Inbox opens the waiting proposals for the machine you have open. Approve still runs the command.

Show only waiting approvals

The menu on the approvals rail hides cards that already ran or failed. Nothing is approved.

See what BE AI already did

Every investigation is a run: who asked, which machine, tokens, the conclusion.

Read one BE AI investigation

Click a run. The conclusion, the next step, and the proposals open under the list.

Show BE AI runs for one machine

The machine menu keeps that machine's investigations and hides the rest. Nothing is re-run.

Search BE AI runs

The search box looks through the question, the result, and the machine. It only hides rows.

Show BE AI runs from a recent window

All time, the last day, the last week, or the last month. The menu only hides rows.

Review and approve missing updates

Inventory, approve, schedule a job. Approving installs nothing by itself.

See updates from one source

The source menu keeps Windows Update, or winget, and hides the rest. Search matches the title or the KB.

Search the update list

Type a name, a KB, or an id. Rows that do not match drop out. Nothing is approved.

See updates you already approved

The status menu hides awaiting rows and keeps approved ones. Nothing is installed.

Decline an update you will not install

A declined update stays off every job. Approving and declining install nothing by themselves.

Put an update back to awaiting review

Back to review clears an approve or a decline. The update is in the queue again. Nothing is installed.

Approve every security update

One button approves every critical, important and security update still awaiting in the list. It does not install them.

Schedule a patch install

A job installs only what a person already approved, on the machines you pick, inside a window.

Install updates at a chosen time

When is now, or a time. A time waits. Now starts as soon as you confirm.

Leave the machine running after updates

Restart is if an update needs it, never, or always. Never leaves a needed restart pending.

Install updates on one machine

Machines is every machine in view, one group, or one machine. One machine leaves the others out.

Install updates on one site

Machines can be a group, not only one box. The path covers that site and anything nested under it.

Choose how long a patch job keeps trying

Four hours is the start. A day covers a machine that is off overnight. Three days is the longest.

Schedule only the updates you ticked

Schedule selected opens a job for those rows. It installs them even when they are still awaiting review.

Cancel a scheduled patch job

A job that is still waiting can be cancelled. The first press asks you to confirm.

See missing updates on one machine

Work › patches is this machine's inventory. Approve here. Installing still waits for a job.

Install the approved updates on this machine

On a connected machine, install approved opens a job for that box only. It does not schedule it.

Ask about one missing update

Ask on a row fills a question about that update. It does not send, and it does not approve.

Ask which updates to approve first

Discuss on Patches › updates fills a company-wide question. It does not send, and it does not approve.

See which machines are missing updates

Patches › machines is one row per machine. Missing… opens that machine's inventory under the table.

Push an agent update

Pick a signed release and who should get it. The agent checks the signature and swaps itself.

See which address a machine connects through

Updates lists the hostname each machine last reported. Re-point moves online machines that are still on an old name.

Run a saved script

A script is text with {{variables}}. Run renders it per machine and sends it as an approved command.

Stop a script that is still running

Scripts › runs. Stop is on a row that is still going. The first press asks you to confirm. The second press stops it.

Show script runs that have finished

The status menu hides runs that are still going, or keeps only those. The runs themselves stay.

Search script runs

The search box looks through the script, the machine, who ran it, and any output. It only hides rows.

Answer what a script asks

A {{name}} in the command is a question at run time. You type it. The preview shows the command before anything is sent.

Say what a blank in a script may contain

Each {{name}} has a shape. A value outside that shape is refused before the command is sent.

Keep a script answer off the record

Tick secret on a question. The run history and the audit store bullets. The machine receives the real answer.

Let a script question be left blank

Clear required. The yellow schedule warning goes away. A night run can leave that blank empty.

Fill a script blank from the machine

Set the source to from the machine. The hub puts the hostname, the LAN address, or a group into the command.

Always send the same value in a script

Set the source to fixed and type the value. Every run uses it. Nobody is asked.

See which scripts this machine needs

The scripts tab names a few that match what this machine is reporting, and says why.

Find a script by what it is for

The library is grouped. The kind menu and the operating-system menu hide the rest.

Show scripts for one operating system

The operating-system menu hides the other shells. A script marked any OS stays in the list.

Search the script library

The search box looks through the name, the description, the tags, and the command. It only hides rows.

Tag a script so you can find it

Tags are words on the script, comma separated. The library search looks through them. They are not a machine group.

Add a script to the library

Company admins write the text. Operators run it. A variable is filled in per machine, and it cannot become a second command.

Let a script keep running for hours

Give it up to is minutes. Two is the start. Twelve hours is the longest. Closing the page does not stop it.

Keep a script on one machine

Belongs to can be the company, or only one machine. The others do not list it.

Change a script in the library

Edit opens the saved script. Save changes keeps the same row. A run that is already going is not rewritten.

Copy a script

Copy opens a new script from a library row. The original stays. It is not in the library until you press add to library.

Remove a script from the library

Delete takes the script out of the library. The first press asks you to confirm. A run that is already going is a different button.

Save a proposal as a script

A run_shell proposal becomes a library entry, so the next person does not retype the command.

Ask BE AI what a script does

Ask fills a question about that script on this machine. Send is still yours.

Ask what a script run did

Ask on a run fills a question about that run. Send is still yours. The printed output stays untrusted.

Run a script on a schedule

A time and the days. It runs on machines that are online then. An offline machine is skipped.

Run a script on weekdays

Tick the schedule, then clear Saturday and Sunday. A machine that is offline at that minute is skipped.

Run a script in another timezone

The timezone box copies this console's clock. Replace it and 02:00 means 02:00 there. This shot does not save.

Choose scripts for a new machine

When a machine first comes online, a rule can prompt someone to run a script, or start it itself. Match the operating system and the machine type.

Build a report of the fleet

Saved views of disks, patches, approvals, online — filtered by type, tag or company.

Save a report you will open again

The name keeps the template and the filters. Machines still enter and leave.

Delete a saved report

Delete takes the name off the Reports menu. The first press asks you to confirm. The machines stay.

Update a saved report

Change the filters, then update saved. The name stays. The machines still enter and leave.

Read the morning brief

Offline, disk, failing checks, open alerts and waiting approvals, worst first.

Limit a report to servers

Tick a type. The report covers only those machines. Empty still means every type.

Limit a report to laptops

Tick laptop. The report covers only those machines. Empty still means every type.

Limit a report to workstations

Tick workstation. The report covers only those machines. Empty still means every type.

Limit a report to network devices

Tick network device. The report covers only those machines. Empty still means every type.

Limit a report to hypervisors

Tick hypervisor. The report covers only those machines. A guest is not a hypervisor.

Limit a report to printers

Tick printer. The report covers only those machines. A company with none enrolled shows an empty set.

Limit a report to machines of type other

Tick other. The report covers only those machines. A company with none shows an empty set.

Limit a report to one site

Type a tag. The report covers machines with that tag. All of these means every tag you added.

See how long an approval has waited

Proposed and running actions, oldest first. This page does not approve them.

Show approvals filed in the last day

Everything waiting is the whole queue. Last 24 hours hides actions filed before that.

Read the alert journal

What fired, what cleared, and what was accepted as known.

See alerts that already cleared

Open now hides resolved alerts. Pick a period and the ones that cleared in that window come back.

See what the patch window is missing

Missing updates, what is approved, and which machines still need a restart. It does not install anything.

See which machines have a shell

Shell on, shell off, not reported yet, and which machines poll other devices.

Open a shell on a Linux machine

Terminal is on the header of an online Linux or FreeBSD machine. It opens a window, not a modal.

Watch or take control of a screen

On an online Windows machine: one click. A second window holds the keyboard. Sessions are recorded.

Read the event stream

Reboots, disk-high, check failed, WAN change, Wi-Fi drop — one line each.

Show only one kind of event

The Events page is the whole company. Pick a name, then Apply. The other kinds stay stored.

Read one machine's events

History › events is this machine only: disk, reboot, address change, check failed.

Show only warnings on one machine

History › events can hide info lines. The warning rows stay. Nothing is deleted.

Search one machine's events

The summary box keeps lines whose name or summary contains the word. The other lines stay stored.

Show one machine's events from the last day

Last 24 hours hides lines older than a day. They stay stored. Last 7 days brings them back.

See who opened this machine

History › audit is the trail for this machine: who opened it, who approved, who ran a command.

Search one machine's audit lines

The box on History › audit looks through the kind, who did it, and the summary. It only hides rows.

Read a machine's trends

CPU, memory, disk and network over the last day, week or month. Past a day the chart is hourly.

Read the last heartbeats

Work › samples is the recent heartbeats as a table. Newest first.

Download a machine's history

A CSV of the heartbeats the hub still has, or of one check's series.

Search the audit trail

Who called which tool, who approved, who opened a machine, who was refused.

Show when someone opened a machine

The kind menu keeps one sort of record. Opening a machine stays. Leaving it drops out. Nothing is deleted.

Limit the audit trail to one machine

The machine menu reloads the list for that machine only. Other lines stay stored.

Find an audit line by a word

The search box looks through the kind, the machine, who did it, and the summary. It only hides rows.

Show one person's audit lines

The user menu reloads the list for that person only. Other lines stay stored.

Add a company for a customer

The organisation's owner creates a company. It gets its own install link, alert rules and machines.

Company notes, schedule and remote control

Notes for BE AI, the nightly pass, the install link, and whether Control is on.

Turn remote control off

The company select is on by default. Set it to off and Control and Watch disappear from every machine.

Tell BE AI about the whole company

Notes on My company apply to every machine. BE AI reads them as technician instructions.

Run the nightly BE AI pass now

The same daily review, started by hand. It still skips a machine that is offline, excluded, or already looked at.

Change when the nightly pass runs

The clock and the days are on the company card. They are saved only when you press save schedule.

Run the nightly pass in another timezone

02:00 is that timezone's clock. The browser's clock does not move it.

Turn off the nightly pass

Clear On and press save schedule. The clock stops for the whole company. Run pass now still starts it by hand.

Rotate the install link

A new link for new machines. Machines already enrolled keep reporting on the old token.

Invite a teammate

A named seat. Email as username sends an invitation; they set their own password.

Invite someone as a company admin

The role menu on Settings › users. Company admin manages users and the install link. Operator only works the machines.

Send the invitation again

A new seven-day link. The previous link stops working.

Issue a temporary password

Someone forgot the password. You issue a new one from their row. It is shown once, and they must change it.

Change your password

Settings › account. The browser you are using stays signed in. Your other browsers are signed out.

Sign out one browser

Sessions lists each signed-in browser. Revoke signs that one out. The others stay.

Sign out of this browser

Sign out on the account card or in the header. This browser only. Other browsers stay signed in.

Disable a person's sign-in

A disabled person cannot sign in. Their sessions drop. The seat stays in the table so you can enable them again.

Replace a script key

An API key is for scripts. It is not the password they type to sign in. A new key is shown once.

Connect an AI agent to BE Hub (MCP)

Claude, an assistant or your own automation can read the fleet and work alerts through BE Hub's MCP address, with a user's API key.

Require an authenticator for a person

Company admins can require 2FA on one account. The QR stays on their own screen.

Reset a lost authenticator

Clears the authenticator on someone else's account. They enrol again at the next sign-in. Their sessions are signed out.

Let a customer manage their computers

A login for their people, limited to the groups you pick. The machines stay enrolled in your company.

Narrow the machines a customer can see

Open manage and tick a smaller group. Save writes it. Until then the login still has the groups it had.

Rename a customer login

The name is what they see after sign-in. Save name writes it. Until then the header still shows the old one.

Stop a customer asking BE AI

BE AI starts ticked on a new customer login. Clear it and they can view their machines without asking BE AI.

Let a customer open a shell

Tick shell on their login. It stays off until you do. They still cannot delete, clean a disk, or remove a machine.

Let a customer open Patches

Tick patches on their login. It stays off until you do. They see the inventory for the machines in their groups. Approving an update and scheduling a job stay with you.

Let a customer take the screen

Tick remote control on their login. It stays off until you do. They still need the company switch on, which it is by default.

Change what a customer can do

On a login that already exists, tick shell, patches or remote control, then save. Until you save, the old ticks stay.

Disable a customer's login

Their people cannot sign in. The machines stay in your company. Enable brings the same login back.

Turn a customer's login back on

After disable login is confirmed, the same button reads enable login. One more press arms it. The second press is what lets them sign in again.

Remove a customer login

The login goes. Their people are disabled. The machines stay enrolled in your company.

Disable one person on a customer login

Invite them on the customer, then disable that row. The login and the other people stay.

Give a customer their own install link

Optional. Machines they install stay in your company and join the group you pick.

Choose the group a customer's new machines join

The menu under Own install link is the tag a new machine gets. The ticks above are which machines they can already open.

Rotate a customer's install link

A new URL for new machines. Machines already installed from the old one keep reporting.

Turn off a customer's install link

Untick it and save. New installs stop. Machines already enrolled keep reporting.

See the computers you were given

After you sign in, the strip names your login and the machines in your groups. The rest of the company stays with your provider.

Find one of your machines

The find box matches a name, a hostname, an address, a site, or a tag. Machines outside your groups are not in the list to begin with.

Show only your machines that need attention

The Needs attention tick hides machines that are fine. Clear it to see every computer you were given.

Show only your machines that are online

The online tick keeps machines that are up. Clear it to see every computer you were given, including the ones that are off.

Show your machines as one list

By group folds your machines under site, role, and type. Flat list is the same three machines in one list. The choice stays in this browser.

Choose cards or exceptions for your machines

List, cards, or exceptions. The same three computers, three ways to read them. The choice stays in this browser.

Focus your list on one site

The site picker keeps one site. Clear puts every site you can see back. The choice stays in this browser.

Copy your install link

The URL on the strip enrols a machine into your group. It stays in the company that invited you.

Inventory updates on your machines

Patches lists what your machines are missing. Approving an update and scheduling the install stay with your provider.

Ask your machines to report updates again

Scan my machines asks the agents that are online to inventory again. It does not install anything.

Read missing updates on your machine

Work › patches is this machine's inventory. Approving an update and scheduling the install stay with your provider.

Ask about one update on your machine

Ask on a row fills a question about that update. It does not send, and it does not approve.

A proposal you cannot run

A shell command waits on one of your machines. Shell is off for this login, so there is no approve button. Reject drops this copy only.

Reject every waiting proposal on your machines

Reject all clears every proposal still waiting on that machine. The first press only asks you to confirm. Nothing runs.

Show only the proposals that failed on your machines

The status menu keeps failed, or executed, and hides the rest. Nothing runs. There is no retry on this login.

Read the inbox on your machine

Inbox opens the proposals for the machine you have open. A command this login cannot run has reject and no approve.

Show only what is still waiting

The menu on the approvals rail hides cards that already ran or failed. Nothing is rejected.

See alerts on your machines

Alerts lists problems on the computers you were given. Rules, who was told, and accepting a known condition stay with your provider.

See resolved alerts on your machines

Open + acked hides an alert that already cleared. Resolved brings it back. Who was told stays with your provider.

Acknowledge an alert on your machines

Ack means you saw it. The alert stays open. Accept is not on this login.

Resolve an alert on your machines

Resolve closes an alert when the hub has not noticed the condition cleared. Accept is not on this login.

Leave a comment on your alert

Comment adds a note and leaves the alert open. Ack and resolve use the same box, and those comments are optional.

Your own settings

Settings is your sign-in: timezone, password, and this browser. The users table stays with your provider.

Read your dashboard

Dashboard counts the computers you were given: who is offline, what needs attention, and the one alert that is open.

Open one of your machines

The machine page you get is health, work, and history. Control, files, storage, and the actions tab stay with your provider.

Read the wireless tab on your laptop

A laptop whose last heartbeat includes a wireless network gets a network workspace. The recorder itself waits until the machine is online.

Read checks on your machine

Health › checks lists what your provider asked this machine to watch. You can read the results. You cannot add or push a check.

Read custom metrics on your machine

Health › custom metrics shows the URL a command on the machine posts to. You can copy it. You cannot create, edit, rotate, or remove one.

Read trends on your machine

History › trends is CPU, memory, disk, and network for one of your machines. Past a day the chart is hourly.

Read heartbeats on your machine

Work › samples is the recent heartbeats as a table. Newest first. You can export them. You cannot change the machine from here.

Read events on your machines

Events is the record for the computers you were given. Audit is not in this nav.

Show only one kind of event on your machines

The name menu on Events does nothing until you press apply. The other kinds stay stored.

Read events on one of your machines

History › events is this machine only. The company Events page is every computer you were given.

Show only warnings on one of your machines

The severity menu on one machine hides info lines. The warning rows stay. Nothing is deleted.

Show one of your machines' events from the last day

Last 24 hours hides lines older than a day. They stay stored. Last 7 days brings them back.

Search events on one of your machines

The summary box keeps lines whose name or summary contains the word. The other lines stay stored.

See BE AI runs on your machines

BE AI runs lists investigations on the computers you were given. The month's totals and the token cost stay with your provider.

Search BE AI runs on your machines

The search box looks through the question, the result, and the machine. It only hides rows. It does not start an investigation.

Show BE AI runs for one of your machines

The machine menu keeps that machine's investigations and hides the rest. It does not start a run.

Show BE AI runs from a recent window

All time, the last day, the last week, or the last month. The menu only hides rows. It does not start a run.

Read one BE AI investigation on your machines

Click a run. The conclusion and the proposals open under the list. Opening it does not approve anything.

Ask BE AI about your machine

Discuss opens a thread on this machine. Send starts the investigation. A command this login cannot run comes back with reject and no approve.

Read seats and this month's BE AI

People are seats. An investigation that reached the model is a run. Machines are neither.

Read an earlier month

The month menu is UTC. Seats stay as they are today. The investigation tiles follow the month you pick.

Remove a machine from the fleet

A company admin decommissions it. Online, the agent uninstalls itself. Offline, it uninstalls the next time it calls home.

Show times in another timezone

Settings › display. Every clock on this console follows it, including BE AI's answers. This browser only.

Your account, timezone and sessions

How timestamps look, change password, authenticator, sign this browser out.