How to know all Harmony Endpoint online users

khineminn

Hello All,

I am new to Harmony Endpoint and have a question. In the Infinity dashboard, the status shows as 'Active,' even though the last connection was on March 4, 2025, at 11:32. What does this mean? Also, how can I filter all currently online users?

I have also attached the screenshot. Thanks in advance.

Don_Paterson

I don't see an attachment, but you can try this:

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Endpoint-Admin-Guide/...

the_rock

I also believe what @Don_Paterson sent is the right way. Btw, as he said, we cant see anything attached.

Andy

khineminn

Hello @the_rock , although the last connection was on March 4, 2025, at 10:09 (correct), the status shows "Active" (already shutdown the PC).

According to the Harmony Endpoint EPMaaS Administration Guide which @Don_Paterson mentioned, it's as below.

Active

Active computers. Computers that have communicated with Harmony Endpoint in the last 30 days.

So, I would like to know how I can check/filter all currently online users? Possible?

the_rock

Let me log into cloud portal for one of our customers and will see shortly what it shows.

Andy

the_rock

I just checked and where it says "add", you can add multiple filters for search.

Andy

Don_Paterson

When a PC is shut down or in flight mode (for example) then the Harmony Endpoint client does not send in the heart beats to the management platform (every 60 seconds by default). After a few missed heart beats the PC is declared disconnected (assumed to be disconnected/offline/not connected to the internet or network with access to the Harmony management platform).

Last connection normally shows the machines last heartbeat time, within a few minutes.

The attached shows the Endpoint view (in the Harmony GUI on the endpoint).

What is your objective?
Maybe a Push operation can help you. Just don't do a Diagnostics push operation, that will slow the machine down for a few minutes at least.

khineminn

@Don_Paterson My objective is quite simple that how many clients are online (connected to Infinity) and how many offline (no internet/shutdown/etc..).

the_rock

@khineminn Just to make sure we are all on the same page here, so we can hopefully provide the right/satisfactory answer. Are you saying you do NOT really care how many users show active or when they were connected, you just want to see how many are online/offline?

Andy

khineminn

@the_rock Yes, I just want to see how many are online/offline.

the_rock

I even asked AI copilot about it, but appears answer it gave is for on prem server, not the cloud, though I did specifically asked about cloud portal. I see there are 3 horizontal lines on the left, when you go to asset management -> computers, but even if you click on that, does not give online or offline option.

Maybe someone from CP can verify this.

Andy

the_rock

@khineminn

This is what AI copilot gave, but I dont sadly have on prem endpoint to confirm, but you definitely cant see below in the cloud portal.

Andy

*******************

To determine how many users are online or offline in the Harmony Endpoint Portal, you can follow these steps:

Access the Harmony Endpoint Portal:
- Log in to your Harmony Endpoint Portal.
Navigate to the Users Section:
- Go to the "Users and Computers" tab.
View User Status:
- In the "Users and Computers" tab, you can see the list of users and their statuses.
- Users are typically categorized into groups such as "Online" and "Offline".
Filter or Search for Specific Users:
- You can use the search or filter options to find specific users or to filter by their status (e.g., online or offline).
Check User Details:
- Click on a user to view more detailed information about their status, including their last seen time and other relevant details.

By following these steps, you should be able to see the number of users who are currently online or offline in the Harmony Endpoint Portal. If you need more detailed instructions or encounter any issues, you can refer to the Harmony Endpoint Server Administration Guide or contact Check Point support for further assistance.

Learn more:

the_rock

I asked one of my colleagues, who is really good with harmony endpoint and he said best way would be to actually filter by last connection column and if you see machine has not reached out in a bit, say few hours or so, it would be safe to assume its offline.

Thats his logical assumption, but personally, as much sense as that makes to me, I would still get an official answer from TAC or someone from CP on here.

Just my 2 cents.

Andy

Don_Paterson

It looks like you are looking for a feature that is not there. Check Point will be able to confirm.

@BarYassure Can you help us out here?

Andy's last suggestions looks good but you could set up a specific Filter on the Last Connection column and set the From and To to be the last half an hour (for example).
That should show Endpoints not connected in the last half an hour (or hour, or more depending on your time frames).

I have attached a couple of screenshots but you just need to hover the mouse over the Last Connection column to see the three dots that will give you the menu to create the filter.

I have found that the Last Connection time for online machines is usually 3 to 4 minutes behind the current time but if you refresh the view (circular arrow in the top right hand corner below the username) then it is only one minute behind the current time for currently online machines.

Otherwise just sorting the Last Connection column might be able to show you what you need.

I looked at setting up a Custom Dashboard but the only option I see is the Active/Inactive (Total endpoints), which is not useful in this case.

the_rock

You definitely tagged the right person, lets hope Bar can assist. Otherwise, I feel like it could be an RFE.

Andy

Don_Paterson

Yeah. 👍

I see that there is a Disconnected Agents alert (ENDPOINT SETTINGS > Alerts) but it is only triggered (by default) in these condition:

Trigger alert when the condition affects

% of devices

It seems a bit extreme but playing with the percentage could show the alert in the OVERVIEW section (Unified Dashboard).

The Alert is a clickable link that sets up a filter (in ASSET MANAGEMENT) with a blank From box and a To box with the current date and time minus 30 minutes.

the_rock

Well, if there was a way to see online and offline machines, like @khineminn wanted, it would be much easier. Now, its possible that "criteria", if you will, might be calculated a different way for endpoints, not sure.

Andy

Are you a member of CheckMates?

How to know all Harmony Endpoint online users