First Steps

Once you have logged in and enrolled at least one agent, this guide walks you through the TridentStack Control interface and the recommended steps to get your environment configured.

Your organization comes ready to go

When your organization is created, TridentStack Control sets it up with sensible defaults so you see results as soon as you enroll your first endpoint. Out of the box, your organization includes:

• Automatic endpoint tagging. Every newly enrolled device joins the "all-endpoints" tag immediately, and is also sorted into a platform tag (Windows workstations, Windows servers, Linux, or Mac) based on its detected operating system, with no setup required.
• A default system update policy that automatically approves operating system updates older than 7 days with no known issues, or any update older than 30 days regardless, then surfaces them for your review. On macOS it also approves recommended security updates automatically and never approves a major OS upgrade.
• Two default application update policies. One keeps more than 30 popular applications current if they are installed, and never installs an application that is not already present. The other holds a set of commonly-stale server and admin tools one release behind so a new release can settle before you adopt it; it is not applied to any endpoints until you choose to assign it.
• Three ready-to-attach deployment rings (Always Allowed, Wednesday Patching, and Workstation Daily Patching), each with its own maintenance window and phased rollout, so you can pick a rollout pace without building one from scratch.

Because of this, you do not need to create a policy, a tag, or a ring before you get value. As soon as you enroll an endpoint, applicable operating system and application updates begin appearing for it.

warning

The default policies surface and pre-approve updates for your review, but nothing installs automatically: none of the default rings are attached to a policy out of the box. To actually install updates on your endpoints, attach one of the ready-to-attach deployment rings to a policy, or create your own. This keeps you in control of when and how patches roll out.

What you see after login

After logging in, you land on the Dashboard. The default system dashboard provides a high-level view of your fleet: agent status, patch compliance, vulnerability counts, and recent activity. The system dashboard is read-only, but you can clone it or create your own custom dashboards where widgets can be freely added, removed, and rearranged. The dashboard system is highly modular, allowing you to build visualizations for essentially any data within the platform.

Navigation overview

The left sidebar is your primary way to move between sections. It is organized into these areas:

Section	Pages	Purpose
Dashboard	Dashboard	Fleet overview with customizable widgets
Agents	Endpoints, Tags, Tag Automation	Manage enrolled devices, organize them with tags, create automation rules
Update Management	System Updates, Application Updates, Deployment Rings	Create patch policies, manage third-party app updates, configure phased rollouts
Orchestration	Configuration Policies	Apply and enforce device configuration settings
Reporting	Vulnerabilities, Compliance, Query Builder, Templates	Review detected CVEs, measure endpoints against security baselines, and build custom reports

At the bottom of the sidebar:

Section	Purpose
System Audit	Activity logs and change tracking
Settings	Platform configuration, user management, API keys, agent installers

tip

The sidebar can be collapsed to icon-only mode by clicking the collapse button at the bottom. This gives you more screen space when working in detail views.

Recommended onboarding workflow

Because your organization arrives pre-configured, getting to a fully managed environment is mostly a matter of enrolling endpoints and deciding how you want updates to roll out:

The default update policies and automatic tagging are already in place, so enrolled devices are covered immediately. The one action that actually installs updates is attaching a deployment ring to a policy. From there, you can refine targeting with your own tags and add compliance baselines as your needs grow.

How targeting works

Understanding the relationship between agents, tags, and policies is key to managing your fleet effectively.

The hierarchy works like this:

• Tags are the only thing directly associated with an agent. You do not assign policies to individual endpoints. Instead, you assign tags to agents and then target policies at those tags.
• All policies target tags. System update policies, application update policies, configuration policies, and compliance baselines are all associated with tags, not individual agents. When you add or remove an agent from a tag, it automatically gains or loses every policy targeting that tag.
• Deployment rings are associated with update policies, not tags or agents. Both system update policies and application update policies can use deployment rings. Rings control the rollout pace of a specific policy and determine what percentage of the targeted agents receive updates at each stage.

note

Linux updates are managed exclusively through system update policies. Application update policies apply to Windows and macOS endpoints.

info

This design means you manage your fleet by organizing agents into the right tags. Once your tags are set up, adding a new endpoint is as simple as assigning its tags - all relevant policies apply automatically.

note

Your organization's default update policies are already targeted at the built-in "all endpoints" tag, and every newly enrolled device joins that tag automatically. That is why updates begin appearing without any setup. You can create additional tags and policies whenever you want finer-grained control.

Step 1: Verify your agents

Before configuring anything, confirm your agents are communicating properly.

1. Navigate to Agents > Endpoints in the left sidebar.
2. Check that each enrolled endpoint shows a Status of Online.
3. Review the Last Seen column to confirm agents are actively reporting.

If any agents show as Offline, refer to the Agent Enrollment troubleshooting section before proceeding.

Step 2: Confirm updates are appearing

Thanks to the default policies and the "all endpoints" tag, you do not need to create anything to start seeing results. Once an endpoint is online and has completed its first telemetry refresh, applicable updates show up automatically.

1. Navigate to Update Management > System Updates to see operating system updates the default policy has surfaced and pre-approved for your endpoints.
2. Navigate to Update Management > Application Updates to see third-party application updates for the popular applications that are installed on your fleet.
3. Open an individual endpoint from Agents > Endpoints to see the updates applicable to that specific device.

Remember that surfaced and pre-approved updates are ready for installation, but they do not install on their own. The next step puts them into action.

note

The default application updates policy only updates applications that are already installed. It will not add new software to an endpoint.

Step 3: Attach a deployment ring to install updates

A deployment ring is what actually rolls out approved updates to your endpoints. It also lets you control the pace: you can install to a small test group first, watch the results, and then expand to the rest of your fleet in phases.

Your organization already includes three ready-to-attach rings, so you can start rolling out updates without building one from scratch:

• Always Allowed - no maintenance window; approved updates can install at any time.
• Wednesday Patching - a weekly Wednesday-evening window with a 10% pilot phase that bakes for 4 hours before the rest of the fleet completes.
• Workstation Daily Patching - a nightly window with a three-phase rollout (a small canary, then a larger wave, then everyone), each phase baking for 24 hours.

1. Navigate to Update Management > Deployment Rings.
2. Open one of the three built-in rings, or click Create Ring to define your own.
3. Assign the ring to an update policy. You can attach it to the default system update policy, either default application updates policy, or any policy you create.
4. Save the ring.

Once a ring is assigned to a policy, approved updates begin installing on the targeted endpoints according to the ring's schedule and phase settings. For a full walkthrough of phases, advancement rules, and presets, see Deployment Rings.

warning

When trying out a new rollout, start with a small phase so updates reach a handful of non-critical endpoints first. Confirm the results, then let the ring expand to the rest of your fleet.

Step 4: Organize with your own tags (optional)

The built-in "all-endpoints" tag covers your whole fleet, and four platform tags (Windows workstations, Windows servers, Linux, and Mac) are already assigned to endpoints automatically based on their detected operating system. This is perfect for getting started. As your environment grows, you will likely want to group endpoints more precisely so you can apply different policies to different sets of devices.

1. Navigate to Agents > Tags.
2. Create tags that reflect your environment. Common examples:
   • Production and Development (by environment)
   • Windows Servers and Linux Servers (by platform)
   • Finance, Engineering, HR (by department)
   • US-East, EU-West (by location)
3. Assign tags to endpoints from the Agents > Endpoints page by selecting one or more agents and using the tag assignment action.
4. Target a policy at your new tags by editing the policy and choosing those tags under Targets.

note

A single endpoint can have multiple tags. For example, a server might be tagged as both "Production" and "Windows Servers". When a policy targets either tag, that server receives the policy.

tip

To create your own update policy, navigate to Update Management > System Updates or Update Management > Application Updates, click Create Policy, choose which updates to include and how they are approved, and select the tags it targets. See System Updates and Application Updates for details.

Step 5: Review vulnerabilities

TridentStack Control automatically scans your fleet for known vulnerabilities based on installed software and missing patches.

1. Navigate to Reporting > Vulnerabilities in the left sidebar.
2. Review the list of detected CVEs, sorted by severity (Critical, High, Medium, Low).
3. Click any CVE to see which endpoints are affected and whether a patch is available.
4. For vulnerabilities that cannot be patched immediately (due to compatibility requirements or other constraints), create an exception with a justification and expiration date.

Vulnerability data updates automatically as agents report new software inventory and as new CVE information becomes available. No manual scans are required.

You can also view vulnerabilities for a specific endpoint by navigating to its details page in Agents > Endpoints and selecting the Vulnerabilities tab. This gives you a per-agent view of all detected CVEs affecting that individual endpoint.

Step 6: Check compliance

Compliance baselines measure your endpoints against industry-standard security frameworks. Unlike vulnerabilities (which are detected automatically), compliance evaluation requires you to assign a baseline to your endpoints first.

1. Navigate to Reporting > Compliance in the left sidebar.
2. Review the available frameworks: CIS Benchmarks, DISA STIGs, and Microsoft Security Baselines.
3. Assign a baseline to one or more tags. Endpoints with those tags will begin compliance evaluation on their next check-in.
4. Once evaluation completes, select a baseline to see your fleet's compliance score and which specific controls are passing or failing.
5. Drill into individual controls to see affected endpoints and remediation guidance.

info

Compliance evaluation only runs on endpoints that have a baseline assigned through their tags. If you do not see compliance data for an endpoint, verify that its tags are associated with at least one compliance baseline.

Next steps

With endpoints enrolled, updates appearing through your default policies, and a deployment ring installing them, you have a working environment. From here, explore these areas:

• Application Updates - Review and tune the third-party application patches that the default policy surfaces, or create your own application policies.
• Deployment Rings - Refine your phased rollouts so patches reach test groups before production.
• Configuration Policies - Enforce device settings (security configurations, feature toggles) across your fleet.
• Tag Automation - Create rules that automatically tag, patch, or notify based on endpoint conditions.
• Query Builder - Build custom reports to share patch compliance and vulnerability status with stakeholders.