What changed?
Compare a current Watchman report with available local or connected history.
The platform
From endpoint condition to accountable response.
Follow a reported condition from its evidence to a priority, a responsible owner and a reviewable response.
Your questions, answered
See the work in context.
What needs attention?
Review endpoint alerts and reported conditions instead of treating every signal as equally urgent.
Why does it matter?
Use the supporting device evidence and its operational impact to decide priority.
Who owns the response?
Use a Citadel ticket or team workflow where central coordination is enabled.
What remains unresolved?
Keep open findings and pending work visible until the next review.
What evidence is retained?
Review reported history, tickets, actions and follow-up signals.
Endpoint scenarios
Three ways to investigate a reported condition.
Follow a device report through priority, investigation and a later review.
A Windows device reports low free storage.
Evidence: Reported free-space percentage and available device history. Priority: Consider business impact and how quickly the device may run out of space. Next step: Investigate what is consuming storage and agree on safe cleanup.
Response: Assign the investigation in Citadel if connected. Record the action and review a later storage report to see whether the condition changed.
A reported firewall or Defender state needs review.
Evidence: The reported posture signal and the device it belongs to. Priority: Assess the device role and whether the signal is current. Next step: Check the configuration with the responsible operator.
Response: Keep an owner and ticket history where Citadel is used. Review a later posture report to see whether the state changed.
A connected node has not reported on schedule.
Evidence: Citadel heartbeat or snapshot recency and its generated stale-reporting alert. Priority: Check whether visibility has been lost for a device that matters to the team. Next step: Investigate connectivity and the local Watchman state.
Response: Assign ownership and review subsequent reporting before treating the condition as cleared.
The roles
Each component has a clear boundary.
Watchman runs on Windows devices and can operate locally. Citadel receives selected reports from enrolled nodes and coordinates team response. Vision is attended support: the user chooses View Only, Full Control or Reject for each request.