Watchlists

Description

The Watchlist Dashboard provides a view of all devices in violation of specific criteria defined in the Analysis Profile. The number of devices in violation displays beside each criteria tab.

Devices remain in the watchlist until they stop violating the watchlist criteria.

Users can set devices to snooze so they do not receive notifications on them.

The criteria for the watchlist are as follows:

  • Critical: Devices that have met three or more conditions defined by the Analysis Profile.
  • Data: Data Consumed Per Month Exceeds the predefined threshold (Only Cellular Data is considered).
  • Battery: Battery Discharge Rate Per Hour Exceeds the predefined threshold.
  • Storage: Storage Consumed Exceeds the predefined threshold in %.
  • Memory: Memory Consumed Exceeds the predefined threshold in %.
  • Virus Scan: Last Virus Scan Exceeds the predefined threshold in days.
  • Check-In: Last Check-In Exceeds the predefined threshold in days.
  • Location: Last location reported days exceeds the threshold.
  • Drops detected: Number of drops happening for a device exceeds the threshold defined. Below there is an explanation for the drop detection algorithm.

Watchlist window

The number of devices in violation displays beside each criteria tab. Selecting a tab reveals details about the devices violating the condition.

The following table outlines some key functions of the interface:

Function Description
Download button Download Downloads a CSV file containing watchlist data.
Unread button Unread Sets the current record as unread.
Snooze devices button Snooze Device(s) Temporarily removes a device from the watchlist.
Report Incident button Report Incident Creates an incident ticket associated with selected devices.
Drop Detection Algorithm

The drop detection algorithm relies on the accelerometer sensors on mobile devices. The application monitors the gravity signal from the device at a rate of 10 readings per second and watches for the signature of a drop or free fall. From a physics point of view a device registers no gravity only when it is falling under the gravitational force. The threshold for the lower bound of gravity signal has a specific value. When a drop detected due to low gravity, the duration of the drop determines its severity. The severity of a drop corresponds to the height of the free fall and is a square function of time duration. The watchlist inform you of drops over 1 m.

Note: In SOTI XSight 2024.0.0, drops of any height were added to the watchlist, causing excess notifications. In 2024.0.1 and later, the watchlist informs you of drops over 1 m.
Note: A drop of 0.5 seconds corresponds to a 1.2 m. A drop that lasts for about 1 second can indicate a fall from a height of 4.9 m. The system categorizes detected drops into three categories based on the relative drop heights.

Creating an Incident for Selected Devices

About this task:

With SOTI XSight, you can create incident tickets for devices on the Watchlist. To report a device or a group of devices, do the following:

1. Within the Watchlist, select the devices to report.

Watchlist device selection

2. From the Device Actions menu bar, select Report Incident button Report Incident. A Report Incident confirmation window opens.

3. Select Report Incident.

Results: The Incident Management window opens with a draft incident form. SOTI XSight automatically associates the selected devices under Devices.

Snoozing Devices

About this task:

You can 'snooze' a device on the Watchlist to have it temporarily hidden from the list. Note that data is still collected for snoozed devices.

To snooze one or more devices:

1. Select an analysis profile from the Operational Intelligence menu.

2. From the Choose Dashboard menu, select Watchlist. The watchlists for the selected analysis profile are displayed in the right pane.

3. Select one of the conditions at the top of the pane (for example, Critical, Data, Battery) then select the device(s) you want to snooze.

4. Select Snooze Device(s) snooze devices button at the bottom of the pane. The Snoozed Devices dialog box opens.

5. Choose to snooze the device permanently, or by the minute, hour, day, month, or year. Devices can be snoozed for up to one year. At the end of the snooze period, the device reappears on the watchlist.

6. Select SNOOZE to close the Snoozed Devices dialog box. The snoozed device(s) are no longer displayed in the watchlist.