Endpoint diagnostics and investigations
Understand the issue. Know what to check next.
Bring live endpoint evidence and public research into the same investigation. GenticFlow checks Windows, macOS and Linux devices, draws on available internal knowledge, and can research vendor guidance and security advisories to help answer your question. Review the findings and sources, then follow through with remote control, terminal, files or a supported remediation workflow.
For IT teams and MSPs. Read-only investigation; follow-up actions remain under your controls.
From an IT question to evidence and next steps.
Check the Environment
Start with your question. GenticFlow runs read-only checks on the selected endpoints and uses available internal knowledge and history to guide the investigation.
Research Relevant Sources
When the question needs external evidence, Investigations can search public sources for vendor guidance, known issues and security advisories, then use that research alongside device observations.
Review the Assessment
Read the findings, supporting observations and source links. See recommended next steps, the scope of the checks and anything that remains unverified. Follow through with your existing support tools and approval policies.
Investigation example
Does this security advisory affect this server?
This anonymized example combines a published PHP security advisory with selected package, executable and process checks. The assessment explains why exposure was not demonstrated in the checked scope and what to inspect next.
Investigation Complete
Does this PHP vulnerability affect this server?
Exposure to CVE-2026-109618 was not demonstrated in the checked scope. The selected checks found no PHP runtime.
Details
The published advisory concerns PHP. Device checks covered selected packages, the executable path and running processes. Other deployment paths remain unverified.
Evidence (3)
- Public research: the advisory identifies a vulnerability in PHP request handling.
- Device checks: no matching PHP package or executable in the inspected scope.
- Process checks: no matching PHP, Apache or nginx process at the time of inspection.
Recommendations (2)
- Check containers and bundled application runtimes before ruling out exposure.
- If PHP is found, compare its version and deployment with the advisory and review the required update.
Choose the scope the issue needs.
Endpoint Investigations
Investigate one device using live checks, available historical context and relevant public research. Ask whether an advisory applies, why a laptop is slow, or why a VPN connection fails after sleep.
Fleet Investigations
Investigate selected groups of endpoints, compare findings and consult public guidance when needed. Review a combined conclusion with per-device context and coverage to understand whether an issue affects one machine or a wider group.
General Investigations
Research a technical question using available internal documentation, knowledge, investigation history and public sources. This path works without an attached endpoint and does not collect live device evidence.
Review findings and recorded commands, export the result, or start a follow-up investigation. Historical context remains distinct from fresh checks. An inconclusive result identifies where further work is needed.
When a question needs external evidence, investigations can consult public sources such as vendor guidance and include source links. Web research depends on a supported, enabled research model configuration. It is also available in technician conversations, but not in end-user conversations.
For repeatable checks, Hero’s Script Library includes network, DNS, certificate, backup file age, and other diagnostic scripts. Technicians can review and run them from endpoint Commands or use their named results in workflows.
Explore the Hero Script LibraryExplore endpoint troubleshooting.
Endpoint Diagnostics Guide
What to collect, how to interpret the evidence, and what a useful diagnostic report contains.
Slow Computer Investigation
Follow an illustrative performance case from resource readings to a technician handoff.
VPN Ticket Diagnosis
Explore endpoint checks for client state, routing, DNS, and authentication symptoms.
Agent Requirements
Check supported operating systems and connectivity requirements before deployment.
FAQ
Questions about endpoint investigations.
What is collected, what stays read-only, and how to evaluate the result.
Can Investigations search the web?
Can Investigations search the web?
Yes. When a question needs external evidence, Investigations can research public sources such as vendor documentation, known-issue reports and security advisories. Findings can include supporting source links. Web research requires a supported, enabled research model in Models > Default Models; it can be disabled. It is also available in technician conversations, but not end-user conversations.
Can I investigate whether a vulnerability affects an endpoint?
Can I investigate whether a vulnerability affects an endpoint?
Yes. Ask about a specific advisory or potential exposure. An Investigation can compare observed software, versions and configuration with published information, then explain what the evidence establishes and what remains unchecked. It is a scoped assessment, not an exhaustive vulnerability scan or a guarantee that a device is secure.
What is endpoint diagnostics software?
What is endpoint diagnostics software?
It collects and helps interpret device state for troubleshooting: processes, memory, disk, services, logs, and network configuration. GenticFlow Investigations uses read-only checks to answer a specific IT question and retains the findings for technician review.
Does an Investigation make changes to the device?
Does an Investigation make changes to the device?
Investigations use read-only diagnostics. A finding or recommended action is not a completed repair. Any follow-up remediation uses a separate action or workflow and remains subject to the applicable permissions and approval policies.
Which endpoints can I investigate remotely?
Which endpoints can I investigate remotely?
Live endpoint investigations require a connected GenticFlow agent on Windows, macOS, or Linux and access to that endpoint. Available checks depend on the operating system, permissions, and the evidence the device can provide. See the system requirements before deploying agents.
What happens when evidence is missing or the endpoint is offline?
What happens when evidence is missing or the endpoint is offline?
An offline endpoint cannot provide fresh diagnostic results. Cached inventory or a previous finding can provide context, but does not establish the device's current state. An investigation can be inconclusive; review the missing checks before deciding on the next action.
Do I need to start from a ticket?
Do I need to start from a ticket?
No. Technicians can start from the Investigations page by selecting an endpoint or a fleet scope, or by asking a general technical question. Investigations can also support ticket work. API and MCP access provides another entry point where included in your plan and enabled for the connection.
How do I evaluate the results?
How do I evaluate the results?
Use a representative issue from your support queue. Check that the conclusion answers the original question, links findings to collected evidence, distinguishes current observations from historical context, and identifies unresolved checks. Verify any subsequent fix separately before treating the issue as resolved.
Bring a question from your support queue.
Bring a performance issue, a recurring VPN failure or a security advisory. Review the device evidence, relevant public sources and next steps with your team.