Jump To Inventory Page

Endpoints Detail Story

alice-mbp.local should read as a stable but consequential host: trusted identity anchor, sensitive repo adjacency, and a useful containment boundary.

A host story page should help the operator reason about trust and containment quickly, not just list OS fields and IP addresses.

Operator Brief

This host anchors the important work

Alice’s host matters because it is the stable endpoint behind several meaningful sessions, files, and key stories.

Question This View Answers

Why is this host story valuable even though the host is known?

Sessions

Most meaningful recent developer work

Sensitive files

Several are high consequence

Primary user

alice@company.com

Stable owner anchor

Environment

developer_machine

Expected but consequential

c6 Detail Reference

Identity strip, metric strip, then evidence tables.

Owner binding incomplete

This host is active in AI usage but still lacks a clear person or environment owner.

Hostname

10.0.1.44

IP Address

10.0.1.44

Environment

unknown

macOS

Runtime

node

Endpoint ID

endp_01Y7w...

Users On This Endpoint

c6 starts with attribution around the host.

User	Primary agent	Sessions	Last seen
unknown	Claude Code	1	22 min ago

Recent Sessions

The raw page then shows the work actually happening there.

User	Agent	Model	Cost	Status
unknown	Claude Code	claude-sonnet-4-6	$0.61	active
sandbox-evals	Cursor	claude-opus-4-6	$1.94	ended

Key Findings

What this representative item changes in the security story.

This host gives the story a stable anchor

Owner, environment, and work pattern align, making interpretation stronger than on weaker endpoints.

That is why the page matters even without an obvious anomaly.

Company consequence is high here

Sensitive file and repo context are concentrated on this machine.

The consequence is about the work, not the OS metadata.

Containment is unusually clear

If the surrounding session story turns concerning, this host is a clean place to act.

That operational clarity is valuable to surface.

Immediate Actions

The page should point to action before deeper raw inspection.

Use the host as the containment anchor

If the surrounding session or key story escalates, this endpoint gives security a clear boundary for action.

Compare against the unresolved host

Use this page as the baseline for what a strong endpoint story looks like.

Trace the file-to-network sequence

Open the attached session and file stories to confirm how company context moved from the host outward.

Representative Relationship Map

Use the same topology to explain the item from several security lenses.

Endpoint trust map

A host story should connect owner clarity, company context, and containment value in one read.

Use the map to show why a known host can still be the most consequential endpoint in inventory.

Identity, adjacency, activity, and posture around one representative item.

Owner fit

Who owns this host?

alice@company.comknown owner

developer_machineexpected environment

Execution lane

What runs here?

Claude Codeprimary agent

shared org keyadjacent caveat

endpoint

alice-mbp.local

Stable developer machine behind several high-signal stories.

trusted anchor

Company context

What lives here?

api-refactorauth repo path

.env + config filessensitive file cluster

Containment value

Why does the host matter?

clean host boundarygood containment anchor

boundary-linked sessionsimportant review lane

owner trust

high

company consequence

high

containment

clear

next drill

session detail

Evidence Bundles

Bundle the story instead of forcing the user to reconstruct it from rows.

Identity bundle

alice-mbp.local aligns with Alice’s account and expected developer environment.

Strong host trust baseline.

Context bundle

Auth-related repos and sensitive files sit on this endpoint.

That is what makes the host consequential.

Execution bundle

Claude Code and a shared key appear repeatedly on the host.

The host is central to the broader inventory story.

Boundary bundle

High-signal sessions on the host lead into provider and secondary outbound paths.

Host meaning sharpens boundary interpretation.

Raw Evidence Paths

The meaning page should keep the proving data one click away.

Return To Endpoints Listing

Step back to the entity-wide meaning page and compare this item to the rest of the class.

Open meaning list

Open Raw Endpoints Detail

Drill into the original ledger once the meaning layer has narrowed the question.

Open raw detail

Open Raw Endpoints List

Compare this representative item against the full list for distribution and frequency.

Open raw list