Pulse in Backoffice: applications, profiles, bundles and rollouts
This page walks an administrator through the Pulse configuration pages in Backoffice, in the order you use them: register an application, author a profile, publish it as a signed bundle and follow the rollout. Read Noxtica Pulse: endpoint telemetry overview first.
You need the administrator role for every change. Viewers can read all of these pages.
What it is
Availability: In development.
The pages are under Backoffice → Noxtica Pulse: Pulse, Applications, Profiles, Bundles and Rollouts. They configure what the Pulse desktop client collects for one of your applications and how a change reaches devices. This page does not cover installing the client.
| Page | What it holds |
|---|---|
| Applications | The programs Pulse observes. The slug is the join link every device enrols with. |
| Profiles | A draft per application: telemetry, privacy and retention, delivery, and a read-only list of detection rules |
| Bundles | Every signed configuration published for an application. Append-only. |
| Rollouts | The ring-by-ring spread of each published revision, with a health gate |
Reads need the viewer role (view.pulse). Writes need the administrator role (manage.pulse) and a fresh step-up MFA confirmation, and are recorded in the audit log.
Prerequisites
- Pulse provisioned for your organisation. Otherwise you see “Pulse is not enabled for this tenant”.
- Administrator role and a device for step-up MFA.
- For each operating system you target: the signature details of your program (certificate subject or thumbprint, Apple team ID, ELF build ID or package name). An executable name alone is easy to spoof, so Pulse attaches only to a program whose signature, team or build ID you name.
- A decision, inside your organisation, about which data classes the application may collect and which are optional for the end user.
Steps
1. Register an application
Backoffice → Noxtica Pulse → Applications → Register application.
| Field | Rule |
|---|---|
| Name | Required, at most 128 characters |
| Slug | 2 to 63 lowercase letters, digits or hyphens, starting with a letter or digit. It becomes the join link and cannot be changed later. |
| Deployment kind | Game, Enterprise or Workforce |
| Allowed modules | Observability, Integrity, Detection (EDR), Response |
| Targets | One or more of Windows, macOS, Linux. Each needs a signer: Authenticode (Windows), Apple team, ELF build ID or package. Add executable names, bundle IDs, install path hints or a product name to narrow the match. |
Press Register. Use Edit to change fields other than the slug. Archive keeps published bundles as the audit trail, but devices stop receiving new configuration and new devices can no longer join.
2. Create a profile
Backoffice → Noxtica Pulse → Profiles. Choose the application, press New profile, and enter a Profile name: 1 to 63 lowercase letters, digits, hyphens or underscores, starting with a letter or digit, for example eu-staging. The profile starts from a valid default for the application.
3. Set telemetry
Open the profile and the Telemetry section. Anything you do not select is never collected.
- Metrics: application CPU, memory, threads and handles; frame time; GPU memory and utilisation; host CPU, memory, disk and network. Each metric has an interval in seconds. There is also a default interval and an aggregation window.
- Sampling.
- Collect application logs with a Minimum log severity.
- Collect session start / end events.
- Crash reports: Off, Metadata only or Full report. Crash symbolication: No symbolication or Symbolicate on the server.
- Host context: None, Coarse (OS family and hardware class) or Extended (detailed hardware and OS build).
- Network quality probes: endpoints the client measures latency and loss against, each with a host, a port and a protocol (HTTPS, TCP or UDP). The client currently measures TCP connect time; probes of other protocols are skipped and reported.
4. Set privacy and retention
In Privacy and retention:
- Data classes enabled: application metrics, application process metadata, crash reports, detections, host metrics, integrity signals, logs, loaded-module metadata, network quality and sessions.
- Optional for the end user (consent required): an optional class is accepted only for users who granted it under the required consent version. Only enabled classes can be optional.
- Required consent version: raise it to ask every user to consent again.
- Pseudonymisation: Linked (a stable pseudonym across sessions) or Pseudonymous (not linked across applications).
- Retention class: the days you request for sessions, measurements, diagnostics, and integrity and detections. A blank field leaves the platform default. The platform can enforce a shorter limit, and a request is limited to the plan maximum.
Backoffice marks the default retention periods and plan maximums as provisional. They can change, so do not quote them to your users from this page. See Pulse detections, response, devices and privacy.
5. Set delivery
In Delivery, set the Bundle poll interval (seconds) if you want to change how often the client checks for a new bundle. An empty value uses the client default. Each device waits that interval plus or minus half of it, so a change reaches every device within one interval after publishing. The setting needs Pulse client 0.3.0 or newer, and publishing raises the minimum client version, so older clients reject the whole bundle.
6. Validate and save the draft
Press Validate. The validator checks the schema, the red-line rules and the cost bound. A profile that is rejected shows the offending paths and the reason, and Publish… stays unavailable until the validator accepts it. Press Save draft. Publishing always uses the saved version. If someone saved a newer draft first, Backoffice shows “This profile changed while you were editing” and you reload.
The Detection rules list in the profile is read-only. Rules and their response actions cannot be edited in this editor yet; saving keeps them unchanged.
7. Publish
Press Publish…, then:
- Enter the Minimum client version in the form
x.y.z, for example0.1.0. Older clients ignore the bundle. - Enter Valid for (days), from 1 to 30. Clients stop trusting the bundle after that.
- For a revision after the initial one, optionally open Advanced: ring plan.
- Press Publish and confirm step-up MFA.
Backoffice signs saved draft version N and publishes it as the next revision. Every enrolled device picks it up on its next configuration pull.
The Bundles page notes when a bundle is signed with a development key. Such bundles are not for production use and must not be trusted.
8. Follow the rollout
Backoffice → Noxtica Pulse → Rollouts.
- The initial revision of an application, a rollback, a bundle that carries a kill switch, and a single-stage plan go live for every device at once.
- Any other publish is staged. A ring plan has one to four stages in the order canary, early, broad. Each stage has a share of devices (a whole number from 1 to 100, larger than the stage before) and a soak time in whole minutes. The final stage must reach 100% of devices.
- The rollout advances while the health gate stays green. Signals include devices rejecting the bundle, client CPU and memory use, recent unclean exits, dropped-event rate, export failure rate, upload retries, devices that went silent after applying, devices with a degraded sensor and the reviewed false-positive rate of response actions. A check needs a minimum number of reporting devices for a verdict.
- A new publish is refused while another rollout of the application is still Running or Halted.
9. Halt, resume or roll back
On a rollout:
- Halt freezes it at the current stage. Devices already in the cohort keep the new revision; others stay on the previous one. You may enter a reason.
- Resume continues a halted rollout.
- Roll back abandons the rollout and publishes the content of the previous revision again as a new, higher revision, signed anew and served to every device at once. Devices never accept a lower revision number, so the old number itself is not restored.
- Evaluate now runs a health check at once.
The same rollback exists on the Bundles page, Roll back, for any older revision. Every change is recorded in the rollout’s audit timeline.
10. Read the bundle history
Backoffice → Noxtica Pulse → Bundles lists revisions newest first with Published, Expires, Content hash, Key ID and Signer. View opens a revision and its Changes vs previous.
Verify it works
- The new application is listed under Applications with status Active and appears under Current revision per application on the overview once published.
- Validation shows “The profile is valid”.
- After publishing, a message says “Published revision N” and Bundles marks that revision Current.
- Rollouts shows the revision, its stage and “Last health check” results. The initial revision shows “live for every device”.
- A halted rollout shows “This rollout is halted” with the reason.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| “Use 2–63 lowercase letters, digits or hyphens” | Slug format | Fix the slug. It cannot be changed after registration. |
| “Choose a signer kind for .” | A target has no signer | Pick a signer and fill its value. |
| “The profile is rejected” | Schema, red-line or cost-bound failure | Read the offending paths and reason, change the profile, validate again. |
| Publish… is disabled | Validator has not accepted the draft, or there are unsaved changes | Validate and save the draft. |
| “Use the form x.y.z” | Minimum client version malformed | Enter a version such as 0.1.0. |
| “The rollout of revision N is still Running” | A new publish is refused during an active rollout | Wait for it to complete, or roll it back. |
| “A ring plan has one to four stages”, “The last stage must reach 100% of devices” and similar | Ring plan rules | Correct the stages. |
| “Editing and publishing need the administrator role” | Viewer role | Ask an administrator. |
| “The rollout could not be halted” or “could not be resumed” | Temporary fault or state changed | Refresh and retry. |
| The health gate holds the rollout (“The health data could not be read during this check”) | Health data could not be read | Nothing advanced or halted; the next check retries. |
| Older clients ignore a new bundle | The minimum client version was raised | Update the client or lower the minimum for the next publish. |
Related
- Noxtica Pulse: endpoint telemetry overview for the whole picture.
- Pulse detections, response, devices and privacy for review, response, devices and the privacy page.
- Roles and permissions for the capabilities used here.
- Audit log and data export for the record of publishes and rollbacks.
- Privacy and Security for data handling.