MDM Policy Engine & Drift Detection
Coblyn "Vanguard" (v1.15.0) introduces a native Policy Engine within the Go agent, elevating the ecosystem from a passive telemetry collector to an active compliance enforcement tool.
Understanding Drift Detection
Drift Detection is the continuous process by which the Coblyn agent compares the actual state of an endpoint against the desired state (assigned policies).
If a user modifies a restricted registry key (e.g., enabling USB storage when it should be blocked), the agent detects this drift and acts based on the configured enforcement level.
Enforcement Modes
The Coblyn Policy Engine supports 2 main operational modes:
Audit Mode (
audit): The agent evaluates the configuration. If there's a mismatch, it reports a "Drift" (drifted) state back to the server but does not modify the endpoint. Ideal for assessing compliance without causing disruption.Enforce Mode (
enforce): The agent evaluates the configuration. If there's a mismatch, the agent overwrites the value using native Windows API calls (x/sys/windows/registry). The final state is reported as "Compliant" (compliant), noting "Drift Corrected" in the details.
Supported Policy Types
Currently, Coblyn MDM natively supports:
- Registry (
registry): Granular control overHKLM,HKCU, etc. ValidatesREG_SZ,REG_DWORDtypes and performs in-memory modifications. - Package (
package): Desired state enforcement for software apps (See App Deployment). - Script (
script): Arbitrary Bash or PowerShell execution under SYSTEM context, with error capturing.
Compliance Dashboard
The Compliance dashboard is fueled directly by the POST /api/mdm/agent/policy_report workflow. During every "Heartbeat", agents parse their assigned policies, evaluate the endpoint, and push the differential state.
Common States
- 🟢 Compliant: The policy matches; the device is secure.
- 🟠 Drifted: A mismatch was detected. (This only persists if the policy is strictly in Audit mode).
- 🔴 Error: Evaluation failed (e.g., invalid JSON, lack of permissions to write the target key).
Regularly monitor the Compliance tab in highly secured environments to prevent configuration vulnerabilities.