Enhancement request: Include the client's lockdown mode in uploaded events

[jamiestrachan-shopify]

To be brief, it would be quite useful to know what mode (lockdown, monitor) that a device was in when an event was recorded.

In other words, we would like to add the client_mode field to the Event Object, to definitively indicate what mode the client was in when an event is generated.

This would be very useful for reporting!

Q: Why don't you just mark it down on the sync server, when events are uploaded? The server is what sets the mode!
A: There's lots of caching going on, and timing. For example, the client might have more than one batch of events to upload, and the server does not know exactly when the client makes the switch from one mode to the other. While it would be possible for the server to make that determination, it would be complicated and inexact!

Thanks for your consideration!

[tburgin]

The decision field in the Event encodes the client mode in the cases we have found useful. For instance, ALLOW_UNKNOWN indicates the client was in monitor mode for that event, while BLOCK_UNKNOWN indicates lockdown mode. We have found these signals sufficient, for example, to determine the number of block events a user would experience when switching from monitor to lockdown.

Do you have a use case that requires you to distinguish monitor or lockdown on a BLOCK_BINARY event, for example?

[jamiestrachan-shopify]

The desire for that field stems from a set of reports that include things like "What applications are being run by devices in MONITOR mode? (Including Approved and Unapproved programs)".

We can get it pretty close, but there are times when the server configured mode does not match the event upload timing perfectly, resulting in some incorrect data in reports.

[pmarkowsky]

@jamiestrachan-shopify you're welcome to wait for someone from Google to respond. However we the team that was working on Santa, have left and formed North Pole Security, our fork is over at https://github.com/northpolesec/santa.

We're happy to continue the discussion over there.