Policy · package telemetry
data.json (read-only, passed to every evaluation)
Run on 7 days of history
Start live stream
Batch
Live stream
–
events scanned
–
violations
–
devices
–
ChalkSQL time
Pick a policy and run it over the fleet's last 7 days.
Historical telemetry joined to endpoint inventory, evaluated with regorus_eval in ChalkSQL.
Start the live stream to watch the fleet's telemetry arrive.
Violations from the live stream appear here.
Every 2 s, new events are evaluated with the same SQL and your policy.