Asset Activity Detection
Identifies managed assets that haven't reported activity within a configurable period, surfacing lost, stolen, or no-longer-used devices.
- Runs periodic scans to identify inactive hardware assets
- Detects devices with no activity beyond the configured threshold
- Distinguishes newly flagged assets from those already being tracked
- Notifies asset owners and the IT team through their preferred communication channel
- Consolidates the findings into a structured report
- Opens a ticket for reassignment or decommissioning review
What Asset Activity Detection does
Asset Activity Detection is Harmony's scheduled monitoring agent for company-owned hardware that has stopped checking in. On a recurring schedule, it compares every company-owned asset's last-seen timestamp against a configurable inactivity threshold, and for any device that's gone dark, it opens a ticket with a CSV audit trail and notifies IT - no one has to pull a stale-device export by hand. It tracks what it's already reported, so each run surfaces new problems rather than repeating the same list.
Who Asset Activity Detection Is For
IT operations and helpdesk managers responsible for hardware asset inventory, security posture, and audit readiness.
Without this, teams have no automated visibility into devices that quietly stop reporting to their MDM: laptops left behind after an employee exits, lost or stolen hardware, or simply offline devices - all piling up as unmanaged risk with no one noticing until an audit or incident forces the question.
How Asset Activity Detection Works
A cron schedule (weekly by default, configurable per tenant); the workflow ships disabled and must be turned on.
- Query Inactive Assets
calls
asset-management-api's asset listing endpoint filtered to company-owned assets, comparing eachlast_seenvalue against a threshold cutoff (30 days by default); results are enriched with the assigned employee's details. - Filter Recently Reported
deduplicates against assets already flagged within a configurable cooldown window (7 days by default) using Harmony's entity-tracking/read-state mechanism, so repeat runs don't re-report the same device every cycle.
- Generate CSV Report
compiles the filtered list of inactive assets into a downloadable CSV attachment.
- Create Ticket
opens a ticket in Harmony's native Service Desk, attaches the CSV, and links it directly to the affected asset records.
- Notify Recipients
resolves the configured ticket assignee, falling back to the IT desk's managers, and delivers a notification via each recipient's preferred channel (Slack, Teams, or email) through Harmony's Notifications API.
A Service Desk ticket in the configured IT desk with an attached CSV of all currently-inactive company-owned assets, plus a direct notification to the assignee or desk managers.
Capabilities
- Detect stale devices - flags company-owned assets whose last-seen timestamp exceeds a configurable day threshold.
- Scope to company-owned hardware - filters strictly on ownership, excluding personal/BYOD devices from the sweep.
- Auto-deduplicate repeat findings - suppresses re-flagging the same device within a configurable cooldown window.
- Enrich with employee context - resolves each flagged asset's assigned employee so IT knows who to follow up with, not just a device ID.
- Generate audit-ready CSV reports - every run that finds inactive assets produces a CSV attachment for record-keeping.
- Auto-ticket into the Service Desk - opens a native Harmony ticket, linked to the affected asset records, with configurable desk, assignee, and priority.
- Notify the right person automatically - falls back from a configured assignee to desk managers, delivered via each recipient's preferred channel.
- Fully schedulable and tenant-configurable - cron schedule, inactivity threshold, dedup window, and ticket routing are all configurable per tenant.
Main use cases
Silent offboarding leak - An employee returns their laptop, but it's never marked recovered in the MDM. Weeks later it stops checking in. Asset Activity Detection flags it past the inactivity threshold, tickets it with a CSV, and notifies the desk manager so the asset can be reclaimed before it's lost from inventory.
Lost or stolen hardware - A field employee's laptop stops reporting to the connected MDM. On its next scheduled run, the agent catches the last-seen gap and raises a ticket tied directly to that asset record, giving IT a head start before it becomes a security incident.
Compliance-driven asset audits - A security team needs a recurring, evidence-backed record of hardware that's gone dark for audit purposes. The agent's periodic CSV-attached tickets create a running paper trail without anyone manually exporting MDM data.
Integrations
| Integration | Role in the agent flow |
|---|---|
| asset-management-api (Harmony) | Source of truth for asset ownership, last-seen timestamps, and metadata queried each run |
| Tenant's connected MDM/EDR integration (e.g. JAMF, Intune, Kandji, JumpCloud) | Upstream source of device check-in data that populates last-seen; tenant-optional, depends on which MDM is connected |
| Harmony Service Desk (native ticketing) | Ticket creation, CSV attachment, and linking to the related asset records |
| Harmony Notifications API | Delivers the alert to the assignee or desk managers via Slack, Teams, or email |
| Authz service | Resolves desk managers as the fallback notification recipients |
| Employee enrichment service | Resolves the employee assigned to each flagged asset |
FAQ
It's a scheduled, cron-triggered automated workflow inside Harmony's workflow engine, not a conversational agent. It runs on a recurring schedule, queries asset data, and takes action - no chat interface involved.
Meet more Agents
