# Asset Activity Detection

**Categories:** Asset Management

Identifies managed assets that haven't reported activity within a configurable period, surfacing lost, stolen, or no-longer-used devices.

- Runs periodic scans to identify inactive hardware assets
- Detects devices with no activity beyond the configured threshold
- Distinguishes newly flagged assets from those already being tracked
- Notifies asset owners and the IT team through their preferred communication channel
- Consolidates the findings into a structured report
- Opens a ticket for reassignment or decommissioning review

## What Asset Activity Detection does

Asset Activity Detection is Harmony's scheduled monitoring agent for company-owned hardware that has stopped checking in. On a recurring schedule, it compares every company-owned asset's last-seen timestamp against a configurable inactivity threshold, and for any device that's gone dark, it opens a ticket with a CSV audit trail and notifies IT - no one has to pull a stale-device export by hand. It tracks what it's already reported, so each run surfaces new problems rather than repeating the same list.

## Who Asset Activity Detection Is For

**Persona:** IT operations and helpdesk managers responsible for hardware asset inventory, security posture, and audit readiness.

**Pain point:** Without this, teams have no automated visibility into devices that quietly stop reporting to their MDM: laptops left behind after an employee exits, lost or stolen hardware, or simply offline devices - all piling up as unmanaged risk with no one noticing until an audit or incident forces the question.

## How Asset Activity Detection Works

**Trigger:** A cron schedule (weekly by default, configurable per tenant); the workflow ships disabled and must be turned on.

1. **Query Inactive Assets** - calls asset-management-api's asset listing endpoint filtered to company-owned assets, comparing each last_seen value against a threshold cutoff (30 days by default); results are enriched with the assigned employee's details.

2. **Filter Recently Reported** - deduplicates against assets already flagged within a configurable cooldown window (7 days by default) using Harmony's entity-tracking/read-state mechanism, so repeat runs don't re-report the same device every cycle.

3. **Generate CSV Report** - compiles the filtered list of inactive assets into a downloadable CSV attachment.

4. **Create Ticket** - opens a ticket in Harmony's native Service Desk, attaches the CSV, and links it directly to the affected asset records.

5. **Notify Recipients** - resolves the configured ticket assignee, falling back to the IT desk's managers, and delivers a notification via each recipient's preferred channel (Slack, Teams, or email) through Harmony's Notifications API.

**Outcome:** A Service Desk ticket in the configured IT desk with an attached CSV of all currently-inactive company-owned assets, plus a direct notification to the assignee or desk managers.

## Capabilities

- **Detect stale devices** - flags company-owned assets whose last-seen timestamp exceeds a configurable day threshold.
- **Scope to company-owned hardware** - filters strictly on ownership, excluding personal/BYOD devices from the sweep.
- **Auto-deduplicate repeat findings** - suppresses re-flagging the same device within a configurable cooldown window.
- **Enrich with employee context** - resolves each flagged asset's assigned employee so IT knows who to follow up with, not just a device ID.
- **Generate audit-ready CSV reports** - every run that finds inactive assets produces a CSV attachment for record-keeping.
- **Auto-ticket into the Service Desk** - opens a native Harmony ticket, linked to the affected asset records, with configurable desk, assignee, and priority.
- **Notify the right person automatically** - falls back from a configured assignee to desk managers, delivered via each recipient's preferred channel.
- **Fully schedulable and tenant-configurable** - cron schedule, inactivity threshold, dedup window, and ticket routing are all configurable per tenant.

## Main use cases

**Silent offboarding leak** - An employee returns their laptop, but it's never marked recovered in the MDM. Weeks later it stops checking in. Asset Activity Detection flags it past the inactivity threshold, tickets it with a CSV, and notifies the desk manager so the asset can be reclaimed before it's lost from inventory.

**Lost or stolen hardware** - A field employee's laptop stops reporting to the connected MDM. On its next scheduled run, the agent catches the last-seen gap and raises a ticket tied directly to that asset record, giving IT a head start before it becomes a security incident.

**Compliance-driven asset audits** - A security team needs a recurring, evidence-backed record of hardware that's gone dark for audit purposes. The agent's periodic CSV-attached tickets create a running paper trail without anyone manually exporting MDM data.

## Integrations

| Integration | Role in the agent flow |
| --- | --- |
| asset-management-api (Harmony) | Source of truth for asset ownership, last-seen timestamps, and metadata queried each run |
| Tenant's connected MDM/EDR integration (e.g. JAMF, Intune, Kandji, JumpCloud) | Upstream source of device check-in data that populates last-seen; tenant-optional, depends on which MDM is connected |
| Harmony Service Desk (native ticketing) | Ticket creation, CSV attachment, and linking to the related asset records |
| Harmony Notifications API | Delivers the alert to the assignee or desk managers via Slack, Teams, or email |
| Authz service | Resolves desk managers as the fallback notification recipients |
| Employee enrichment service | Resolves the employee assigned to each flagged asset |

## FAQ

### What exactly is Asset Activity Detection - is it a bot, a workflow, or something else?

It's a scheduled, cron-triggered automated workflow inside Harmony's workflow engine, not a conversational agent. It runs on a recurring schedule, queries asset data, and takes action - no chat interface involved.

### How does it decide which devices to flag?

It compares each company-owned asset's last-seen timestamp - populated from your connected MDM/EDR integration - against a configurable inactivity threshold (30 days by default). Anything older than that cutoff is flagged; personal/BYOD devices are excluded by the ownership filter.

### What's automatic versus what needs a human?

Detection, deduplication, CSV generation, ticket creation, and notification are all automatic. Not confirmed in code: whether any remediation (marking a device recovered, wiping it, reassigning it) happens automatically - those actions require a human to act on the ticket.

### Will it keep re-flagging the same inactive device every run?

No - it tracks which assets were already reported and suppresses repeat tickets for the same device within a configurable cooldown window (7 days by default), so IT sees new or still-unresolved findings, not an identical list each cycle.

### What needs to be set up before this agent works?

An MDM/EDR integration connected and syncing device check-in data (so last-seen timestamps are populated), an IT desk configured to receive tickets, and the workflow enabled with its schedule, threshold, and ticket routing configured - it ships disabled by default.

## Related platform features

- **Harmony Service Desk** - Receives the tickets this agent creates, with CSV attachments and linked asset records