Groups

Groups collect endpoints into reusable targets for jobs, variables, configuration profiles, alert rules, and reporting.

Open Groups from the top navigation.

Group Types

Ordyn supports groups that are scoped globally, to a tenant, or to a folder.

Groups can be:

• static, where endpoints are assigned directly
• dynamic, where endpoints match rules

Dynamic group rules can use endpoint properties and inventory fields. The query tab shows the configured rule logic.

Firmware inventory fields are grouped under Firmware. Rules can match the selected vendor and the collected Secure Boot, Wake-on-LAN, virtualization, IOMMU, TPM, capsule update, BIOS downgrade, and AC power recovery values. A firmware field is null rule also matches endpoints that have not collected firmware inventory or did not report that particular setting.

Windows security posture fields can match VBS, Credential Guard, Memory Integrity, LSA protection, UAC, cached logons, NTLM, Remote Desktop, Windows Firewall, and Microsoft Defender inventory. SMB fields cover separate client and server protocol, signing, encryption, guest logon, NTLM blocking, dialect, auditing, service, and authentication-delay values.

Boolean security fields support is true, is false, is null, and is not null. Use the null operators to identify endpoints that do not support a setting or have not reported it. Numeric fields such as cached logon count and SMB invalid-authentication delay support numeric comparisons.

Intel AMT Rules

Intel AMT fields let dynamic groups follow an endpoint through discovery and management:

Field	Available values
Intel AMT hardware support	Supported, Unsupported, Unknown
Intel AMT provisioning state	Unprovisioned, Provisioning, Provisioned, Unknown
Intel AMT ownership	Unmanaged, Externally managed, Managed by Ordyn, Recovery required

Use Intel AMT hardware support equals Supported for a stable group of endpoints that can receive an Intel AMT configuration profile. Use the provisioning and ownership fields for operational views, such as endpoints currently being provisioned, devices managed by Ordyn, externally managed devices that can be adopted, or devices requiring recovery.

Provisioning and ownership groups change as AMT operations complete. If such a group has a configuration profile assigned, endpoints receive or lose that assignment as their group membership changes. An endpoint without Intel AMT inventory is treated as having unknown support and provisioning state and as unmanaged.

Rules Based on Another Group

Select Endpoint group membership when one dynamic group should build on another group. The source can be static or dynamic. Choose one of these operators:

• is a member of, to include endpoints currently in the selected group
• is not a member of, to include endpoints currently outside the selected group

The selector identifies each group by its name, type, and tenant or global scope. It only lists groups that you can read and that are compatible with the group being edited.

A tenant-scoped group can reference global groups and groups from the same tenant. A global group can reference any group you can read. The negative operator is a literal membership check: for example, a global group that uses is not a member of Tenant A laptops also matches eligible endpoints from other tenants because those endpoints are not members of the Tenant A group.

Membership rules use the source group's current saved membership. When that membership changes, Ordyn automatically reevaluates groups that depend on it. Dependencies can span several groups, and Ordyn evaluates each source before the groups that use it.

Circular references are not allowed. A group cannot reference itself, and a chain such as Group A → Group B → Group A is rejected. Groups that would create a circular reference are omitted from the selector while editing an existing group.

If a referenced dynamic group has not completed a successful evaluation, or its latest evaluation failed, the dependent group keeps its existing membership and reports an evaluation failure. It can update again after the source group evaluates successfully.

A referenced group cannot be deleted. Moving it to another tenant is also blocked when that would make an existing reference invalid. Likewise, deleting a tenant is blocked if one of its groups is still referenced by a group that would remain.

Operating System Rules

Use Endpoint OS family for broad operating system rules. The available family values are:

• windows
• ubuntu
• debian
• linux
• unknown

Use OS name when a rule needs the reported operating system name rather than its family. Use Windows product type to distinguish Windows clients from Windows servers. The available product types are Client and Server.

Network Rules

Network fields use the latest network configuration reported by the endpoint agent. IPv4 and IPv6 values share the same fields.

• IP address matches an exact address assigned to any interface.
• Subnet uses is in subnet and is not in subnet with CIDR input such as 192.168.10.0/24 or 2001:db8::/64.
• Default gateway matches a default-route gateway reported for any interface.
• DNS server matches a resolver address reported by a Windows endpoint. Linux endpoints do not report DNS servers for this rule.

IP address and subnet rules exclude loopback, unspecified, and multicast addresses. Link-local addresses can match. The is null operator matches endpoints without a valid reported value. Negative operators also match endpoints without a valid reported value; combine a negative rule with is not null when the endpoint must report the field.

Uptime Rules

Select the Uptime field to group endpoints by how long their operating system has been running. Configure a positive whole-number duration in minutes, hours, days, or weeks, and use one of these comparisons:

• greater than
• greater than or equal to
• less than
• less than or equal to
• is null
• is not null

Ordyn advances the effective uptime while an endpoint is connected. When an endpoint disconnects, its effective uptime freezes at the last time the endpoint was seen. A later inventory update corrects the value after the endpoint reconnects or reboots.

Dynamic group memberships are refreshed periodically. An endpoint that crosses an uptime threshold without sending new inventory can take approximately ten minutes to enter or leave the group.

Endpoint jobs can request an immediate evaluation with the Refresh dynamic group memberships step. Use it after changing a persistent variable or another query input when later work depends on the new membership before the job continues. The step evaluates all dynamic groups available to the current endpoint, so reserve it for workflows that need immediate results. See Available Tasks.

Group Detail

A group detail page can show:

• overview
• endpoints
• assigned jobs
• automations
• configuration profiles
• alert rules
• variable overrides
• query definition
• audit history

Use groups when the same set of endpoints should receive the same automation, configuration, or reporting treatment.

Exporting And Importing Dynamic Groups

Open a dynamic group's Actions menu and select Export JSON to download its versioned definition. The document contains the group's scope, tenant and folder references, name, description, and complete membership query. It does not contain current members, evaluation history, assignments, automations, variable overrides, or audit history. Static groups do not have JSON documents because their membership is made up of environment-specific endpoint assignments.

The group editor provides GUI and JSON modes for dynamic groups. JSON mode edits the same versioned document that export produces. Switch back to GUI mode after the document passes validation and can be represented without losing fields.

Use Library > Import to create a dynamic group from an exported document. During review, map referenced tenants, folders, endpoints, groups, jobs, collectors, and variables to resources in the destination environment. The import creates a new group and opens its overview page.

To export a folder of dynamic groups, open the folder's actions menu and select Export JSON. The collection contains the selected folder, its nested folders, and every dynamic group in that folder tree. Static groups are omitted. Import the collection through Library > Import, select the destination tenant for a scoped collection, and optionally select a parent folder. Ordyn recreates the exported root folder and its nested structure beneath that parent. Global collections remain global.

References between groups in the same collection are mapped automatically. Map references to resources outside the collection during import. The complete collection is rejected if its root folder or a group conflicts with an existing destination resource. No folders or groups are created when collection validation fails.

Dynamic endpoint group documents use schema_version 1, kind endpoint_group, and type dynamic. The complete schema is available in endpoint-group-v1.schema.json.

Folder collections use schema_version 1 and kind endpoint_group_collection. The complete schema is available in endpoint-group-collection-v1.schema.json.