Skip to content

Hierarchical Policy Engine

Jump to bottom
Tyler Hatfield edited this page Nov 12, 2026 · 3 revisions

Hierarchical Policy & Condition Notification Engine (v2.5.0)

Vitrine RMM features a 4-tier cascading policy inheritance engine (backend/src/services/policy/index.ts) that unifies endpoint security settings, LAPS rotation & offboarding governance, reboot UX, and multi-channel state notifications.

1. The 4-Tier Inheritance Hierarchy

[Tier 1: Global MSP Baseline]
       │
       ▼ (Overridden by non-null tier fields)
[Tier 2: Client / Tenant Level]
       │
       ▼
[Tier 3: Site / Location / Subnet Level]
       │
       ▼
[Tier 4: Device Role (Domain Controller, Database Server, Workstation, POS, Hypervisor)]

Administrators can create, edit, or delete overrides at any tier (GET, POST, PUT, DELETE /api/policies) and inspect the live resolved result for any device via Effective Policy Inspector (GET /api/policies/effective/:deviceId).

2. Governed Policy Attributes

Attribute Description Default Baseline
telemetry_interval_sec Agent CPU, RAM, and disk heartbeat cadence 30s
require_remote_consent Prompt logged-in user before interactive KVM screen share true (false on Server roles)
max_reboot_snooze_hours Maximum cumulative hours a user may defer a patch reboot 8h
forced_reboot_hud_sec Bottom-left countdown HUD timer once snooze limit expires 300s
laps_enabled / laps_account_name Managed local admin account toggle & customizable username Enabled / LocalAdmin
laps_rotation_days / laps_password_length Scheduled LAPS rotation cadence & entropy length (deferred when offline!) 30d / 24 chars
laps_rotate_on_reveal_grace_min Auto-rotate LAPS password X minutes after a technician reveals it 120 min
laps_offboard_*_action Contextual local admin action for Explicit Device, Archived Client, or Deleted Client offboarding keep_account_rotate_final / remove_account
offboard_offline_auto_archive_days Days an offline pending_offboard device waits before auto-archiving 14d
require_mfa_for_secrets Require RFC 6238 Step-Up TOTP before revealing LAPS or BitLocker true
self_healing_max_runs_per_hour Circuit-breaker threshold before halting flapping watchdogs 3 runs/hr

Offline LAPS Safety: Whenever a scheduled LAPS rotation triggers for an offline device, Vitrine defers the rotation (rotation_pending_online = 1) until the endpoint returns online — or skips it entirely if lifecycle_state = 'pending_offboard' — guaranteeing Vitrine's vaulted password never diverges from the offline OS.

3. Configurable Multi-Channel State & Condition Notification Matrix

Every policy tier (Global, Client, Site, Role) includes a granular Condition & State Alerting Matrix (alert_rules_json) evaluated continuously by the background scheduler (POST /api/alerts/evaluate & GET /api/alerts/events):

Tracked Conditions

  1. Endpoint Offline > X Days (endpoint_offline_days, e.g., > 7 days for Workstations or > 0.05 days for Servers)
  2. Disk Free Space Critical (disk_free_percent, e.g., < 10%)
  3. Sustained High CPU (cpu_high_percent, e.g., > 90%)
  4. Critical Memory Pressure (ram_high_percent, e.g., > 92%)
  5. Pending Reboot Overdue (pending_reboot_days, e.g., > 7 days)
  6. Disk Encryption / BitLocker Unprotected (bitlocker_unprotected)
  7. EDR / Antivirus Inactive or Outdated (edr_inactive)
  8. S.M.A.R.T. Disk Health Degraded / Failing (smart_unhealthy)
  9. Self-Healing Circuit Breaker Tripped (watchdog_tripped)
  10. Specialty / Network Appliance Offline (appliance_offline)
  11. WAN SSL / TLS Certificate Expiring < X Days (ssl_cert_expiring_days, e.g., < 14 days)
  12. Hardware Delta or Rogue Network Drift Detected (drift_detected)

Independent Delivery Channels & Cooldowns

For each condition at each policy tier, administrators independently toggle:

  • Web UI Notification Bell (notifyUi) — Real-time alert banner & notification center badge.
  • SMTP Email Dispatch (notifyEmail) — Outbound TLS email to configured alert recipients (with optional per-tier override recipient address).
  • Direct PSA Ticket Creation (createTicket) — Opens a structured incident ticket in the local PSA queue and syncs with ITFlow.
  • Deduplication Cooldown (cooldownHours) — Prevents alert storms while an endpoint remains in the same fault state, automatically resolving once telemetry recovers.

Clone this wiki locally