We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
Correct the MAC-rotation claim, add the reverse-proxy ingress option The agent re-reads the MAC on the same cache as the IP and reports it on the next score report, and the address object is named after the device rather than its MAC, so a rotation updates the object instead of breaking the key. Cost is a propagation window, not a failed match. On-premise ingress can also be a reverse proxy, as done for self-hosted Netbird, so present that alongside direct exposure and note that FortiGate trusted hosts then has to allow the proxy.
Document that overlay/endpoint integrations have no IP or MAC fallback NetBird, Tailscale and Netskope address devices only by an identity the vendor's own client issues. Saying a device without that identity is 'silently skipped' left it open whether EDAMAME falls back to the IP or MAC it also holds. It does not, and cannot: an enforcement point that keys on its own identifier has no way to resolve an address it never issued. Spell out the consequence per provider, since it differs and is never neutral: omission from the NetBird group, active deauthorization from the Tailscale tailnet, and denial by the allow-on-tag policy in Netskope. All three fail towards denial, so a broken agent cannot leave a device authorized.
Add integration principles and architecture page