Matrix42 Device Insights · Sep – Oct 2026

Device Insights: agent-first remediation

A telemetry widget that alarmed people and offered no way out became an app where a service-desk agent sees problems, lets Neo check the device live, approves one fix, and records the outcome.

Role: Design and implementation lead across five repositories
Period: Sep – Oct 2026
Stack: ESM extension (.NET config, flows)Lit + ReactFastViewerMicrosoft IntuneEmpirumCortex tools (Python)constrained PowerShell

commits in the Insights extension
pull requests
repositories and teams
approved fix at a time

The inherited widget on the self-service home was called AI Actions and Intelligent Insights. It showed critical and warning alerts from device telemetry that refreshed once a day, in raw form, to end users who could do nothing about them. Nobody could say who it was for. In a wartime review before the October release we agreed to replace it rather than polish it.

Service desk first, problems not alerts

Insights live in the Service Desk, for agents. End users only see something when there is a decision for them to make.
Problems are grouped into patterns: thirty machines with the same issue is one row, not thirty notifications.
Root cause is on demand: Neo checks the device live through FastViewer, reads only, and reports what it found.
Remediation is one proposed fix from an approved set, shown in plain language with what changes and what the user will notice. Nothing runs until the agent approves; Neo checks again afterwards.
Every outcome is recorded: It's fixed with evidence, Not a problem with a reason, or a ticket carrying the evidence.

Device problem page: what was seen, is it happening now, what you can do, with Neo's brief in the side panel — A problem: what was seen, is it happening now, what you can do. Neo's brief on the right.

Neo proposes a single approved fix with the script it will run — Fix with Neo: likely cause, the one change, the exact script, and a request for approval.

It's fixed dialog: records the problem as fixed with what was checked — It's fixed: what Neo or you checked, saved to the record.

Across the endpoint estate

The same pattern carries to unified endpoint management: a missing patch becomes a vulnerability summary, a root cause (not assigned to any patch group) and a three-step plan the admin approves once. These keynote screens were built in HTML from the real product and shown at the customer conference, together with a booth demo running live on a test tenant.

Patch status page with Neo's vulnerability summary, root cause and remediation plan — Endpoint management: vulnerability summary, root cause, approve the patch.

Incident page after Neo's remediation plan ran and the ticket was resolved — After the fix: the ticket journal shows what ran and that the user confirmed.

How it was built

The app, data model, importers, flows and cards live in the ESM extension; the device checks and fixes are Cortex tools calling FastViewer, Intune and Empirum with a constrained PowerShell runner; the chat is the shared component. I planned the work as agent-executable slices with a human gate each, built on a real test tenant through esm-devkit, kept the end-to-end test rig and the handbook current with every change, and wrote the engineering overview that handed the app to the product team: architecture, status, the 236 leftover fragments to delete, the P0 gaps and a nine-PR cleanup plan.