Policies

Policies is the part of the Athena console where you set what is enforced on your Windows endpoints. It groups four modules in one place: BitLocker, Sysmon, Power Management and BIOS, which reads BIOS settings, checks them against baselines, and lets an Admin remediate a drifted machine. A fifth module, Restart Policies, restarts machines that are waiting for a restart on Windows, Linux and macOS agents, and Shortcuts puts desktop, Start menu, Dock and web-link shortcuts on Windows, Linux and macOS machines and keeps them there. The Policies landing page shows a short summary card for each one, so you can check your fleet's policy state at a glance before you open a module.

Finding Policies in the navigation#

• Policies is a group in the left navigation, between Commands and Compliance. Its children are BitLocker, Sysmon and Power Management, in that order.
• Click Policies to open the landing page (/policies). The small chevron next to it only shows or hides the child pages and doesn't navigate.
• The group opens by itself when you are on any Policies page. On those pages the top bar says Policies, and the page heading names the module.
• The group lists only the modules you may see. A module is listed when your licence includes it and your role has its view permission. If no module qualifies, the whole Policies group is hidden.

The Policies landing page#

The landing page is headed Policies, with the line "What each module enforces on your agents. Open one to change its policies." Below it there is one card per module you may see. Each card has an Open link to the module's page and shows the following:

Each card also notes Windows agents only. If a card's figures can't be loaded, it shows "Numbers unavailable right now." and its Open link still works. If you may see no module at all, the page says "No policy module is available to you. A module appears here when it is licensed and your role may view it."

The module pages#

Typing a page's address checks your permission in the same way as the navigation. A module page you may not view tells you so instead of opening. An address under /policies/ that doesn't match a module shows "There is no policy page at this address."

Who can see and change what#

Each module has a view permission, which you need to see its page, its card and its agent tab, and a manage permission, which you need to make any change. Without the manage permission a page opens read-only. The built-in roles get these defaults:

The Sysmon REST API follows the same split. Every endpoint under /api/modules/sysmon needs sysmon.view, and every request that changes something also needs sysmon.manage. See Sysmon REST API.

Old addresses#

For one release, the old Settings addresses redirect to their new Policies pages, so existing bookmarks and links keep working:

Update saved links before the redirects are removed. During this release, Settings also shows the note "BitLocker, Sysmon and Power Management have moved to Policies." with a Go to Policies link. Dismiss it with its close button. The dismissal is remembered for each user in that browser.

Related#

• BitLocker Management, Sysmon Configuration and Power Management: the three policy modules that change endpoints.
• Restart Policies: maintenance windows, deadlines and countdowns for machines waiting for a restart.
• Shortcuts: desktop, Start menu, Dock and web-link shortcuts kept in place on Windows, Linux and macOS.
• BIOS Configuration: BIOS / UEFI settings, the model catalog, baselines with drift checks, and remediation of drifted machines.
• Permission Model: module permissions and Roles & Permissions.
• Licensing: separately licensed modules.