diff --git a/src/pages/manage/access-control/endpoint-detection-and-response/force-approval.mdx b/src/pages/manage/access-control/endpoint-detection-and-response/force-approval.mdx index 6ac5184e..38fb7e47 100644 --- a/src/pages/manage/access-control/endpoint-detection-and-response/force-approval.mdx +++ b/src/pages/manage/access-control/endpoint-detection-and-response/force-approval.mdx @@ -46,9 +46,17 @@ The peer will immediately gain network access and the `Approval required` status To see all peers that have been force approved: 1. Navigate to the [Peers](https://app.netbird.io/peers) page -2. Use the filter to show only force-approved peers +2. Click the **Force Approved** filter button (shows a count badge with the number of force-approved peers) -Force-approved peers are visually distinguished from naturally compliant peers, making it easy to track which devices have administrative overrides in place. +

+ Force approved filter button +

+ +The filter can be combined with connection status filters: +- Click **Online** + **Force Approved** to see only online force-approved peers +- Click **Offline** + **Force Approved** to see only offline force-approved peers + +Force-approved peers are visually distinguished from naturally compliant peers with a green "Force Approved" badge, making it easy to track which devices have administrative overrides in place. ## Revoke Force Approval @@ -65,6 +73,38 @@ To revoke a force approval and return a peer to normal EDR validation: Once revoked, the peer will be subject to normal EDR compliance checks. If the device is still non-compliant, it will lose network access and show `Approval required` status again. +## Batch Operations + +You can force approve or revoke force approval for multiple peers at once: + +### Batch Force Approve + +1. Navigate to the [Peers](https://app.netbird.io/peers) page +2. Select multiple peers using the checkboxes (peers must have `Approval required` status) +3. In the action bar that appears at the bottom, click the **Force Approve** button (shield icon) +4. Confirm the action in the dialog + +

+ Batch force approve +

+ +The button shows a count of how many selected peers will be force approved. + +### Batch Revoke Force Approval + +1. Navigate to the [Peers](https://app.netbird.io/peers) page +2. Select multiple force-approved peers using the checkboxes +3. In the action bar that appears at the bottom, click the **Revoke Force Approval** button (shield-off icon) +4. Confirm the action in the dialog + +

+ Batch revoke force approval +

+ + + Batch operation buttons only appear when you have an EDR integration enabled and have selected peers that can be force approved or have their force approval revoked. + + ## Automatic Removal of Force Approval Force approval is automatically removed when a device becomes naturally compliant in your EDR platform. This ensures that: @@ -92,15 +132,15 @@ Force approval can also be managed via the NetBird API: ```bash # Force approve a peer -curl -X POST "https://api.netbird.io/api/integrations/edr/peers/{peerId}/force-approve" \ +curl -X POST "https://api.netbird.io/api/peers/{peer-id}/edr/force-approve" \ -H "Authorization: Token " # Revoke force approval -curl -X DELETE "https://api.netbird.io/api/integrations/edr/peers/{peerId}/force-approve" \ +curl -X DELETE "https://api.netbird.io/api/peers/{peer-id}/edr/force-approve" \ -H "Authorization: Token " # List all force-approved peers -curl -X GET "https://api.netbird.io/api/integrations/edr/peers/force-approved" \ +curl -X GET "https://api.netbird.io/api/peers/edr/force-approved" \ -H "Authorization: Token " ```