Posture Checks

A posture check is a named set of conditions a device must meet: a minimum client version, an allowed country, office hours, an encrypted disk, a running security agent, and more. On its own it does nothing. It acts where you attach it, and blocks the device there while it fails:

• Policies: the device loses the policy's access. See Policies.
• Profiles: an Enterprise Workspace blurs its work apps, and a domain setting of the browser extension or Enterprise Browser stops applying. See Profiles.
• Published applications: the user is refused at the application's address. See Published Applications.

Edge filters and guardrails carry no posture checks.

Manage posture checks under Endpoint > Posture Checks.

How it works

1. You create a posture check with one or more check cards turned on.
2. You attach it to a policy, a profile's workspace or domain setting, or a published application, and choose whether All attached checks must pass or Any one.
3. The device's Netzilo client evaluates the checks against what it observes on the device and reports the result. A check that fails blocks the device where the check is attached, and the failure is recorded under Activity > Events.
4. A client that meets a condition it cannot evaluate, because it is older than the condition, treats it as failed.

The Security Score indicators on a peer's page show the signals most checks read. Use them to predict a check's result before you attach it; see Peers.

The posture checks list

Filter with Active and All, or search by name and description. A check that is in use cannot be deleted; remove it from every policy, profile and application first.

Create a posture check

1. Click Add Posture Check. In a policy, profile or application, you can also click New Posture Check on its Posture Checks tab.

   

2. On the Checks tab, click a card, configure it and click Save. Its pill turns ON. Turn on as many cards as you need. Clicking ON asks to disable the check and discards its settings.

3. Click Continue. On Name & Description, enter Name of the Posture Check, for example Managed Windows laptops, and an optional description.

4. Click Create Posture Check.

Every card that is turned on must pass for the posture check to pass.

Check types

Netzilo Client Version Check

Allows only devices whose Netzilo client is at least the version you enter under Minimum required version, for example 5.1.0. Pair it with the Version column of the peers list, which marks clients that have an update available.

Geolocation (Country & Region) Check

Judges the location of the device's public IP address. Choose Allow or Block and add countries, optionally narrowed to a city, with Add Location.

• An Allow list blocks every other location.
• A Block list allows every other location.

The lookup uses the public IP address, so devices behind another VPN or a mobile carrier can appear somewhere unexpected. On a self-hosted server, this check needs the GeoLite2 database; see Geolocation database.

Date & Time Check

Allows access only within the time windows you define. Click Add Rule, and in Date & Time Settings set Start Time, End Time and TimeZone, choose Daily, Weekly (pick the weekdays) or Monthly (pick the months), and optionally a Start date and an End date. Rules are evaluated in the rule's own time zone.

Operating System Check

Judges the operating system and its version. Each tab, Linux, Windows, macOS, iOS and Android, has Allow or Block. With Allow, choose All versions or Equal or greater than a named version such as Windows 11 or macOS Sonoma, or turn on Use custom version number.

• An operating system set to Block is refused.
• Only the operating systems the check allows pass. Any other, including one the check does not recognise, is refused.
• For Linux and Windows the kernel version is compared. Examples: Windows 10 22H2 is 10.0.19045, Windows 11 23H2 is 10.0.22631, Windows Server 2022 is 10.0.20348, and a Linux kernel is a number such as 6.1. For macOS, iOS and Android, the system version is compared, such as 14.3 for macOS Sonoma.

Peer Network Range Check

Judges the device's local and public IP ranges. Choose Allow or Block and add ranges such as 172.16.0.0/16 with Add Network Range. For example, block a routing peer's access while it is in the office network.

Peer Domain Membership Check

Judges the directory domain a Windows device is joined to. Choose Allow or Block and add domains with Add Domain. Enter the short NetBIOS name, such as CORP, not the full domain name. Devices joined only to Entra ID report no domain.

Endpoint Security Settings Check

Requires device security settings. Every item you turn on must pass.

Because each item reads a different source on each system, put per-system requirements in separate posture checks and attach them with Any evaluation.

Advanced Endpoint Settings Check

Requires the presence or absence of indicators on the device. Every item you turn on must pass. The icons next to each item show the systems it applies to.

For Registry Key & Value, File & Folder and Running Processes, choose whether all listed entries or any one must be found.

Netzilo Gateway

Use this item to write a policy that admits browser users of clientless access and nobody else.

• Turn on nothing else in the same posture check. Every other item fails for a browser session, so the check would admit nobody.
• Attach it to network policies only. On a profile's domain setting or a workspace, the device's own client evaluates it and blocks itself.
• It never passes at a published application's address; do not add it to an application's posture checks.

A peer that passes this item shows the Netzilo Gateway indicator on its page.

Netzilo Extension

On a published application, this item asks the extension in the user's browser directly. When it is the only item the user fails, the sign-in dialog shows Additional Protection Required and offers to add the extension, or to connect an installed one to this server.

Older clients

Clients before version 5.0.455 receive a posture check that contains the Netzilo Gateway or Netzilo Extension item as a client version requirement, and fail it with the client version reason. Clients 5.0.464 and later treat any condition they cannot evaluate as failed. Upgrade clients between 5.0.455 and 5.0.463.

Registry Key & Value, File & Folder, Running Processes

Click Add Key or Add Path to add entries. Paths accept wildcards, such as C:\Program Files\EDR\*. File paths expand with the system account's environment.

Attach a posture check

To a policy

1. Go to Network > Policies and open the policy.

   

2. Select the Posture Checks tab.

   

3. Click Browse Checks, select the posture checks and click Add Posture Checks (n).

   

4. Under Posture Check Evaluation, choose All or Any.

5. Click Save Changes.

   

Posture checks on a policy are evaluated against the policy's source peers.

To a profile

Open the profile under Endpoint > Profiles. Open the Enterprise Workspace card, or a domain's Domain Settings in the Enterprise Browser or Enterprise Browser Extension card, and use its Posture Checks tab. See Enterprise Workspace and Browser Extension.

To a published application

Open the application under Network > Applications and use its Posture Checks tab. These checks are judged when the user signs in at the application's address, against the device the browser runs on: the browser and its connection, the Netzilo extension or Enterprise Browser in use, and the posture the Netzilo client on the device reports. The Enterprise Workspace item there reads the client inside the workspace, and the Enterprise Browser item reads the browser's User-Agent. Items a device without the client cannot satisfy fail for it. See Posture checks on the application.

Browser sessions and reverse-proxy peers

Clientless-access sessions (vp-<n>-PROXY) and published-application tunnels (vp-<n>-RPROXY) are not managed devices:

• Operating System reads the system the browser reports. Browsers report macOS as 10.15.7 and Windows 11 as 10.0, so minimum versions above those fail.
• Netzilo Client Version reads the browser extension's version for a browser session.
• Country & Region and Peer Network Range read the browser's public IP address.
• Every endpoint item, such as the security settings, Workspace, Browser, Virtual Device, Device Integrity, registry, files, processes and domain, fails with the reason Endpoint checks cannot be satisfied by a browser session.

Give browser users their own policy without endpoint checks. See Clientless Access.

Failure reasons

When a check fails on a policy, Activity > Events records Peer access blocked (peer.access.blocked) with the posture check, the policy and a reason. A published application records published_app.access_denied and shows the reason to the user. Profiles record workspace.posture.check or browser.posture.check.

The event is written only while a destination peer is connected, so a missing event does not prove that nothing was blocked. The device's own log records every failure.

Creating, changing and deleting posture checks is recorded as posture.check.created, posture.check.updated and posture.check.deleted.

Troubleshooting

Users are blocked unexpectedly. Look for Peer access blocked under Activity > Events: it names the posture check, the policy and the reason. Fix the device setting, or change the check.

A check has no effect. It is not attached: the Used by column reads No Policies, No Profiles and No Applications. Or another policy, such as the default one, still allows the same access.

Every ordinary device lost access. The check uses the Enterprise Workspace, Enterprise Browser or Netzilo Gateway item on a policy for ordinary devices. Move the item to a check attached only to the matching peers.

An Operating System check blocks every Windows device. The version was entered as a marketing version, such as 11, instead of a kernel build. Use 10.0.22000 or later, or pick the named version.

A Country & Region check blocks everyone on a self-hosted server. The server has no GeoLite2 database. See Geolocation database.

A compliant device fails Endpoint Security Settings. Open the peer's page and check which indicator is off, then read what that item checks in the table above.

A Date & Time check is off by hours. Rules are evaluated in the rule's time zone. Set the TimeZone explicitly.

Old clients fail a check with the Netzilo Gateway or Netzilo Extension item. Upgrade the clients, or keep such checks on policies meant for browser sessions only.

A posture check cannot be deleted. It is in use. The Used by column shows where; remove it there first.

The last button reads "Upgrade Plan". The account is on the Free plan.

Related Documentation

• Policies - Attach posture checks to network access
• Profiles - Posture checks on workspaces and domains
• Published Applications - Posture checks at an application's address
• Clientless Access - How browser sessions are judged
• Peers - The device signals behind the checks
• Geolocation database - Country & Region on self-hosted servers