Reporting Setup Checker

This page gives you a temporary receiver URL. Point a pilot endpoint's ReportingEndpoint policy at it and watch the extension's events and heartbeats arrive below, so you know your configuration works before you wire up your own webhook or SIEM.

This checker is for MSPs running their own receiver instead of the Osprey Management Console.

Console customers do not need it. When you enroll a device, it appears on the client's Devices page with its first heartbeat, and detections are shown under Events, which verifies the whole reporting chain including the ingest key. The one time this page helps a console customer is debugging a device that never shows up, by temporarily pointing that single machine here to prove the extension is reporting at all.

1. Your test URL

Receiver baseSelf-hosters can point this at their own OspreyProxy instead.Test endpoint URLSet this as the ReportingEndpoint policy on a pilot endpoint, through Group Policy, Intune, a plist, or the config generator. Optionally set any ReportingAuthToken to verify the Authorization header arrives too.

The session holds the last 30 payloads in memory only and expires 30 minutes after the last activity. Nothing is stored. Use it to verify configuration, then point your fleet at your real receiver.

2. Checks

Waiting for the first payload. This page polls every 4 seconds.

Heartbeat receivedThe extension sends one on startup and every 15 minutes.
Event batch receivedSent on startup and every 5 minutes when there are detections or overrides to report. Visit a test page like malware.wicar.org, or use the extension normally to generate one.
DeviceTag is setWithout it you cannot tell which machine an event came from.
SiteId is setWithout it you cannot tell which client an event came from.
Authorization header presentOnly expected if you set ReportingAuthToken. Your real receiver should reject requests without it.
Proxy reachable from the endpointThe heartbeat probes the configured proxy origin and reports the result.

3. Received payloads

Building your real receiver

Your production receiver only needs to accept a JSON POST and return a 2xx status. Payloads are told apart by the top-level kind field, which is either events orheartbeat, and every event carries a stable id you should deduplicate on. The full payload schema, delivery semantics, and retry behavior are documented in the extension repository's docs/outbound-events.md. Alert on a missing heartbeat rather than waiting for a removal message, because a removed extension cannot report its own removal.