Fleet Management

What is Noah Fleet?

Noah Fleet is a separate product (noah-fleet) that works alongside the Noah desktop app. While Noah runs locally on each device handling IT problems one machine at a time, Fleet gives IT administrators a bird's-eye view of every enrolled device.

With Fleet, admins can:

• Monitor device health — See health scores, grades, and per-category breakdowns for every machine in the organization.
• Push playbooks — Author and distribute custom playbooks to all devices or specific groups. See fleet playbooks for details.
• Dispatch remediations — Send targeted fix instructions to a specific device when an issue is detected.
• Enforce policies — Control which health categories are active, ensuring consistent compliance standards.
• Review activity — See session reports, playbook run results, and auto-heal events across the fleet.

Enrollment

Enrolling a device links it to your organization's Fleet dashboard. The process takes about 30 seconds.

How to enroll

1. Admin generates an enrollment URL from the Fleet dashboard. The URL looks like: https://fleet-dashboard/enroll/TOKEN
2. User opens Noah and navigates to Settings > Fleet.
3. User pastes the enrollment URL into the enrollment field.
4. Noah registers with the fleet, sending the device's hostname and OS type.
5. Fleet responds with a device_id, device_token, and fleet_name.
6. Noah saves the configuration to dashboard.json in the app data directory.

Config file location

What gets synced: device to fleet

Once enrolled, your device periodically sends status data to the Fleet dashboard. This gives admins visibility into device health without needing remote access or screen sharing.

Health scores

Every 6 hours (or after an on-demand health check), Noah sends:

• Overall health score — A numeric score representing the device's current health.
• Health grade — A letter grade (A through F) derived from the score.
• Per-category breakdowns — Individual scores for security, updates, performance, backups, network, and other categories.

Session reports

When a user completes a support session with Noah, a summary is sent to Fleet:

• Session title and summary
• Number of messages exchanged
• Whether the issue was resolved
• Session duration

Playbook run reports

Every playbook execution — manual, auto-heal, or fleet-dispatched — generates a report:

• Playbook slug and content hash (version)
• How it was triggered (user, auto-heal, fleet dispatch)
• Steps completed and tools used
• Health score before and after
• Success or failure status

Auto-heal events

When Noah's auto-heal system runs a fix autonomously, Fleet receives:

• Which health check failed
• Which playbook was activated
• The resulting score improvement (or lack thereof)

What gets pushed: fleet to device

Fleet is not just a read-only dashboard. Admins can push configuration and content down to enrolled devices.

Enabled health categories

Admins can control which health categories are active on a device. For example, an admin might disable the "backups" category for servers that use a centralized backup system, or enable a stricter security posture for devices handling sensitive data.

Fleet name

The organization's fleet name is synced on each checkin. If an admin renames the fleet in the dashboard, the new name is reflected on all devices at their next checkin.

Assigned playbooks

Admins can author playbooks in the Fleet dashboard and push them to devices. These arrive as source: fleet playbooks and take the highest precedence in Noah's playbook registry. See fleet playbooks for full details on delivery, precedence, and cleanup.

Remediation actions

Admins can dispatch targeted fix instructions to a specific device. See Fleet actions below.

Checkin cycle

Enrolled devices communicate with Fleet on a regular cadence. Understanding the checkin cycle helps explain when changes take effect.

Timing

• Every 6 hours — Aligned with Noah's health check cycle. When a scheduled health check completes, the device checks in with Fleet.
• After on-demand health checks — If a user manually triggers a health check, a checkin happens immediately after.

What happens during a checkin

1. Device sends its current health score and category breakdowns.
2. Fleet responds with any policy updates (enabled categories, fleet name) and the list of assigned playbooks.
3. Noah downloads any new or updated playbooks and removes any that have been unassigned.
4. Device polls for pending remediation actions.

Token revocation

If the Fleet server responds with a 401 Unauthorized status (meaning the admin has removed the device or revoked its token), Noah automatically unlinks the device. This is a security mechanism — an admin can cut off a compromised or decommissioned device immediately.

Fleet actions & remediation dispatch

Beyond passive monitoring, Fleet lets admins take direct action on individual devices. This is how you push a fix to a specific machine without waiting for the user to report a problem.

How it works

1. Admin identifies the issue in the Fleet dashboard — a device with a failing health check, a low score, or a reported problem.
2. Admin dispatches an action targeting that device. An action includes:
   • check_id — Which health check the action addresses
   • action — A hint describing the fix (e.g., "Clear DNS cache and reset network settings")
   • playbook_slug (optional) — A specific playbook to run for the fix
3. Device picks up the action at its next checkin (or poll).
4. Noah executes the fix — either by running the specified playbook automatically or presenting the action to the user for approval.
5. Status is reported back to Fleet: completed or failed, along with details of what happened.

Unlinking from Fleet

A device can be unlinked from Fleet at any time, either by the user or by an admin revoking the device token.

User-initiated unlinking

1. Open Noah and go to Settings > Fleet.
2. Click Unlink.
3. Noah removes the dashboard.json config file.
4. The device token is invalidated — the Fleet dashboard can no longer reach this device.

Admin-initiated removal

When an admin removes a device from the Fleet dashboard, the device's token is revoked. At the next checkin, Noah receives a 401 response and auto-unlinks.

What happens to playbooks

• Fleet playbooks (source: fleet) are cleaned up at the next pass. The .md files are removed from disk.
• Bundled playbooks are unaffected — they ship with the app.
• Local playbooks are unaffected — your custom files are never touched.

Security model

Fleet communication is designed with a minimal-trust, minimal-data architecture.

Authentication

• Every request from a device to Fleet includes a Bearer token in the authorization header.
• The token is issued during enrollment and stored in dashboard.json.
• If the token is revoked (admin removes the device), any subsequent request returns 401 Unauthorized, and Noah auto-unlinks.

Transport

• All communication between the device and Fleet happens over HTTPS.
• No data is sent over unencrypted channels.

Data minimalism

• No raw data leaves the device. Health scores are computed locally. Fleet receives numeric scores and grades, not the underlying system data (process lists, file paths, etc.).
• No persistent fleet data on device. The only Fleet-related file on disk is dashboard.json (containing the device ID, token, and fleet URL). All health data is computed fresh each cycle.
• Session reports are summaries, not full transcripts. Fleet sees titles, summaries, and resolution status — not the full conversation.

For admins vs. users

Fleet serves two audiences with different needs. Here's a quick reference for what matters to each.

If you're an end user

If you're an IT admin