NovacoastDevice and fleet intelligence
Build hardware, software, network, storage, and package inventory. Use scoped live queries and retained query history to investigate device state and inform operational decisions.
Orkestrate / Endpoint operations
Bring your fleet into focus. Put operations in motion.
Orkestrate is a self-hosted endpoint operations platform that connects device management, software delivery, fleet intelligence, and exposure management in one control plane.
One connected operating model
Understand the endpoint before you act on it.
Endpoint work spans administration, application delivery, inventory, and security investigation. Disconnected tools make it harder to connect a finding to the device state and operational action behind it.
Orkestrate brings those disciplines together, with a native macOS endpoint agent and fleet operations for Windows and Linux. Teams can organize devices, inspect inventory, run scoped queries, and deliver software through a shared control plane.
Validate operating-system coverage, packaging requirements, and deployment prerequisites for your environment with Novacoast before planning a rollout.
Core capabilities
See the fleet. Deliver change. Investigate exposure.
Software delivery
Distribute applications, packages, scripts, and Homebrew titles to device groups. Runner-side caching, preflight controls, and device-level deployment progress support managed rollouts.
Exposure management
Correlate current inventory with CVE intelligence. Investigate normalized, OCSF-aligned vulnerability findings by device, severity, and affected software to focus follow-up work.
Runner-mediated architecture
A central control plane. A deliberate communication path.
Endpoint layerAgents and administrators
Managed endpoints and administrative clients communicate through runners rather than connecting directly to the central server.
Intermediary layerRunners close to the fleet
Runners mediate communications, cache packages locally, and support runner-aware routing across the locations where endpoints operate.
Control layerSelf-hosted control plane
The central system of record brings fleet information and operational controls into infrastructure managed by your organization.
This is a conceptual architecture, not a live environment view. Runner placement, connectivity, and trust configuration should be designed for your network.
Security and governance
Keep access intentional and actions accountable.
Orkestrate supports mutual TLS, server authentication, rate limiting, and encrypted system-to-system communication. Its runner-mediated model avoids a direct client-to-central-server path.
Role-based access control and OIDC group mapping connect operational permissions to team responsibilities. Audit trails provide a record of administrative activity for investigation and internal review.
Self-hosting gives your organization control over deployment and operational data, along with responsibility for configuration, maintenance, and access policy. Security features and audit records do not by themselves establish regulatory compliance.
Three-step workflow
Move from fleet context to a measured change.
Enroll and organize
Bring endpoints into management, establish device groups, and review hardware and software inventory to understand the starting state.
Investigate and scope
Use inventory, scoped queries, and vulnerability findings to identify affected devices and determine the software or operational change required.
Deliver and review
Deploy packages or scripts through runners, review device-level progress, and use subsequent inventory and queries to validate the resulting state.
Where it fits
Built around the work of endpoint teams.
Distributed IT operations
Organize devices across sites and use runner-local package caching to bring software delivery closer to the endpoints that need it.
Application lifecycle management
Identify installed versions, scope software changes to device groups, and inspect rollout progress instead of treating delivery as a single unverified action.
Security investigation
Connect vulnerability findings to affected devices and installed software, then use fleet queries to gather context for prioritization and remediation planning.
Questions, answered
Planning an Orkestrate deployment.
Where does Orkestrate run?
Orkestrate uses a self-hosted control plane with runners positioned to serve your endpoint environment. Discuss hosting, network boundaries, and runner placement with Novacoast when evaluating a deployment.
Why are runners part of the architecture?
Runners are the intermediary between endpoints or administrative clients and the central control plane. They also provide local package caching and runner-aware routing for distributed operations.
What can teams deliver to endpoints?
The platform supports applications, packages, scripts, and Homebrew software, with device-group targeting, preflight controls, and deployment visibility. Confirm supported formats and operating-system requirements for your software estate.
Does a vulnerability finding prove a device is exploitable?
No. Inventory-to-CVE matching identifies potential exposure for investigation. Teams still need to assess version accuracy, configuration, reachability, and business context before selecting and validating remediation.
Connect your endpoint operations
Design the next step around your fleet.
Talk with Novacoast about your endpoint estate, software delivery needs, and the architecture for a self-hosted Orkestrate deployment.