The Cybermatic icon on your device: what it shows and means

A read-only status icon in the Windows tray / macOS menu bar; on Linux, `cybermatic-agent status`.

1. 1Agent 2.3.0 and later place a small Cybermatic icon in the Windows system tray and the macOS menu bar. It is purely informational: it reads the agent's status and cannot change anything — settings live in the Cybermatic portal, controlled by your administrators.
2. 2Colors: green/monochrome — all services healthy. Orange — something needs attention (real-time protection off, definitions more than a week old, no contact with Cybermatic for over 24 hours, or the disk isn't encrypted). Red — the device is network-isolated by an administrator, or a critical detection is awaiting review.
3. 3Click the icon for the status panel: agent version and last contact with Cybermatic; Security Posture (last report); Endpoint Protection (mode, engine, real-time protection, definitions age, last scan, encryption, isolation) with the last few detections and their outcomes; SIEM forwarding (last shipment, events today); Network discovery (last run); and any notes explaining an orange or red state. 'Open Cybermatic portal' is the only action.
4. 4Notifications: when a high or critical detection occurs, the icon shows a system notification with the detection title and the action taken — never file paths or user data. Administrators can turn these off under Endpoint Protection → Policies → Local status icon notifications; the icon and panel stay either way.
5. 5Linux: servers rarely have a desktop, so run `cybermatic-agent status` in a terminal for the same panel. Desktop Linux also receives notifications where a notification service is present.
6. 6Network discovery listening posts: a host running only the Cybermatic Discovery agent gets the same icon on Windows (headlined "Cybermatic Discovery" with mode, devices seen last cycle, and last report — orange if a report failed or none arrived in two hours); on Linux run `cybermatic-discovery status`. Hosts running both agents show one icon with a Network discovery line.
7. 7Missing icon? Windows: it starts at sign-in via the 'Cybermatic Tray' scheduled task — sign out and in, or run it from C:\Program Files\Cybermatic\cybermatic-tray.exe. macOS: it's part of Cybermatic Agent.app, started at login; open the app from /Applications if it isn't showing. 'No status yet' means the background service hasn't completed its first cycle — give it a minute.

Tip: The icon reading orange for 'no contact in 24 hours' is the fastest way to notice a laptop that has been offline or blocked from the internet — check the device page in the portal to confirm.