Introduction
The Custom Fields tab on a device shows every custom field defined in your organization — its current value, where that value comes from, and whether it's been overridden at this level. You can edit any field's value here, and that override takes effect for this device only, leaving group and global defaults untouched.
Custom fields are defined in Workspace → Custom Fields. This article covers the device-level view. For creating fields, setting global defaults, or managing group-level overrides, see Workspace → Custom Fields.
⚙️ PREREQUISITES
At least one custom field created in Workspace → Custom Fields
Technician has write access to this device's group
Device Custom Fields
Open any device, then click Custom fields in the left nav under the device name.
The table has 3 columns:
Field name — the name of the custom field, as defined globally. If the value was inherited from a parent scope, a note shows underneath: "Inherited from [source]"
Description — an optional description set when the field was created, explaining how the value is used
Field value — the current value for this device, from whichever scope is providing it
Fields with no value set at any level show -- in both Description and Field value.
Inheritance: Where Values Come From
Custom fields cascade from most general to most specific. Level uses the value from the most specific scope that has one set:
Organization (global default, set in Workspace → Custom Fields)
Group (override for a device group, set in Group Settings → Custom Fields)
Device (override for this device only, set here)
When a field shows "Inherited from [organization name]" beneath the name, the value is coming from the global or group level — this device hasn't had its own value set. When a field has a value but no "Inherited from" note, the value was set directly on this device.
ℹ️ NOTE: The inheritance label shows the name of the organization or group providing the value, not the scope type. "Inherited from Level Demo" means the value comes from the Level Demo organization's global settings or a parent group — not this specific device.
Searching Custom Fields
Use the Search custom fields bar at the top of the table to filter by field name. Useful on organizations with many fields defined globally.
Copying a Field Value
Each row has a copy icon on the right. Click it to copy the field's current value to your clipboard in one click — no need to open the edit panel.
💡 TIP: The copy button uses whatever value is active for this device — whether it came from the device, a group, or the organization. Useful when pulling credentials, tokens, or keys stored in fields.
Editing a Field Value
To set or change a custom field value for this device specifically:
Click the ⋮ menu at the end of the row.
Click Edit.
In the Edit custom field panel, update the Field value.
Click Update custom field.
The panel shows:
Field name — read-only, set when the field was created
Description — read-only, set when the field was created
Field value — the value you're setting for this device
Admin only — read-only indicator showing whether this field is restricted to administrators
Once saved, this device uses its own value rather than inheriting from a group or the organization. Other devices are unaffected.
⚠️ WARNING: Setting a value here overrides any group or global default for this specific device. If you later change the group or global value, this device won't pick up the update — it keeps its own override until you clear it.
Clearing a Device-Level Override
To revert a device back to inheriting from its group or the organization:
Click the ⋮ menu on the row.
Click Clear value.
The field will go back to inheriting from the next scope up (group, then organization). If neither has a value, it returns to --.
How Custom Fields Work with Automations and Scripts
Any value on this device — whether inherited or set directly — is what automations and scripts receive when they reference that field. Level resolves the value at execution time using the most specific scope available.
Common patterns:
Authorized Admins: Define a global list, then tighten or expand it for specific groups or individual devices.
Admin Password: Store a device's local admin password, set per device, marked Admin only. Scripts can retrieve it without it being visible to non-admin technicians.
AV/EDR tokens: Keep client-specific tokens at the group level so they're shared across all devices in that group automatically.
S1 Token: Set an organization-level SentinelOne token as the global default, then override it per client group for billing isolation. Any automation that references the
S1 Tokenfield picks up the right token for whichever device it's running on.
Script monitors can also read custom field values — for example, a monitor that checks whether a running process matches the value in an "Authorized Applications" field.
For details on using custom fields in automations and scripts, see Workspace → Custom Fields.
FAQ
Why does a field say "Inherited from [name]" — does that mean the value can't be changed here? It means the value is coming from a parent scope (organization or group), not that it's locked. You can set a device-level value at any time by editing the field here. That override takes precedence over the inherited value for this device only.
Who can view and edit Admin only fields? Only account administrators can see or change the value of fields marked Admin only. Other technicians can see that the field exists, but the value is hidden. This is typically used for passwords, recovery keys, and sensitive tokens.
I cleared a field value, but it still shows a value. Why? Clearing a device-level override reveals the next value in the inheritance chain — the group or organization default. If a group or global value is set, that's what you'll see after clearing. To remove the value entirely, it would need to be cleared at all levels.
Can I create new custom fields from this view? No. Custom fields are created globally in Workspace → Custom Fields. This view shows all existing fields and lets you set device-specific values, but field creation and deletion happen at the workspace level.
If I set a value here, will automations on this device pick it up immediately? Yes. Level resolves field values at execution time, so the next time an automation or script runs on this device, it'll use the updated value.