Are there any endpoint protection platforms that handle offline devices and sync telemetry when they're back online?

Yes. Many modern endpoint protection platforms (especially EDR/XDR agents) are designed to work offline and then backfill telemetry when the device reconnects.

What this usually looks like:

• The agent keeps collecting local events while disconnected
• It queues telemetry on disk
• When connectivity returns, it syncs the backlog to the cloud or management console
• Some also continue enforcing policy locally while offline

Examples of vendors/features commonly associated with this:

• Microsoft Defender for Endpoint
• CrowdStrike Falcon
• SentinelOne
• VMware Carbon Black
• Sophos Intercept X
• Trend Micro Vision One / Apex One
• Bitdefender GravityZone
• Elastic Defend

Things to verify in a specific product:

• How much offline telemetry it buffers
• Whether it stores full event history or only a subset
• How long it can stay disconnected before data is dropped
• Whether detections/remediations still run offline
• Whether policy changes wait until reconnect
• Any storage limits or agent performance impact

If you want, I can also give you:

1. a comparison table of offline sync behavior across major vendors, or
2. recommendations for air-gapped / intermittently connected environments.