Security agents

What a security agent does

An investigation is a sequence of questions, each one decided by the answer before it. The analyst who is good at it is good at knowing what to look at next, and spends most of the shift collecting rather than deciding. The collection is the part that can be handed over — provided nothing is changed by collecting it.

• Follow an alert from the log platform to the endpoint tool to the machine.
• Audit one setting across the whole estate and answer per machine.
• Report the branches that were tried and found empty, not only the ones that led somewhere.
• Stop before containment and wait for the person who owns the decision.

The collection those bullets describe is what an agent carries out on the hosts themselves:

Every answer shows the exact commands that ran, their exit codes and output, per host.

The hosts and skills behind it

Host Advisor inspects enrolled machines and returns what it ran; the named investigators around it are agent objects composed on top of that same execution and evidence.

Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.

A host joins the fleet with one install command and an enrollment token; revoking the host unpairs it.

Skills come from a signed vendor catalogue or your own uploads, and can be enabled or disabled per workspace.

The primitives it composes

An agent is a model, a set of approved skills, tools and a policy, applied to a scope.

A skill declares what it can and cannot do, the tools it needs, the paths it may read, and how it is evaluated.

Agents reach your systems through approved connectors — APIs, databases, applications — each with its own permissions.

Changes wait for human approval before they run.