Agent Management

Agent Properties Modal

Open it with Configure on the agent row, then View Health. The modal has five sections:

1. Information Grid

  • Server Name, Agent ID, Type, Status (with colored indicator), Last Heartbeat, Version, Environment, Mode, Tags

Server Name follows the host machine name. If you rename the underlying computer, the agent picks up the new name on its next start-up and reports it, and the dashboard updates automatically on the following heartbeat — no manual edit needed.

2. Health Metrics

  • CPU and Memory usage cards with color-coded thresholds (green/yellow/red)
  • Values from the latest health report (updated every 30 seconds)

3. Collection Control

  • Start Full — begins continuous ETW collection
  • On-Demand — starts time-limited collection
  • Stop — ends all ETW collection, returns to Health Only

A status bar shows the current collection state and active provider count.

4. Interactive Query Session

  • Current session ID and event count (if active)
  • Begin Session / End Session buttons to control live sessions from properties

5. Delete Agent

  • Requires two confirmations before proceeding
  • Sends a silent uninstall command to the agent ("C:\Program Files\ETDucky\Agent\uninstall\unins000.exe" /VERYSILENT) via the existing SSE shell channel
  • Modal closes immediately; a countdown toast shows the remaining time before database removal
  • After 15 seconds, the agent record and all associated data are permanently deleted from the database
  • The agent process self-terminates via the uninstaller; the subsequent heartbeat 401 is expected and benign

Inventory Drawer

The Inventory button in the Agent Health modal opens a drawer on the right with the host's latest inventory report. The same drawer opens from the bar that appears when you tick one agent in the list (Inventory); with several agents ticked that button is inert and points to the fleet view under Systems, Patch Management, Agents, By app. The bar's Monitoring button applies a monitoring preset to every ticked agent. The agent reports at start-up and every 24 hours. The tabs are OS, Software, Services, Scheduled, Sockets, Modules and Persistence. The header shows the agent id, platform and the time of the report.

Software tab

One row per installed application with Name, Version, Source (winget, registry, hotfix, a Linux package manager, or MSIX / Store), Publisher, Installed date, Installed for and Install path. The table is wider than the drawer, so scroll it sideways to reach the last two columns.

  • Installed for reads All users for machine-wide apps. On Windows, apps installed in one user's profile show that user's account name. The agent reads a user's list while that user is signed in. While the user is signed out, the agent keeps sending the last list it read, and the row reads signed out, list as of <date>. The list is read again at the next sign-in. Lists for deleted profiles, and lists older than 90 days, are dropped.
  • Install path is the folder the app is installed in when the agent can determine one: the installer's recorded location or the folder of the main program on Windows, the snap mount for snaps on Linux. dpkg, rpm and flatpak packages have no single install folder and show none. Hotfixes and some redistributables show none.
  • MSIX / Store rows are Microsoft Store and other MSIX packages, listed for the user they are installed for, with the package family name in the Source column and the WindowsApps folder as the path. Store-signed apps and sideloaded (developer or enterprise signed) apps are listed. Frameworks, resource packages and Windows inbox components are left out.

Refresh

Refresh asks the agent for a new inventory now. The drawer waits for the agent to report, then reloads with the new report time and Updated just now. A Windows pass runs winget and the offline Windows Update search, so it usually takes 15 to 60 seconds. If no new report arrives within two minutes, for example because the host is offline, the drawer says so and keeps the previous report; the agent reports at its next check-in.

Agents older than 2.8.1.0 send the machine-wide list only. Their rows read All users with no path until the agent updates. Linux agents do not report per-user or Store rows.

Remote Management

Collection Control

  • Start Full/On-Demand/Stop buttons in Properties modal
  • Agent picks up commands on next heartbeat (within 30 seconds)
  • Live Sessions automatically start and stop collection

Configuration Push

  • Changes in the Configure modal are saved server-side
  • Agents poll for updates every 30 seconds
  • Server-side config overrides local AgentConfig.json
  • No agent restart required for most settings

Applying a preset to many agents

Tick agents in the All Agents grid and choose Configuration in the selection bar to apply one monitoring preset across the whole selection. This is the fastest way to move a set of hosts off Health Only — the one preset that stops behavioural detection and app-baseline learning — and back onto Minimal Monitoring.

  • Presets only, by design: a preset states capture posture, mode and providers explicitly, so every selected agent lands on the same known state. A partial field edit would leave each agent keeping whatever it already had for the keys you did not set.
  • Requires the Technician privilege (administrators and owners have it). Members see the button but get a clear refusal, because the server decides, not the browser.
  • Agents under network isolation and unlicensed agents are skipped, and you are told which ones and why rather than being given a count.
  • Every bulk push is recorded in the audit log with the operator, the preset name, the agents it reached and the agents it skipped.