Configuration Modal

Click Configure on any agent to open the Configuration modal. Changes are queued as a config command, pushed to the agent over its live connection, and applied by merging into the agent's local AgentConfig.json. If the agent is offline, the change is picked up the next time it polls.

The modal has three parts: baseline settings, remote desktop capabilities, and provider restrictions. They are independent — applying a preset does not change provider restrictions or remote desktop capabilities, and setting a provider restriction does not change the baseline preset.

Baseline Settings

• Minimum Event Level: Errors Only, Warnings & Errors, Informational & Above, or All Events
• Event Collection (ETW): which of the agent's baseline Windows event providers are on at idle (File I/O, Registry, Process, Network, Disk I/O, Image/DLL Load, Thread, Virtual Memory)
• System Metrics: health metric collection interval, plus Disk Space / Process / Service metric toggles
• Performance: max buffer size, batch interval, and max events per query

Remote Desktop

Two capabilities, both off on every agent unless they are granted under Systems → Security, for the whole organization, a tag, or a single agent. This section of the modal links to that page and has no switches of its own. They govern what a remote-control operator may do with the Windows secure desktop: the sign-in screen, the lock screen, the Ctrl+Alt+Del screen and UAC elevation prompts.

• Allow Ctrl+Alt+Del: lets an operator raise the secure attention sequence on this host. Windows will not permit software to do this unless a machine policy allows it, so while this is on the agent sets that policy (SoftwareSASGeneration) and records the previous value; turning it back off restores exactly what was there before, or removes the policy if there was nothing. Note that the policy is machine-wide: while it is on, any local process can raise the sequence, not only ET Ducky.
• Allow viewing and control of the secure desktop: lets an operator see the secure desktop and type into it. Requires the setting above; on its own it does nothing. Without it, raising Ctrl+Alt+Del freezes the operator's view on the last frame of the user's desktop and their input goes nowhere, because Windows admits only the operating system to that desktop. Granting it means an operator can enter credentials at the sign-in screen and approve elevation prompts on this host, and it runs one additional SYSTEM process in the signed-in user's session for the length of each remote session. Keystrokes and captured frames are never logged.

Both take effect when the agent service next restarts rather than immediately: the capability is evaluated at service start. The Security page describes the architecture and the exact registry value, and the Remote Desktop page describes what an operator sees in each combination.

Provider Restrictions

A live session (started from the dashboard) and inflection-driven root-cause analysis both choose which ETW/eBPF providers to turn on automatically, without an operator picking them in the moment. Provider Restrictions is a deny-list: check a provider to prevent it from ever being turned on by either of those two paths on this agent. Leaving a provider unchecked (the default) does not turn it on by itself — it just leaves it eligible to be turned on dynamically when needed.

Provider restrictions do not apply to the agent's own small always-on idle baseline (the Event Collection (ETW) toggles above, and the fixed minimum-capture floor the agent runs regardless of configuration). A restriction change takes effect the next time the agent starts a live session or an inflection escalation fires — no agent restart required.

Configuration Presets

Presets set baseline settings only. They do not touch provider restrictions.

There are four presets, listed here from least to most capture. The first three capture continuously and differ only in how much; the fourth captures nothing at all and is described separately below, because choosing it turns features off.

Minimal Monitoring (default)

• Errors only. File I/O, Registry, Process, and Image Load events; Network, Disk I/O, Thread, and Virtual Memory off.
• Health metrics every 5 minutes. Disk space metrics only (no process/service metrics).
• Capture posture: Continuous. This is the floor at which behavioural security detection and application baseline learning still work — Process, Image Load and File I/O are the three providers those features read.

Image Load is on in this preset even though it looks like a detail you could drop. Behavioural detection, anomaly bracketing and the application fleet baseline all read the same capture stream, and removing Image Load from it degrades all three at once. If you are trying to reduce agent load below this, the answer is Health Only rather than a hand-trimmed Minimal.

Standard Monitoring

• Warnings and errors. File I/O, Registry, Process, Network, Disk I/O, Image Load, and Thread events on; Virtual Memory off.
• Health metrics every 60 seconds. Disk space and process metrics.
• Idles at approximately 250 MB RAM. CPU usage is not listed here because it depends on the host's CPU, not on the preset.

Production Server

• Warnings and errors. File I/O, Process, Network, Disk I/O, and Image Load events on; Registry and Thread off.
• Excludes noisy paths by default: Windows Prefetch, Windows Temp, Windows Update staging, Windows Defender, and IIS logs.
• Health metrics every 30 seconds. Disk space, process, and service metrics.

Health Only

Health metrics and nothing else. No kernel capture at all. Capture starts only for a live session or an operator-triggered escalation, and stops again when that ends.

This is the one preset that turns features off. Applying it asks you to confirm, and lists what stops:

• Behavioural security detection — ransomware kill-chain, mass file access, reverse shell, privilege escalation and unusual outbound rules all stop firing on this agent.
• Application baseline learning — the agent stops contributing observations, and existing per-app profiles go stale.
• Anomaly bracketing — inflections are still detected from health metrics, but they arrive with no ±30 s of kernel events attached, so root-cause analysis has far less to work with.

Those three features read the same capture stream, so they stop together. Health, availability, patch status, inventory, remote control and scripted commands are unaffected — the agent stays fully manageable, it just stops watching the kernel.

Health Only is the right choice for a host where capture overhead genuinely is not acceptable, or one already covered by another security product. It is not the right choice for "quiet by default": Minimal Monitoring is the low-overhead preset that keeps detection working, which is why it is the default. If you have a fleet on Health Only and are wondering why the security dashboard is empty, this is why.

There is no persistent "Troubleshooting" or "Maximum" preset. A live session already captures the full provider set for the duration of an active investigation, with automatic teardown when the session ends — that covers the same need without leaving an agent running at high volume indefinitely.

Linux Agent: journald & auditd Capture

The Linux agent’s eBPF backend sees kernel syscalls but is blind to the structured signal that lives in journald (failed service starts, OOM kills, sudo/su sessions, SSH login chains, kernel WARN_ON dumps) and auditd (file-watch hits, capability use, AVC denials from SELinux/AppArmor, login records). Both readers can be enabled per-host via AgentConfig.json on the agent or pushed remotely.

journald reader

Flag	Default	Notes
EnableJournaldCapture	false	Master switch. When true, the agent tails journalctl --output=json --follow and feeds entries into the same SystemEvent pipeline as eBPF.
JournaldUnits	[]	Optional list of systemd units to subscribe to (e.g. ["nginx", "postgresql"]). Empty means “all units”.
JournaldMinPriority	4	Syslog priority floor (0=emerg, 7=debug). Default 4 ships warnings-and-worse, matching the Windows “Warning or higher” default.
JournaldMaxLinesPerMinute	1000	Throttle. Excess lines are dropped and a single Linux.Journald.Throttled marker is emitted per minute so the AI prompt knows lines went missing.

auditd reader

Flag	Default	Notes
EnableAuditdCapture	false	Master switch. Polls ausearch --raw --start checkpoint --interpret on a timer and emits each record as a SystemEvent.
AuditdRules	Identity-file watches (/etc/passwd, /etc/shadow, /etc/sudoers)	Rules pushed via auditctl at startup. Leave empty if you manage rules via /etc/audit/rules.d.
AuditdPollIntervalSeconds	30	Cadence of ausearch drain. Matches the eBPF batch cadence.

The systemd unit needs AmbientCapabilities=CAP_AUDIT_READ (and CAP_AUDIT_CONTROL if you want the agent to install rules). On hosts without auditd or journalctl installed, the reader logs a single warning and exits cleanly — safe to leave the flag enabled in a mixed fleet.

Both readers are opt-in because a quiet host shouldn’t suddenly start shipping every log line. Operators flip them on when they want richer Inflection RCA prompts — the AI sees journald narratives and auditd file-watch hits as evidence alongside eBPF syscalls.