Configuration Modal

Click Configure on any agent to open the Configuration modal. Changes are queued as a config command, pushed to the agent over its live connection, and applied by merging into the agent's local AgentConfig.json. If the agent is offline, the change is picked up the next time it polls.

The modal has two parts: baseline settings, and provider restrictions. They are independent — applying a preset does not change provider restrictions, and setting a provider restriction does not change the baseline preset.

Baseline Settings

• Minimum Event Level: Errors Only, Warnings & Errors, Informational & Above, or All Events
• Event Collection (ETW): which of the agent's baseline Windows event providers are on at idle (File I/O, Registry, Process, Network, Disk I/O, Image/DLL Load, Thread, Virtual Memory)
• System Metrics: health metric collection interval, plus Disk Space / Process / Service metric toggles
• Performance: max buffer size, batch interval, and max events per query

Provider Restrictions

A live session (started from the dashboard) and inflection-driven root-cause analysis both choose which ETW/eBPF providers to turn on automatically, without an operator picking them in the moment. Provider Restrictions is a deny-list: check a provider to prevent it from ever being turned on by either of those two paths on this agent. Leaving a provider unchecked (the default) does not turn it on by itself — it just leaves it eligible to be turned on dynamically when needed.

Provider restrictions do not apply to the agent's own small always-on idle baseline (the Event Collection (ETW) toggles above, and the fixed minimum-capture floor the agent runs regardless of configuration). A restriction change takes effect the next time the agent starts a live session or an inflection escalation fires — no agent restart required.

Configuration Presets

Presets set baseline settings only. They do not touch provider restrictions.

There are four presets, listed here from least to most capture. The first three capture continuously and differ only in how much; the fourth captures nothing at all and is described separately below, because choosing it turns features off.

Minimal Monitoring (default)

• Errors only. File I/O, Registry, Process, and Image Load events; Network, Disk I/O, Thread, and Virtual Memory off.
• Health metrics every 5 minutes. Disk space metrics only (no process/service metrics).
• Capture posture: Continuous. This is the floor at which behavioural security detection and application baseline learning still work — Process, Image Load and File I/O are the three providers those features read.

Image Load is on in this preset even though it looks like a detail you could drop. Behavioural detection, anomaly bracketing and the application fleet baseline all read the same capture stream, and removing Image Load from it degrades all three at once. If you are trying to reduce agent load below this, the answer is Health Only rather than a hand-trimmed Minimal.

Standard Monitoring

• Warnings and errors. File I/O, Registry, Process, Network, Disk I/O, Image Load, and Thread events on; Virtual Memory off.
• Health metrics every 60 seconds. Disk space and process metrics.
• Idles at approximately 250 MB RAM. CPU usage is not listed here because it depends on the host's CPU, not on the preset.

Production Server

• Warnings and errors. File I/O, Process, Network, Disk I/O, and Image Load events on; Registry and Thread off.
• Excludes noisy paths by default: Windows Prefetch, Windows Temp, Windows Update staging, Windows Defender, and IIS logs.
• Health metrics every 30 seconds. Disk space, process, and service metrics.

Health Only

Health metrics and nothing else. No kernel capture at all. Capture starts only for a live session or an operator-triggered escalation, and stops again when that ends.

This is the one preset that turns features off. Applying it asks you to confirm, and lists what stops:

• Behavioural security detection — ransomware kill-chain, mass file access, reverse shell, privilege escalation and unusual outbound rules all stop firing on this agent.
• Application baseline learning — the agent stops contributing observations, and existing per-app profiles go stale.
• Anomaly bracketing — inflections are still detected from health metrics, but they arrive with no ±30 s of kernel events attached, so root-cause analysis has far less to work with.

Those three features read the same capture stream, so they stop together. Health, availability, patch status, inventory, remote control and scripted commands are unaffected — the agent stays fully manageable, it just stops watching the kernel.

Health Only is the right choice for a host where capture overhead genuinely is not acceptable, or one already covered by another security product. It is not the right choice for "quiet by default": Minimal Monitoring is the low-overhead preset that keeps detection working, which is why it is the default. If you have a fleet on Health Only and are wondering why the security dashboard is empty, this is why.

There is no persistent "Troubleshooting" or "Maximum" preset. A live session already captures the full provider set for the duration of an active investigation, with automatic teardown when the session ends — that covers the same need without leaving an agent running at high volume indefinitely.

Linux Agent: journald & auditd Capture

The Linux agent’s eBPF backend sees kernel syscalls but is blind to the structured signal that lives in journald (failed service starts, OOM kills, sudo/su sessions, SSH login chains, kernel WARN_ON dumps) and auditd (file-watch hits, capability use, AVC denials from SELinux/AppArmor, login records). Both readers can be enabled per-host via AgentConfig.json on the agent or pushed remotely.

journald reader

Flag	Default	Notes
EnableJournaldCapture	false	Master switch. When true, the agent tails journalctl --output=json --follow and feeds entries into the same SystemEvent pipeline as eBPF.
JournaldUnits	[]	Optional list of systemd units to subscribe to (e.g. ["nginx", "postgresql"]). Empty means “all units”.
JournaldMinPriority	4	Syslog priority floor (0=emerg, 7=debug). Default 4 ships warnings-and-worse, matching the Windows “Warning or higher” default.
JournaldMaxLinesPerMinute	1000	Throttle. Excess lines are dropped and a single Linux.Journald.Throttled marker is emitted per minute so the AI prompt knows lines went missing.

auditd reader

Flag	Default	Notes
EnableAuditdCapture	false	Master switch. Polls ausearch --raw --start checkpoint --interpret on a timer and emits each record as a SystemEvent.
AuditdRules	Identity-file watches (/etc/passwd, /etc/shadow, /etc/sudoers)	Rules pushed via auditctl at startup. Leave empty if you manage rules via /etc/audit/rules.d.
AuditdPollIntervalSeconds	30	Cadence of ausearch drain. Matches the eBPF batch cadence.

The systemd unit needs AmbientCapabilities=CAP_AUDIT_READ (and CAP_AUDIT_CONTROL if you want the agent to install rules). On hosts without auditd or journalctl installed, the reader logs a single warning and exits cleanly — safe to leave the flag enabled in a mixed fleet.

Both readers are opt-in because a quiet host shouldn’t suddenly start shipping every log line. Operators flip them on when they want richer Inflection RCA prompts — the AI sees journald narratives and auditd file-watch hits as evidence alongside eBPF syscalls.