“Agent” here means the software agent on the host. The AI agents decide
what to collect and what to do — the software agent carries it out.
Host Telemetry
The agent observes the operating system across kernel and user space:Processes
Process and thread creation, termination, and hierarchy, with the commands
behind them.
Files & filesystem
File access, changes, and deletions, including changes to system binaries and
libraries.
Network & DNS
Network connections and traffic patterns, with heavy DNS-resolution
monitoring.
Windows Event Log & registry
Windows Event Log via ETW, and registry activity — on Windows hosts.
Linux audit & syslog
The Linux audit subsystem and syslog — on Linux hosts.
Hardware & software inventory
A current inventory of the host’s hardware and installed software.
Some telemetry is platform-specific: registry and Windows Event Log/ETW are
Windows-only, while audit and syslog apply to Linux. The agent supports
Windows, Linux, and macOS.
Response Actions
When you approve them, the AI agents operate the software agent to act on the host:- Isolate the host from the network to contain an incident.
- Quarantine a malicious or suspicious file.
- Kill or terminate a process running on the device.
- Run commands on the host to investigate or remediate.
- Manage services, users, and updates on the operating system.
Actions that change a host follow the AI proposes, you approve pattern — you
review and approve before anything runs. See
Perseus for how
response works.
Host-Hardening Audits
The agent runs on-demand host-hardening audits that check the device’s configuration against best practice. Findings feed into Security Posture, where Athena scores your environment and prioritizes what to fix first.Patch Management
The agent applies approved operating-system updates on the host. Updates are scheduled and approved through patch management, keeping you in control of what changes and when.Where to Go Next
Agent architecture
The collect → enrich → respond model behind these capabilities.
Perseus
The AI agent that drives response on your hosts.
Security Posture
Where host-hardening findings surface.
Patch & updates
Schedule and approve OS updates.