Skip to main content

Agent

AttributeTypeDetailed OnlyDescription
idstringAgent ID
platformIdstringPlatform of the agent: Windows , Linux
urlstringSelf URL
hoststringHost name/address as specified by user
netbiosNamestringNETBIOS name
authenticationMethodstringThe authentication method for connecting to the agent: Password, PublicKey
agentPortintThe port that is used by the agent. Default: 4498.
userNamestringAccount for connecting to the agent.
passwordstringXAccount password for connecting to the agent. Password is not exposed.
privateKeystringThe private key used when PublicKey authentication method is used. The private key is not exposed.
clientCertificatestringThe agent's client certificate.
protocolstringThe protocol used for connecting to the agent: GRPC
domainstringDomain name of the agent
machineSidstringThe Machine SID of the Agent Server.
osVersionstringOS version or version servicepack
isDCboolIs Agent a domain controller
errorMessagestringDescription of the failure condition
installStatestringState of Activity Monitor agent: NotInstalled, Unknown, Installed, Installing, Upgrading, Uninstalling, Outdated, Failed, ManagedBySI (last one for Threat Prevention agents)
versionstringActivity Monitor agent version
siInstallStatestringState of Threat Prevention agent: NotInstalled, Unknown, Installed, Installing, Upgrading, Uninstalling, Outdated, Failed, ManagedBySI (last one for Threat Prevention agents)
siVersionstringThreat Prevention agent version
managedBySIboolTrue if the Threat Prevention Agent configuration is managed by Threat Prevention. Otherwise Activity Monitor managed the Threat Prevention Agent
configVersionstringA hash of the config file
monitoredHostsUrlstringURL to the list of agent's hosts
monitoredDomainUrlstringURL to the domain monitored by the agent, if any
warningsstring[]XArray of errors/warnings if any
ad.safeModeStatusstringXpending, approved. If pending the Threat Prevention agent in the safe mode.
ad.safeModeMessagestringXIf in the safe mode, contains a reason why the agent switched to the mode.
ad.hardeningIsEnabledboolXAD Module hardening is enabled or disabled.
ad.safeModeIsEnabledboolXAD Module safe mode is enabled or disabled.
ad.dnsResolveIsEnabledboolXAD Module DNS hostname resolution is enabled or disabled.
ad.siIpWhiteliststring[]XWhitelist of IPs allowed to connect to the AD Module port.
archive.IsEnabledboolXWhether the archiving feature is enabled
archive.pathstringXUNC path of the archival location
archive.userNamestringXAn account to access the archival location.
archive.passwordstringXUser password to access the archival location. Password is not exposed.
archive.maxLocalSizestringXMaximum space the agent is allowed to use on the local drives.
fpolicy.portintXNetApp c-mode fpolicy port
fpolicy.authstringXNoAuth, Server, Mutual
fpolicy.ipWhiteliststring[]XIP whitelist
fpolicy.clientCertificatestringXThe Client or CA certificate that is currently set.
fpolicy.serverCertificatestringXThe FPolicy Server certificate that is currently set. Server Certificate is not exposed.
minLocalFreeSpacestringXFree disk threshold after which the agent stops writing data to the log files
cee.vcapsIsEnabledboolXCEE Asynchronous bulk delivery (VCAPS) is enabled or disabled.
cee.vcapsIntervalintXInterval in seconds on how often events are delivered by CEE.
cee.vcapsEventsintXInterval in number of events on how often events are delivered by CEE.
cee.httpEnabledboolXCEE HTTP protocol is enabled or disabled
cee.rpcEnabledboolXCEE RPC protocol is enabled or disabled
cee.ipWhiteliststring[]XWhitelist of IPs that are allowed to connect to the agent via http protocol. If blank the agent will accept connections from any host.
inactivityAlerts.isEnabledboolXWhether Inactivity Alerting is enabled
inactivityAlerts.inactivityIntervalintXThe time interval to elapse after the Monitored Host stops receiving events.
inactivityAlerts.replayIntervalintXHow often to repeat an alert if the inactivity period is long lasting.
inactivityAlerts.inactivityCheckIntervalintXThe time interval to check the Monitored Host for new events.
inactivityAlerts.syslog.serverstringXThe syslog server that is sent inactivity alerts.
inactivityAlerts.syslog.protocolstringXThe syslog server protocol that is used: "UDP" , "TCP" , "TLS"
inactivityAlerts.syslog.separatorstringXThe syslog server separator / message framing that is used: "LF ASCII 10" , "CR ASCII 13" , "CRLF ASCII 13, 10" , "NUL ASCII 0" , "Octet Count RFC 5425". Only used for TCP and TLS protocols.
inactivityAlerts.syslog.templatestringXThe syslog server template text that is used.
inactivityAlerts.email.serverstringXThe email SMTP server that is sent inactivity alerts.
inactivityAlerts.email.sslboolXEmail SMTP Server SSL / TLS is enabled or disabled.
inactivityAlerts.email.userNamestringXEmail SMTP Server Username.
inactivityAlerts.email.passwordstringXEmail SMTP Server Password. Password is not exposed.
inactivityAlerts.email.fromstringXEmail address of where the inactivity alert is from.
inactivityAlerts.email.tostringXEmail address of where the inactivity alert is sent to.
inactivityAlerts.email.subjectstringXEmail message subject of the inactivity alert.
inactivityAlerts.email.bodystringXEmail message body of the inactivity alert.
apiServerIsEnabledboolAPI Server is enabled or disabled
apiServerPortintAPI Server TCP/IP port
apiServerIpWhiteliststring[]XWhitelist of IPs allowed to connect to the API Server port.
apiServerMgmtConsolestringXNETBIOS name of the Console machine that manages the agent list of the API Server (only available for agent(s) that are running the api server)
traceLevelstringXThe logging trace level of the agent.
externalNicNamestringXThe selected network interface that is used for connections. If blank, the agent will auto-detect the network interface to use.
commentstringThe agent's set comment.
etwLogEnabledboolIf true or enabled the windows agent will produce extended debugging data (ETW) logs from the windows driver when Trace logging is enabled for the agent.
linux.serviceUsernamestringXThe linux agent's service username that is used to run the agent service / daemon. If blank, root user is used.
networkProxy.addressstringXHTTP Proxy Server set in SERVER[:PORT] format. If blank HTTP Proxy is disabled.
networkProxy.useDefaultCredentialsboolXIf enabled the proxy server authenticates as the agent's machine account.
networkProxy.bypassProxyOnLocalboolXIf enabled the agent will bypass the proxy server for local addresses.
networkProxy.userNamestringXThe Proxy Server Username
networkProxy.passwordstringXThe Proxy Server Password. Password is not exposed.
networkProxy.bypassListstring[]XList of regular expressions that describe URIs that do not use the proxy server when accessed.
dns.isEnabledboolXLocal DNS caching service is enabled or disabled.
dns.listenPortintXPort used by the DNS caching service.
dns.parallelismintXParallelism level to use while processing DNS requests.
dns.perfStatsTimeDebugTimeSpanXPeriod to dump performance statistics on debug level.
dns.perfStatsTimeInfoTimeSpanXPeriod to dump performance statistics on info level.
dns.forwardDnsServerstring[]XList of DNS servers specified to be used for lookups. If blank, the default DNS servers of the agent are used.
dns.cacheFilestringXThe DNS cache buffer filename that is used.
dns.successTtlTimeSpanXHow long to cache successful lookup results before attempting the search again.
dns.failedTtlTimeSpanXHow long to cache a failed lookup result before attempting the search again.
dns.clientWaitTimeoutTimeSpanXThe amount of the DNS service is allowed to process a request before sending a not found response. If no results are received the lookup operation continues in the background.
dns.refreshThresholdTimeSpanXAn interval between expired items in the cache check.
dns.maxCacheSizeintXThe max size of the dns service buffer file.
dns.uselessAgeTimeSpanXThe DNS service does not resolve names for events older then the set time period.
dns.maxAttemptsToResolveintXMaximum attempts that the DNS service will use to resolve addresses. If 0 is set, the DNS service will resolve addresses infinitely.
dns.suffixstringXThe DNS suffix identifies the domain name that is appended to an unqualified host name to obtain a fully qualified domain name (FQDN) suitable for a dns name query.
adUsers.domainControllersstring[]XList of Domain Controllers to be used for user lookups. If blank, the default behavior is used.
adUsers.lookupTimeoutTimeSpanXThe amount of time the agent will wait for the query results. If no results are received , the agent reports an empty username in the events, but continues the lookup operation in the background.
adUsers.successCacheTtlTimeSpanXHow long to cache successful lookup results before attempting the lookup from Active Directory again.
adUsers.failedCacheTtlTimeSpanXHow long to cache failed lookup results before attempting the lookup from Active Directory again.
adUsers.maxCacheSizeintXThe max size of the cache buffer file.
panzura.portintXAgent port used for Panzura.
panzura.useCredentialsboolXProtection of Panzura port is enabled or disabled.
panzura.usernamestringXPanzura's MQ username used for port protection.
panzura.passwordstringXPanzura's MQ password used for port protection. Password is not exposed.
panzura.ipWhiteliststring[]XWhitelist of IP addresses of Panzura nodes that are allowed to connect to the Agent's Panzura port. If blank, connections from any host are accepted.
nutanix.portintXAgent port used for Nutanix.
nutanix.ipWhiteliststring[]XWhitelist of IP addresses of Nutanix nodes that are allowed to connect to the Agent's Nutanix port. If blank, connections from any host are accepted.
qumulo.portintXAgent port used for Qumulo.
qumulo.ipWhiteliststring[]XWhitelist of IP addresses of Qumulo nodes that are allowed to connect to the Agent's Qumulo port. If blank, connections from any host are accepted.
ctera.portintXAgent port used for Ctera.
ctera.ipWhiteliststring[]XWhitelist of IP addresses of CTERA portals that are allowed to connect to the Agent's CTERA port. If blank, connections from any host are accepted.

Response Example

{
    "warnings": [],
    "archive": {
        "isEnabled": false,
        "path": "\\\\KDVM01\\SBACTIVITYLOGS",
        "userName": "",
        "maxLocalSize": "5GB"
    },
    "cee": {
        "vcapsIsEnabled": false,
        "vcapsInterval": 60,
        "vcapsEvents": 100,
        "httpEnabled": false,
        "rpcEnabled": true,
        "ipWhitelist": []
    },
    "ad": {
        "safeModeStatus": null,
        "safeModeMessage": null,
        "hardeningIsEnabled": false,
        "safeModeIsEnabled": true,
        "dnsResolveIsEnabled": true,
        "siIpWhitelist": []
    },
    "minLocalFreeSpace": "64MB",
    "fpolicy": {
        "port": 9999,
        "auth": "NoAuth",
        "ipWhitelist": [],
        "clientCertificate": "",
        "serverCertificate": ""
    },
    "inactivityAlerts": {
        "isEnabled": false,
        "inactivityInterval": 360,
        "replayInterval": 360,
        "inactivityCheckInterval": 1,
        "syslog": {
            "server": "",
            "protocol": "UDP",
            "separator": "Lf",
            "template": "<14>1 %TIME_STAMP_UTC% %AGENT% %PRODUCT% - NO_DATA - [origin ip=\"%INACTIVE_SERVER_IP%\"][noactivity@33334 host=\"%INACTIVE_SERVER%\" lastEvent=\"%LAST_EVENT_TIME_STAMP_UTC%\" activityType=\"%ACTIVITY_TYPE%\"] No activity events from %INACTIVE_SERVER% for %INACTIVITY_PERIOD_HOURS% hours."
        },
        "email": {
            "server": "",
            "ssl": false,
            "userName": "",
            "from": "",
            "to": "",
            "subject": "[Activity Monitor] No activity events from %INACTIVE_SERVER% for %INACTIVITY_PERIOD_HOURS% hours",
            "body": "There were no activity events from %INACTIVE_SERVER% for %INACTIVITY_PERIOD_HOURS% hours.\n  \nHost:                 %INACTIVE_SERVER%\n  Activity Type: %ACTIVITY_TYPE%\n  Period of inactivity: %INACTIVITY_PERIOD_HOURS% hours / %INACTIVITY_PERIOD_MINUTES% minutes\n  Last event received:  %LAST_EVENT_TIME_STAMP_UTC% (UTC)\n  Last event received:  %LAST_EVENT_TIME_STAMP% (agent time)\n  Agent:                %AGENT%\n  \n  \n  %PRODUCT% %PRODUCT_VERSION%\n"
        }
    },
    "panzura": {
        "port": 4497,
        "useCredentials": false,
        "username": "guest",
        "ipWhitelist": []
    },
    "nutanix": {
        "port": 4501,
        "ipWhitelist": []
    },
    "qumulo": {
        "port": 4496,
        "ipWhitelist": []
    },
    "ctera": {
        "port": 4499,
        "ipWhitelist": []
    },
    "linux": {
        "serviceUsername": ""
    },
    "apiServerIpWhitelist": [],
    "apiServerMgmtConsole": "KDVM01",
    "traceLevel": "Info",
    "externalNicName": "",
    "dns": {
        "isEnabled": false,
        "listenPort": 4503,
        "parallelism": 4,
        "perfStatsTimeDebug": "00:01:00",
        "perfStatsTimeInfo": "00:10:00",
        "forwardDnsServer": [],
        "cacheFile": "dns.cache",
        "successTtl": "01:00:00",
        "failedTtl": "00:01:00",
        "clientWaitTimeout": "00:00:01.8000000",
        "refreshThreshold": "00:00:01",
        "maxCacheSize": 1000000,
        "uselessAge": "1.00:00:00",
        "maxAttemptsToResolve": 30,
        "suffix": ""
    },
    "adUsers": {
        "domainControllers": [],
        "lookupTimeout": "00:00:02",
        "successCacheTtl": "10:00:00",
        "failedCacheTtl": "00:01:00",
        "maxCacheSize": 300000
    },
    "networkProxy": {
        "address": "",
        "useDefaultCredentials": false,
        "bypassProxyOnLocal": false,
        "userName": "",
        "bypassList": []
    },
    "id": "AGENT0",
    "platformId": "windows",
    "url": "https://127.0.0.1:4494/api/v1/agents/AGENT0",
    "host": "KDVM01",
    "netbiosName": "KDVM01",
    "authenticationMethod": "Password",
    "userName": "KDUD1\\Administrator",
    "clientCertificate": "",
    "protocol": "GRPC",
    "domain": "KDUD1",
    "machineSid": "S-1-5-21-3126412784-2087258618-1984987930-1105",
    "osVersion": "10.0.14393.0",
    "isDC": false,
    "errorMessage": "",
    "installState": "Installed",
    "version": "7.1.164",
    "siInstallState": "NotInstalled",
    "siVersion": "",
    "managedBySI": false,
    "configVersion": "xVdvRQnWGvifzQ8Q9rpfVj227Jo=",
    "monitoredHostsUrl": "https://127.0.0.1:4494/api/v1/agents/AGENT0/hosts",
    "monitoredDomainUrl": "https://127.0.0.1:4494/api/v1/agents/AGENT0/domain",
    "apiServerIsEnabled": true,
    "apiServerPort": 4494,
    "comment": "",
    "agentPort": 4498
}