Linux (agent)

Use cases

• Each function is a separate, repeatable step for a workflow to chain.
• Monitoring: CPU, load, uptime, memory, swap and filesystem capacity and use, and failed logins, lockouts and new admins from the auth log, as metrics on a schedule.
• Inventory: installed packages as the vulnerability databases name them.
• Compliance: the host's security settings as facts, and OpenSCAP results, for compliance checks.

Included in packs

Each of these packs carries this module, so installing the pack installs it too.

• File baselineThe files and folders every host must have, as compliance checks: the file-state and file-keys table types, the Linux and Windows agent modules' collect_file_state collector and path_ensure fix, and two example baselines — each one list of paths that installs as one check per path, mapped to…
• Fleet monitoringHost monitoring out of the box: the Linux, Windows and macOS agent modules, whose System metrics function files CPU, memory, swap, disk and uptime (and load, on Linux and macOS) under the same series names; a Fleet health dashboard over them, deployed as an organization board on install; and…
• Linux patchingLinux patch channels as a rollout kind: repository file templates and baselines that hold each ring of hosts to its mirror snapshot, patch-state checks that say whether a host has caught up, the Linux agent module, and the workflows that patch one host or a whole ring.
• Linux security baselineCompliance checks for Linux hosts: the Linux agent module's fact collector and OpenSCAP import, the host-facts and scap-results table types, 21 checks over SSH, accounts, sudo, auditd, packages, kernel settings and patching mapped to NIST SP 800-53 (and to Truestone catalogue topics, as…
• Process and service monitoringPer-process and per-service monitoring for Linux, Windows and macOS agents: the process_metrics function of the host modules (watched processes and the busiest few by CPU and memory, per process name; watched services on Linux and Windows); a Processes and services dashboard; four alert rules…
• Security monitoringExposure out of the box: TLS discovery with its endpoints and every certificate they present tracked — key and signature algorithms, hybrid and post-quantum included, and which are quantum-vulnerable — a Linux package inventory, a daily workflow that checks the inventory against OSV.dev and…
• Service monitoringApplications and business signals out of the box: HTTP and API checks (up, status, latency, TLS days left) and numbers read from any JSON API, from a queue worker; failed logins, lockouts and new admins from Linux and Windows hosts; and heartbeats from backups and batch jobs through a small…