Windows (agent)

Use cases

• Report its security settings as rows compliance checks read (account and lockout policy, local accounts, audit policy, firewall, services, software, SMB, BitLocker, the OS) CPU, uptime, memory, page file and volume use as metrics, and failed logons, lockouts and new admins from the Security log, under the Linux module's series names; both change nothing.
• Patch it through the Windows Update Agent, from the source its WSUS or Windows Update for Business policy names: assess, start (a SYSTEM scheduled task), status, restart if required, and verify.
• Patching installs updates and restarts the host.

Included in packs

Each of these packs carries this module, so installing the pack installs it too.

• File baselineThe files and folders every host must have, as compliance checks: the file-state and file-keys table types, the Linux and Windows agent modules' collect_file_state collector and path_ensure fix, and two example baselines — each one list of paths that installs as one check per path, mapped to…
• Fleet monitoringHost monitoring out of the box: the Linux, Windows and macOS agent modules, whose System metrics function files CPU, memory, swap, disk and uptime (and load, on Linux and macOS) under the same series names; a Fleet health dashboard over them, deployed as an organization board on install; and…
• Process and service monitoringPer-process and per-service monitoring for Linux, Windows and macOS agents: the process_metrics function of the host modules (watched processes and the busiest few by CPU and memory, per process name; watched services on Linux and Windows); a Processes and services dashboard; four alert rules…
• Service monitoringApplications and business signals out of the box: HTTP and API checks (up, status, latency, TLS days left) and numbers read from any JSON API, from a queue worker; failed logins, lockouts and new admins from Linux and Windows hosts; and heartbeats from backups and batch jobs through a small…
• Windows security baselineCompliance checks for Windows hosts: the Windows agent module's fact collector, the host-facts table type, and 14 checks over the account and lockout policy, the Guest account, the audit policy, the firewall, SMB, BitLocker, Defender and pending reboots, mapped to NIST SP 800-53 (and to…