Coverage you can state
You can say how many endpoints exist, how many are reporting and which are not.
- SOC 2 Readiness
- 24/7 Security Monitoring
- Canadian-Based SOC
GuardsArm Platform · Platform
Assets & Agent Management
An accurate inventory of every endpoint, what runs on it, and whether its agent is healthy.
You cannot defend a machine you do not know about, or trust telemetry from an agent that stopped reporting last week. Assets & Agents keeps the fleet, its software and its agents in view.
- Endpoint inventory
- Tamper alerts
- Versioned profiles
Assets & Agents
Monitoring- Endpoint enrolledInventory
- Agent stopped reportingTamper alert
- Agent build out of dateAttention
- Profile assigned to groupVersioned
One asset record behind detections, vulnerabilities and software.
What is at stake
Every other control assumes the inventory is right.
Silent failures get noticed
An agent that stops reporting is raised as an alert, not discovered during an incident.
Consistent configuration
Profiles applied by group, with versions and rollback, keep collection consistent across similar machines.
Who carries this
Carried by IT operations and security together. The question they answer is whether every machine is known, covered and current.
The problem
The inventory is the control everything else depends on
Detection assumes there is an agent on the machine. Vulnerability management assumes you know what is installed. Response assumes the endpoint will answer. Each of those assumptions fails silently when the inventory is wrong.
The failure that matters most is the quiet one: an agent that stopped reporting. Whether it was uninstalled, crashed or deliberately disabled, the result is a machine nobody is watching, and the absence of alerts looks exactly like safety.
Assets & Agents treats the fleet as something to be monitored in its own right.
An endpoint that has gone silent is not a healthy endpoint. It is an unanswered question.
Capabilities
What Assets & Agents shows and manages
Endpoint inventory
Every endpoint with its operating system, agent version, group, status, last check-in and risk, plus fleet-level views of agent status, operating system distribution and agent versions. Outdated agents and endpoints with no recent events are counted separately.
Agent health and tamper alerts
Endpoints that stop reporting telemetry are raised as tamper alerts, because an agent stopping, being tampered with and losing connectivity all look the same at first. Fleet connectivity and build distribution show what needs attention.
Software inventory across the fleet
Packages with version, category and vendor, and the number of endpoints each is installed on, aggregated across the fleet.
Network and ports
Listening services and established connections with their remote peers, by endpoint, local port, service and process.
Groups and configuration profiles
Endpoints are organised into groups, and versioned configuration profiles set which collection modules run on a group. Profiles can be assigned and rolled back.
Endpoint telemetry
Process trees, network connections, script execution and persistence for any endpoint, available to the analyst during an investigation.
How it fits the platform
The inventory here is the same one vulnerability management scans against and detections resolve to, which is why a finding, a vulnerability and a software package all point at the same asset record.
How it works
From deployment to a managed endpoint
The life of an endpoint in the console.
Deploy the agent
Deployment starts from the console, using an enrolment token that expires.
Place it in a group
The group decides which configuration profile applies and which business unit the endpoint is counted in.
Inventory fills in
Software, ports, processes and operating system details are reported and kept current.
Health is watched
If the endpoint stops reporting, it is raised as a tamper alert and listed as needing attention.
Policy changes are versioned
A profile change applies to the whole group, and an earlier version can be restored.
Questions
Common questions
How do we find endpoints whose agent has stopped?
Agent Health raises tamper alerts for endpoints that stopped reporting telemetry and lists disconnected, pending and stale endpoints as needing attention.
Can we change what the agent collects on a group of machines?
Yes. Configuration profiles are versioned policies for agent modules. They are assigned to groups and can be rolled back.
Does the inventory include installed software?
Yes. The Software view aggregates packages across the fleet with version, category, vendor and the number of endpoints each is installed on.
Works with
The modules next to this one
Every module runs in the same self-hosted stack and shares the same telemetry, severity model and response engine.
EDR — Endpoint Detection & Response
Deep endpoint visibility and on-box response, from a lightweight native agent.
ExploreVulnerability Management
Continuous, accurate vulnerability detection tied to real assets.
ExploreMulti-Tenancy & MSP White-Label
One platform, many customers, complete isolation.
ExploreSee Assets & Agent Management running on your own infrastructure
We will walk through the console, the deployment model and what it takes to stand it up in your environment.
24/7 SOC Monitoring Available