Agent Management

Agent Properties Modal

Click an agent name or Properties button to open the details modal with five sections:

1. Information Grid

  • Server Name, Agent ID, Type, Status (with colored indicator), Last Heartbeat, Version, Environment, Mode, Tags

Server Name follows the host machine name. If you rename the underlying computer, the agent picks up the new name on its next start-up and reports it, and the dashboard updates automatically on the following heartbeat — no manual edit needed.

2. Health Metrics

  • CPU and Memory usage cards with color-coded thresholds (green/yellow/red)
  • Values from the latest health report (updated every 30 seconds)

3. Collection Control

  • Start Full — begins continuous ETW collection
  • On-Demand — starts time-limited collection
  • Stop — ends all ETW collection, returns to Health Only

A status bar shows the current collection state and active provider count.

4. Interactive Query Session

  • Current session ID and event count (if active)
  • Begin Session / End Session buttons to control live sessions from properties

5. Delete Agent

  • Requires two confirmations before proceeding
  • Sends a silent uninstall command to the agent ("C:\Program Files\ETDucky\Agent\uninstall\unins000.exe" /VERYSILENT) via the existing SSE shell channel
  • Modal closes immediately; a countdown toast shows the remaining time before database removal
  • After 15 seconds, the agent record and all associated data are permanently deleted from the database
  • The agent process self-terminates via the uninstaller; the subsequent heartbeat 401 is expected and benign

Remote Management

Collection Control

  • Start Full/On-Demand/Stop buttons in Properties modal
  • Agent picks up commands on next heartbeat (within 30 seconds)
  • Live Sessions automatically start and stop collection

Configuration Push

  • Changes in the Configure modal are saved server-side
  • Agents poll for updates every 30 seconds
  • Server-side config overrides local AgentConfig.json
  • No agent restart required for most settings

Applying a preset to many agents

Tick agents in the All Agents grid and choose Configuration in the selection bar to apply one monitoring preset across the whole selection. This is the fastest way to move a set of hosts off Health Only — the one preset that stops behavioural detection and app-baseline learning — and back onto Minimal Monitoring.

  • Presets only, by design: a preset states capture posture, mode and providers explicitly, so every selected agent lands on the same known state. A partial field edit would leave each agent keeping whatever it already had for the keys you did not set.
  • Requires the Technician privilege (administrators and owners have it). Members see the button but get a clear refusal, because the server decides, not the browser.
  • Agents under network isolation and unlicensed agents are skipped, and you are told which ones and why rather than being given a count.
  • Every bulk push is recorded in the audit log with the operator, the preset name, the agents it reached and the agents it skipped.