About Audit Agents
An Audit Agent is an endpoint-side worker that audits a computer from the device itself and sends audit results back to AlloyScan over outbound HTTPS.
Use Audit Agents for offsite computers, laptops, remote networks, and other devices that cannot be reached reliably by an in-network Audit Service.
Menu path
Admin Center > Tasks and services > Audit agents
You can also deploy agents from Network > Audit agents.
Scope
Audit Agents are managed per Site. An agent installed for one Site reports into that Site's inventory and does not cross over into other Sites on the same instance.
What the Audit agents page is for
Use this page to:
- review registered Audit Agents for the current Site
- check whether agents are active or stale
- confirm agent version and last activity
- diagnose endpoints that have stopped reporting
- restart an agent host remotely and review the outcome on Remote tasks
- understand which computers are being audited by agent-based audit rather than agentless service audit
The deployment flow itself lives under Network > Audit agents, where users can download Windows, macOS, and Linux installation packages or copy download links.
Lifecycle
AlloyScan retires inactive agents according to the Site's inactivity settings. If an agent reconnects while pending deletion, it receives an uninstall instruction. If it stays offline until the retirement deadline, AlloyScan removes its registration record.
For manual removal, use Remove agent > Queue removal on the agent's Remote tasks tab. See Audit Agents Reference for details.
An Audit Agent can also uninstall itself after prolonged loss of communication with AlloyScan. See Audit Agents Reference for details.
The inactivity window is configured at Admin Center > Settings > Audit settings > Audit Agent.
How Audit Agents differ from Audit Services
| Item | Audit Agent | Audit Service |
|---|---|---|
| Runs on | The audited endpoint | A Windows host inside the network |
| Audit model | Agent-based, push results to AlloyScan | Agentless, scan/audit reachable targets |
| Network requirement | Outbound HTTPS/443 from endpoint | Connectivity from service host to target devices |
| Typical use | Remote users, laptops, offsite computers | Internal networks, servers, SNMP, hypervisors, cloud segments |
Both methods produce Audit Snapshots and populate the same Inventory.