Audit Agent Reference
The Audit Agent is an OS-specific component installed on an endpoint that audits its host and pushes audit data back to AlloyScan over outbound HTTPS. Use Audit Agents for endpoints that leave your local network or that an Audit Service cannot reach.
Fields
| Field | Type | Values | Default | Description |
|---|---|---|---|---|
| Name | string | hostname-style | — | Identifier shown in the agents grid. |
| Audit ID | UUID | — | system-generated | Per-agent identifier used in audit snapshots. |
| Status | enum | Online / Offline | — | Agent connection status. |
| IP address | string | IPv4 / IPv6 | — | Endpoint network address. |
| Device | reference | — | — | Linked Inventory device record for the audited host. |
Constraints
- An Audit Agent is OS-specific. Supported platforms are Windows, macOS, and Linux.
- An Audit Agent requires only outbound TCP/443 (HTTPS) to the AlloyScan instance. No inbound ports are required.
- Initial audit results from a freshly installed agent typically arrive within 10 to 15 minutes.
- Per-site setting Audit agent auto tag applies a configured tag to every agent-audited device automatically.
- An Audit Agent that is silent past the inactivity period (default 30 days) is automatically scheduled for deletion.
Updates
Audit Agents update automatically when a new version is available.
NOTE: Audit Agent or Updater installations running version 25.x or older cannot migrate automatically to a current version. Reinstall these older installations manually.
Agent management
Administrators manage agents under Admin Center > Tasks and services > Audit agents. Agent details contain General, Audit sessions, and Remote tasks tabs. To remove an agent, open Remote tasks and select Remove agent > Queue removal.
For removal behavior, remote-task statuses, and automatic cleanup, see Audit Agents Reference.