Agent Overview

The Infracast Agent is a lightweight, cross-platform binary that provides deep host-level visibility for security monitoring, compliance, and vulnerability detection. Where agentless discovery sees what's visible from the network, agents see what's actually running on the host.

What Agents Do

Agents run continuously on target hosts and report:

Discovery Area	What's Collected
Software packages	Installed packages from all major package managers + versions
Running processes	PIDs, names, users, command lines, resource usage
Network ports	Listening ports, bound addresses, associated processes
Network connections	Active TCP/UDP connections, remote endpoints, states
Firewall rules	iptables / Windows Firewall rules and chains
User accounts	Local users, sudo/administrator access
CVE exposure	Packages correlated with NVD CVE database

Architecture

┌─────────────────┐         HTTPS (443, outbound)         ┌─────────────────┐
│  Infracast      │ ◄───────────────────────────────────► │  Infracast      │
│  Agent          │    Register / Heartbeat / Reports     │  Server         │
│  (on host)      │    Commands (scan, revoke)            │  (SaaS or ECS)  │
└─────────────────┘                                        └─────────────────┘
        │                                                          │
        ▼                                                          ▼
  Host Discovery                                           Asset Graph
  - Process list                                           - Node enrichment
  - Listening ports                                        - CVE findings
  - Installed software                                     - Compliance rules
  - Firewall rules                                         - SBOM artifacts
  - Active connections                                     - Reports

Key characteristics:

~5 MB compiled binary — minimal footprint
Outbound HTTPS only (port 443) — no inbound firewall rules needed
Non-root preferred — some collectors require elevated access for full visibility
Heartbeat every 30 seconds — real-time online/offline status
Full scan every 5 minutes (configurable) — fresh data without manual triggering

Security Model

Enrollment tokens are single-use and scoped to one tenant.
Agent tokens are JWTs and can be revoked at any time from the UI; a revoked agent stops reporting on its next heartbeat.
All communication is TLS-encrypted. Mutual TLS is available and is the expected configuration for IL4 and above.
No inbound connections. The agent initiates every exchange, so no ingress rule or open port is required on the host.
Minimal privileges. The agent runs as a non-root user where possible; process, firewall and package-database collectors need elevated access for full visibility (see Troubleshooting).

Agent vs. Agentless Discovery

Infracast supports both modes. They are complementary, not mutually exclusive.

Capability	Agentless	Agent-based
Cloud infrastructure (EC2, VPC, S3, IAM)	✅	❌
Network topology (Cisco, Palo Alto, Juniper)	✅	❌
VMware / hypervisor inventory	✅	❌
Running processes and open ports	❌	✅
Installed software packages	❌	✅
CVE / vulnerability detection	Partial	✅ Full
SBOM generation	❌	✅
Firewall rule audit	❌	✅
Config drift detection	Limited	✅
STIG compliance checks	Limited	✅
Works without network access to target	N/A	✅
Works in air-gapped environments	No	Yes
Requires software on host	No	Yes

When to Use Agents

Deploy agents when you need:

Software Vulnerability Detection (CVE / SBOM)

Agents enumerate all installed packages and correlate them against the NVD CVE database. This catches vulnerabilities in software that cloud APIs don't expose (custom apps, language packages, libraries).

apt package: openssl 3.0.2 → CVE-2023-0286 (HIGH, CVSS 7.4)
pip package: requests 2.28.0 → CVE-2023-32681 (MEDIUM, CVSS 6.1)

STIG Compliance

Defense Information Systems Agency (DISA) STIG checks require host-level access to audit:

Filesystem permissions
Service configuration
User account settings
Audit policy
Password complexity

Configuration Drift Detection

Detect when host configuration deviates from baseline:

New listening ports opened
New services started
Package versions changed without change control
New user accounts created

Deep Host Visibility for GRC

Auditors require evidence of actual system configuration, not just API assertions. Agents provide:

Point-in-time SBOM snapshots (signed for integrity)
Real running process inventory
Confirmed firewall posture

Supported Platforms

Platform	Architecture	Notes
Linux (Ubuntu, Debian, RHEL, CentOS, Amazon Linux)	x64, arm64	Full package manager support
Windows Server 2016/2019/2022	x64	WMI-based collection
Windows 10/11	x64	Supported but server-focused
macOS 12+	x64, arm64	Community supported
Kubernetes (DaemonSet)	x64, arm64	Sidecar or privileged DaemonSet

Quick Start

Go to Settings → Agents → Generate Token
Copy the enrollment token (shown once)

On the target host:

curl -fsSL https://get.infracast.io/agent | sudo bash -s -- \
  --server https://api.infracast.io \
  --token YOUR_TOKEN

The agent appears in the Agents page within 60 seconds

See Agent Installation for platform-specific instructions, mass deployment options, and air-gapped installs.

What Agents Do​

Architecture​

Security Model​

Agent vs. Agentless Discovery​

When to Use Agents​

Software Vulnerability Detection (CVE / SBOM)​

STIG Compliance​

Configuration Drift Detection​

Deep Host Visibility for GRC​

Supported Platforms​

Quick Start​