Agents¶

Agents automatically collect software inventory from your systems and keep it fresh — SentriKat then matches it against CISA KEV, NVD and the other vulnerability sources.

Ways to get inventory in¶

Installing agents — two official methods¶

Every machine gets its own key with either method (the shared org key never leaves SentriKat):

1. Deploy on a machine (recommended for a few hosts): download from Integrations → Agent Deploy — the per-host key is already baked into the file, nothing to paste. Run the one-line install from the per-OS guide.
2. Mass / automated deploy: create a revocable install token (Integrations → Agent Deploy → Create Install Token) and push the script + ready-made command with your tooling. Each machine exchanges the token once for its own per-host key.

Per-OS commands, options and troubleshooting: Windows · Linux · macOS.

Architecture¶

graph LR
    A[Agent] -->|Inventory Report| B[SentriKat API]
    A -->|Container Scan| B
    A -->|Extension Scan| B
    A -->|Dependency Scan| B
    B -->|Store| C[Database]
    C -->|Match| D[KEV / NVD / OSV]
    D -->|Alert| E[Notifications]

Agents collect installed software (OS packages, applications), optionally scan container images / VS Code extensions / code dependencies (all opt-in per key), send delta updates on a schedule, and poll a lightweight heartbeat for commands (e.g. "scan now", version drift checks).

Shared org keys (advanced)¶

Methods ① and ② above manage keys for you. For scripted setups and the REST API you can still create a shared organization key under Integrations → Agent Keys:

• Key Type: Server or Client — separates infrastructure from end-user workstations; the dashboard's Servers/Clients filters group by it
• Max Assets, Allowed IPs, Auto-Approve
• VS Code Extension Scanning / Code Dependency Scanning — opt-in capabilities for agents using that key (no client-side config needed)

The key is shown once at creation. Prefer per-host keys where possible: one compromised machine never exposes a shared secret.

Managing agents¶

Go to Agent Activity to see every enrolled machine: last seen, software count, agent version, offline/stale flags, per-asset notes and an activity timeline. Endpoints also appear under Inventory → Endpoints tied to their products.

Decommission an agent from Agent Activity when a machine is retired: historical data is preserved and the seat stops counting against your license.