Scheduled paths, plus one that is not
The agent runs two scheduled paths. An inventory runs every hour, with a full sweep every night at 03:00, and collects the complete device state across all data categories. A heartbeat runs every five minutes and confirms the device is online and reports any high-signal changes.
This split keeps the platform current without paying the cost of a full inventory every few minutes. A patched machine is reflected within the hour, while availability and obvious drift are visible within minutes.
A third path is not on a schedule at all. Detections that must not wait for the next cycle are sent the moment they fire, on a separate urgent channel. A schedule is the right shape for inventory and the wrong shape for an attack in progress.
Twelve data categories
A full inventory covers twelve categories: installed software, operating system and patch level, hardware, network configuration, listening ports and processes, local accounts and group membership, antivirus and EDR state, firewall profiles, disk encryption status, scheduled tasks, browser extensions, and startup entries.
Each category feeds a different part of the platform. Installed software drives CVE correlation. Accounts, firewall, encryption, and EDR state drive the configuration and compliance rule engine.
Ed25519 signing pipeline
Each device holds its own Ed25519 keypair. Every payload the agent sends is hashed with SHA3-256 and signed with the device private key before transport. The platform verifies the signature against the registered public key on arrival.
Private keys are protected at rest using DPAPI on Windows, so a key cannot be lifted and replayed from another machine. The signature plus a monotonic counter give replay protection: a captured payload cannot be resubmitted.
Offline queue
When a device cannot reach the platform, the agent does not drop data. Inventories and heartbeats are written to a local queue and signed at the time they are produced.
On reconnect, the queue is flushed in order. Because each payload was signed when created, the platform can trust historical entries even though they arrive late, which keeps the timeline accurate for audit purposes.