Agents

Owned by Svetlana Sheptiy
Last updated: Dec 03, 2024

The Agents | All section allows you to view all the agents that are configured to be managed by SAM, or are discovered using a network scan. The total number of agents is displayed in the footer and as you scroll down, further agents are displayed.  Each agent will display:

  • a coloured icon on the left hand side that allows the user to view its license and communication status:
Reachable / Last seen [x days/a few minutes] ago displays Reachable if the agent connected to SAM or was discovered by SAM within the last 12 hours, otherwise it is the last time SAM "saw" the agent.
Metadata update available the details of the agent have changed since the page was originally loaded. For example, agent's hostname, IP, version or "last seen" date has changed. Reload the page to see updated details.

License Status indicates whether all or some of the features supported by this agent are licensed.

Web UI Status reflects if the agent's user interface (e.g. https://localhost:6161) is password protected or not.


  • Type - the type of agent that it is, Windows, Linux, Epilog, macOS, MSSQL
  • Hostname - the hostname of the machine on which the Snare agent is installed
  • Last Seen - date and time of when the agent last connected to SAM, or was last discovered by SAM via a network scan
  • IPs - the IP address(es) of the machine on which the Snare agent is installed
  • Networks - displayed if the agent was discovered via a network scan configured under Settings > Networks
  • Tags - special labelling given to the agent for further identification, called Tags
  • Settings cog icon that allows further editing of the individual agent

Toolbar

The toolbar allows to perform filtering, sorting, search and bulk delete of the agents.
Searches may be performed on the agents by selecting Show Filters, that allows the user to select the options of the agents to display.  This search may then be saved and managed.  The list of agents may also be sorted by selecting Show Sorting, and selecting the sorting criteria.

  • Show Filters allows to filer the agents list by 16 different criteria. After the filter is applied, it can be saved for future use, and will be listed under the Filters section of the Agents menu. 
  • Show Sorting allows to define sorting criteria for the agents list
  • Bulk Delete - click on the Agent rows to select/deselect them, or use the checkbox on the left of the toolbar to select/deselect all listed agents. If at least one agent is selected, Delete button will appear in the toolbar, allowing to remove all the selected agents from SAM. Bulk delete can be used in combination with a filter. 
  • Mode reflects how the agents are displayed.  By default they are set to Standard, where the individual agent information is displayed over multiple lines.  Selecting Minimized displays a reduced set of agent information on the screen.
  • Upgrade will display the agents that are able to be upgraded.  More information on this feature in Centralized Agent Upgrades.
  • Search - a search on the hostname or the IP address. If filter was already applied, the search is applied on filter results.
    The search is case-sensitive by default. Use Case Sensitive checkbox to control case sensitivity of the search. 

To edit an agent 

An agent's license may be removed or replaced with another agent's license, tags may be added or removed, and the agent itself may be removed from this area.

  1. Go to Agents and select the cog icon to view the agent's settings.  The following information is displayed:
  • Licenses - shows the features supported by the Agent, and if the feature is overlimit or exhausted for its license, the type of license (Managed or Unlicensed) and the reference of the license.
    • Click Add to manually assign a license to the feature.  This option is only available if the feature is not licensed, and license is available, but is not set to Auto-assign.
    • Click Remove to remove the license from the feature, which will cease that feature from functioning. This option is only available if license in use is not set to Auto-assign.
    • Click Replace to select an alternative license for the feature. This option is available if more than one valid license with free slots is available for this feature. The license will be applied to the agent on its next connection to SAM.
  • Networks - displays any network information for this agent if scanned.
  • All Tags - displays any assigned tags
  • Add Tags - allows tags to be added for this agent
  • Vendor - the agent that is built by Intersect Alliance, or possible custom solution
  • Build Date - the status information of the agent
  • SAM Agent ID - an identification number unique to this agent
  • Permalink - link to this agent only
  • Remove Agent - remove the agent from SAM.


Removing Agents

Removing an agent will result in the agent's licenses that are managed by SAM, to be revoked, and license slots released.

If a reporting agent is removed, it will get re-licensed as soon as it re-connects to SAM (usually within up to 100 minutes), assuming SAM has an available license with Auto-assign turned on. 

If a non-reporting agent is removed, then it may be rediscovered once a network scan is performed.

To remove a single agent:

  1. Go to Agents and select the cog icon to view the agent's settings.

  2. From the Remove Agent section select Yes, please!  Confirmation message will appear to remove.

To remove multiple agents:

Bulk delete of the agents is supported starting from SAM v1.7.0. 

  1. Select the agents you need to remove from SAM.
    Use filter and search capabilities to narrow down the list of agents. Then, use a checkbox in the toolbar to select all the listed agents, or select/deselect relevant agent rows by clicking on them. 
  2. Click Delete in the toolbar to delete all the selected agents