How it works
What the agent collects
The agent collects the facts needed to find vulnerabilities and judge their exposure. You can see exactly what it
would send about a host with sudo sec-agent collect --json; that command collects and prints, and sends nothing.
What it collects
| Area | Details |
|---|---|
| Host | Host name, operating system and release, the running kernel and the installed kernels, whether a reboot is required, the addresses of the network interfaces, and whether snapshots are possible (LVM, ZFS, btrfs, Windows VSS). |
| Packages | From dpkg, rpm, apk, pacman and portage: name, exact version, architecture, source package and repository. On Windows: installed programs (MSI and the uninstall registry), Store apps, optional features and server roles, applications known to winget, and installed updates (KBs). |
| Services and processes | Name, state, whether it starts at boot, the program and the package it comes from, the account it runs as, its privileges (capabilities, seccomp), the libraries it has loaded, and whether it still uses files that were replaced by an update (then a restart is needed). |
| Listening ports | Protocol, address and port, the program and package behind it, and whether it listens on loopback, a private or a public address. |
| Host firewall | The active rules evaluated per listening port (nftables, iptables, Windows Firewall) and firewall managers (CSF, firewalld, ufw, Imunify360, cPHulk, fail2ban), read from their standard locations. |
| Inbound traffic | Per listening port, a count of distinct public sources that connected. Source addresses are only counted with a key that exists in memory, and are never stored or sent. |
| Hardening facts | The values of security-relevant settings (for example an SSH option or a kernel parameter), never the content of the configuration files. |
| Language packages and containers | Packages of language ecosystems (npm, PyPI, Maven, Go, Cargo, RubyGems, NuGet, Packagist) found in applications, and the packages inside container images on the host. |
| Software outside the package manager | Programs installed by hand or by a control panel, with their version. For a listening program the agent may run its version flag from a fixed list (for example exim -bV), unprivileged, with an empty environment and a 2-second limit; switch this off with [collect] exec_version_probes = false. For DirectAdmin CustomBuild: the names and checksums of the applied patch files, never their content. |
| Network view | The directly connected subnets and their gateway, the neighbour table (ARP/NDP) of the host, DHCP leases if the host is a DHCP server, and what a short listening window heard of mDNS, SSDP and LLMNR announcements. This is how devices without an agent become visible. Nothing is sent on the network for this. |
| Public (WAN) address | Once an hour, an HTTPS request to ip4.sek.systems / ip6.sek.systems returns the address the host uses towards the internet. Switch off with [egress] discover = false. |
| Hardware identifiers | The serial number and MAC addresses, to match a host with the same device in your RMM tool. SEK Systems stores them only as a pseudonym per environment (a keyed hash), never in readable form. |
What it does not collect
- the content of files, documents or e-mail;
- command lines (process arguments) and environment variables;
- passwords or other secrets;
- browsing history;
- the addresses of the hosts your systems connect to;
- the addresses of the sources that connect to your listening services (only a count).
The agent only reads; it does not send anything on your network for the inventory. The active tests that do send traffic (probes and network discovery) are separate, limited by the local policy, and described in External and internal probes.
How often
| What | When |
|---|---|
| First inventory | Immediately after the agent connects. |
| Inventory | Every 5 minutes (Linux installation line) or 15 minutes (Windows, packages). Between full reports only the changes are sent. |
| Full inventory | At least once every 24 hours, and when SEK Systems asks for one. |
| After a job | A new inventory right after each change, so the result is visible at once. |
| Connection check | A heartbeat every 60 seconds. |
| Local policy | A change is noticed and reported within seconds. |
| Tamper flags | A change is reported immediately. |
| Agent update check | Every hour. |
| Public address | Every hour. |
New vulnerability data is matched against the stored inventory as soon as it arrives: a new CVE does not wait for the next report. See Vulnerability matching.
Who can see it
Only members of your environment, and SEK Systems support when it acts in your environment (visible in your audit log as "SEK Systems support"). Your data is separated from other environments in the database itself; see Tenant isolation. For retention and the legal side, see Privacy and compliance.