| 1 | --- |
| 2 | title: Agents |
| 3 | description: Operator-facing views and controls for endpoints, groups, actions, and security posture. |
| 4 | --- |
| 5 | |
| 6 | # Agents |
| 7 | |
| 8 | **Menu:** Agents |
| 9 | |
| 10 |  |
| 11 | |
| 12 | --- |
| 13 | |
| 14 | ## What this page is |
| 15 | |
| 16 | Agents are the onboarded endpoints reporting to the **Wazuh Manager**. |
| 17 | |
| 18 | In CoPilot, the **Wazuh Manager is the source of truth** for agent inventory and core endpoint status. |
| 19 | |
| 20 | This section includes: |
| 21 | - viewing agent inventory |
| 22 | - organizing agents into groups |
| 23 | - reviewing posture (vulnerabilities, Patch Tuesday, SCA) |
| 24 | - running response workflows (artifact collection, commands, quarantine, active response) |
| 25 | |
| 26 | --- |
| 27 | |
| 28 | ## When to use it |
| 29 | |
| 30 | Use Agents when you need to: |
| 31 | - confirm an endpoint is onboarded and reporting |
| 32 | - find endpoints by hostname/customer/group |
| 33 | - pivot from an alert to the impacted endpoint |
| 34 | |
| 35 | --- |
| 36 | |
| 37 | ## Prerequisites |
| 38 | |
| 39 | - Agents are enrolled and reporting into the stack |
| 40 | - Customer labels/grouping is configured (if you’re multi-tenant) |
| 41 | |
| 42 | --- |
| 43 | |
| 44 | ## Common tasks |
| 45 | |
| 46 | ### Open an agent’s dedicated page |
| 47 | |
| 48 | You can open an agent directly by ID: |
| 49 | |
| 50 | `/agents/<agent_id>` |
| 51 | |
| 52 | On the dedicated agent page you can typically access: |
| 53 | - **Overview** (identity + last seen + versions + customer_code) |
| 54 | - **Vulnerabilities** (Wazuh vulnerability module) |
| 55 | - **SCA** (Wazuh SCA results) |
| 56 | - **Cases** the endpoint is part of |
| 57 | - **Artifacts** previously collected |
| 58 | - **Alerts** the endpoint is part of |
| 59 | - **Collect** (run Velociraptor artifacts) |
| 60 | - **Command** (run remote commands) |
| 61 | - **Quarantine** (isolate/unisolate endpoint) |
| 62 | - **Active Response** (run response capabilities) |
| 63 | - **File Collection** (collect a file) |
| 64 | - **Data Store** (endpoint data store) |
| 65 | |
| 66 | ### Other pages in this section |
| 67 | |
| 68 | - View agents: [Agents](/user/ui/agents) |
| 69 | - Manage groups: [Agent groups](/user/ui/agents-groups) |
| 70 | - Sysmon config: [Sysmon config](/user/ui/agents-sysmon-config) |
| 71 | - Detection rules: [Detection rules](/user/ui/agents-detection-rules) |
| 72 | - Response/actions: [CoPilot actions](/user/ui/agents-copilot-actions) |
| 73 | - Posture: |
| 74 | - [Vulnerability overview](/user/ui/agents-vulnerability-overview) |
| 75 | - [Patch Tuesday](/user/ui/agents-patch-tuesday) |
| 76 | - [SCA overview](/user/ui/agents-sca-overview) |
| 77 | |
| 78 | --- |
| 79 | |
| 80 | ## Gotchas |
| 81 | |
| 82 | - If an agent isn’t visible here, it’s usually an enrollment/ingestion issue upstream. |