13.1 How agents talk to the server
| Mechanism | Interval | Notes |
|---|---|---|
| Heartbeat | Every 60 s (Windows service and macOS daemon) | Reports: |
| Policy sync | Every syncIntervalSeconds (default 300
s, minimum 60 s; Policy → Rules → Agent Rules →
Synchronization) |
Conditional download (ETag). Each policy is signature-checked before use. |
| Online threshold | Fixed 180 s | An agent is online if its last heartbeat is under 180 s old, which equals three missed heartbeats. |
| Command delivery | Next heartbeat (≤60 s) | Commands are signed. The agent verifies the signature, refuses replays, and acknowledges. A command not picked up within 15 minutes fails with “Timed out — the agent did not pick this command up within 15 minutes.” |
| Server-held label registry | Heartbeat cadence | Pushes labels the agent recorded and pulls labels recorded by other machines (section 13.6) |
The sidebar counter next to Agents shows
online/total, for example 42/45. The top bar also
has an N/M agents online button that opens this page. The list
refreshes every 15 seconds while the browser tab is
visible, and immediately when you return to it.