Agent and endpoint management

The TechWatchAlert agent installs on workstations and servers (Windows, Linux, macOS). It continuously reports the machine’s inventory and its missing updates, and carries out what you decide from the Fleet: install updates, reboot, install or remove software, run a script. Deployments follow ring-based policies: a pilot group first, the rest of the fleet once updates are validated.

Note

Endpoint management is included in the Pro and Business plans, like inventory connectors.

How it works

• The agent calls the server every minute; the server never connects to the machine and no port is opened on it.
• Every order sent to the agent is signed by TechWatchAlert. The agent runs nothing else: an attacker who intercepts traffic or steals the agent’s configuration cannot make it run a command.
• The machine joins the fleet at installation, with its full inventory. Its recognised software enters the stack and is monitored like everything else: alerts say which machines are exposed.

Installing the agent

1. In Fleet › Agents, create an enrolment token: a name (“Head office”, “Production servers”), a validity period, a maximum number of uses, and optionally a group and tags set on enrolled machines. The token is shown only once: copy the command right away.
2. Run the command for the machine’s system, as administrator (Windows) or with sudo (Linux, macOS). It downloads the agent from TechWatchAlert, checks its SHA-256 fingerprint, enrols it and installs it as a service (Windows service, systemd unit, macOS LaunchDaemon).
3. The machine appears in the fleet within seconds, with the Agent online badge.

The command contains the fingerprint of the server’s signing key: the agent refuses to enrol with a server that does not present it.

Downloading the agent

Fleet › Agents › Download the agent offers the binaries of the latest version (Windows x64 and ARM64, Linux x86-64 and ARM64, macOS Intel and Apple Silicon), with their SHA-256 fingerprint: handy for deployment through GPO, Intune, an MDM or a script.

Agent updates

When a new agent version is released, agents update themselves, with no need to touch the machines:

• each agent downloads the new version from TechWatchAlert, checks its fingerprint, makes sure it works on the machine, then replaces the old one and restarts;
• if the new version cannot reach TechWatchAlert, the previous version comes back on its own and the reason shows in the machine’s tasks;
• the rollout is progressive: a few agents at a time, never the whole fleet at once.

Fleet › Agents flags outdated agents (“Update available”) and lets you update them by hand, one by one or all at once. Automatic updates can be turned off in the agent settings.

Caution

1.0.0 agents cannot update themselves: they are marked “Reinstall needed”. Run the install command once more on those machines; later versions update on their own.

Revoking a token prevents new enrolments; installed agents carry on. Revoking an agent (agent list, or the machine page) stops it at its next contact; the machine stays in the fleet with its history.

Missing updates

The agent looks for missing updates at least once a day, and on demand:

System	Sources
Windows	Windows Update (security, critical, cumulative, drivers…) and winget (third-party software)
Linux	apt (Debian, Ubuntu; security identified), dnf / yum (Red Hat and derivatives, security advisories), zypper
macOS	softwareupdate (system), Homebrew

Fleet › Updates gathers every missing update of the fleet: how many machines wait for each, its category, severity, the CVEs it fixes, whether it needs a reboot, and the project’s decision:

• Approved: policies requiring approval may deploy it;
• Declined: it never goes out, whatever the policy;
• Pending: no decision yet.

An update can also be deployed now, to the whole fleet, a group or a few machines, with a maintenance window and a reboot rule.

Update policies (rings)

Fleet › Deployments automates updates. A policy says:

• which machines: the whole fleet, or groups;
• which updates: sources, categories, severities; approved only, or all; a delay after release (wait a few days for a fix to prove itself); exclusions;
• when: daily, on given weekdays, on given days of the month, or the n-th weekday of the month (for example the day after Patch Tuesday, second Tuesday), at a local time;
• the maintenance window: past it, what could not be installed waits for the next run;
• the reboot: never, only if needed, or always, with a delay, a message to the user and a maximum postponement.

A policy can follow a previous policy (ring): it only deploys updates the previous ring installed without any failure for at least n days. Example: “Pilot” (10 IT team workstations, the day after Patch Tuesday), then “Workstations” (whole fleet, 3 days after pilot validation), then “Servers” (the following weekend, 4-hour window).

Preview shows what the policy would deploy now, and why the rest is left out (not approved, too recent, not validated by the previous ring, already in progress…). Run now starts the policy without waiting for its schedule. The run history shows, per machine, what was installed or failed.

Groups

A static group holds chosen machines. A dynamic group is recomputed at each use from conditions: system, name, tag, criticality, environment, source, state. Example: “system is Windows” and “tag among pci, hds”.

Remote actions

From a machine page (Actions menu), or on several machines at once:

Action	Role
Inventory now, look for updates	Analyst
Install updates, install or remove software (winget, apt, dnf, Homebrew), reboot, unenrol the agent	Admin
Run a script	Admin, with scripts allowed in fleet settings

The machine’s Tasks tab follows each action: pending, sent, running, succeeded, partial, failed, expired or cancelled, with output and errors.

Scripts

Fleet › Scripts keeps the project’s scripts (PowerShell, bash, sh, zsh, Python). They run as SYSTEM (Windows) or root (Linux, macOS), with a maximum duration. Script execution is off by default: an administrator turns it on in fleet settings. A machine can also forbid it locally at installation (--sans-scripts): the server cannot turn it back on.

Security

• HTTPS only, certificate verified; no port opened on the machine.
• Signed orders (Ed25519), addressed to one agent, dated and single-use.
• The agent’s secret is kept out of users’ reach (root-only file, or machine-encrypted on Windows); the server only keeps a fingerprint.
• Every action is recorded in the organisation’s audit log.

FleetMachines, risk score, vulnerabilities per machine.