# Agent Management

Security agents monitor virtual machines for threats, vulnerabilities, and compliance. They collect security-related data and send it to centralized controlling software. Security agents include tools like OSSEC (used with SIEM Wazuh), ClamAV (anti-virus), CrowdStrike, and Lacework.

DuploCloud provides seamless installation and management of these security agents, offering three types:

**1. Docker-based Agents**

These agents run as containers orchestrated by DuploCloud, with privileged access over the Host operating system. They can be deployed on all or a subset of hosts within a cluster.

**2. Kubernetes DaemonSet Agents**

Kubernetes DaemonSets ensure that security agents are deployed across all or a subset of Hosts in the cluster, typically with privileged access over the Host operating system.

**3. Non-Docker VM Agents**

These agents are Linux packages or Windows services installed on virtual machines, either baked into the VM image before launch or installed via user data scripts.

{% hint style="info" %}
**Security agents** focus on system protection and compliance, while **observability agents** monitor application performance, health, and infrastructure metrics. For more information on **observability agents**, please refer to the [observability documentation](/docs/automation-platform/diagnostics-overview.md).
{% endhint %}

## Agent Registration

1. **Create an Agent Type.** Each vendor or agent software is considered a type. For example, OSSEC, ClamAV, Laceworks, and Crowdstrike are different agent types. To add a new agent type, navigate to **Security** -> **Agents** and click **Add.** The **Add Security Agent** pane displays. Enter the **Agent Name** and click **Create**.<br>

   <div align="left"><figure><img src="/files/Rlpk08LADa7cmfheJHA3" alt=""><figcaption><p><strong>Add Security Agent</strong> pane.</p></figcaption></figure></div>
2. **Create an agent deployment.** Under the desired **Agent** tab, **Add** a deployment to deploy the agent to the Hosts. You must deploy at least one agent per Kubernetes cluster. You can deploy on all hosts in a Kubernetes cluster or on all Hosts for a specific Tenant. Deploying on all hosts for one Tenant is useful for certain Kubernetes clusters or DuploCloud Infrastructures where you have Tenants on which you don't want specific agents to be run.

{% hint style="info" %}
Behind the scenes, this deployment is just a regular Kubernetes DaemonSet deployment or a built-in container orchestration deployment within a tenant, as documented here.
{% endhint %}

## Creating multiple deployments for multiple Tenants

You can create multiple deployments for multiple tenants. In the case of Kubernetes-based container orchestration, as against DuploCloud built-in orchestration, you can target all nodes in the cluster with just one deployment. The following are the fields in the **Update Security Agent Deployment** page:

* **Name** is a desired name to track the deployment.
* **Cluster** is the infrastructure name and is the maximum scope of deployment.
* **Host Tenant** is the tenant namespace where the daemon set will be deployed.
* **Deployment Type** is either a K8s DaemonSet or Docker Native for built-in container orchestration.<br>

  <figure><img src="/files/3CrcXsgLT47YYnR9COYj" alt=""><figcaption><p>The <strong>Update Security Agent Deployment</strong> page</p></figcaption></figure>

Once deployed, you can view the deployed instances of the agents under their respective agent tabs, as shown below:

<figure><img src="/files/fh8I657hgiN1M2YkgrDp" alt=""><figcaption><p>The <strong>Agents</strong> page in the DuploCloud Portal</p></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.duplocloud.com/docs/automation-platform/security-and-compliance/access-control-3/agent-management.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.