Data collected

This page lists every category of data the agent collects and sends to the API.

OS and kernel

Field	Example	Purpose
Distribution	Ubuntu 22.04	EOL status, package manager
Kernel version	5.15.0-86-generic	Kernel security posture
Architecture	x86_64	Binary compatibility
Hostname	web-prod-01	Machine identification
Uptime	45 days	Reboot hygiene
System clock	UTC offset, NTP status	Time sync compliance

Package updates

Field	Example	Purpose
Package manager	apt, dnf, apk	Update commands
Installed package count	342	Baseline size
Pending security updates	7	Patch urgency
Security update sample	openssl, linux-image, ...	Top packages to patch (up to 32)

The agent does not collect the full list of installed packages — only the count and a sample of pending security updates.

Services

For each detected service, the agent collects version and configuration:

PostgreSQL

Version, service state, pg_hba.conf authentication rules (trust, md5, scram), TLS settings, listen addresses.

MySQL / MariaDB

Version, engine type (MySQL or MariaDB), service state, skip-grant-tables flag, bind address, TLS status.

Nginx

Version, compiled modules, server blocks, TLS configuration, security headers, status page exposure.

Apache HTTP

Version, loaded modules, virtual hosts, TLS configuration, ServerTokens/ServerSignature settings, sensitive path exposure.

Docker

Daemon version, API version, rootful/rootless mode, socket permissions, TCP API exposure.

Postfix

Version, service state, TLS configuration, relay settings.

Redis

Version, bind address, protected mode, authentication status.

SSH

• Password authentication enabled/disabled
• Root login allowed/disabled
• Key exchange algorithms
• Host key types

Firewall

• Active/inactive status
• Default policy (accept/drop)
• Rule summary (iptables, nftables, ufw)
• Per-port filtering status

Network

• Listening sockets (port, process, bind address)
• Public IP address (detected via external service)
• WAN probe results (which ports are reachable from the internet)

TLS certificates

• Local certificate inventory (paths, expiry dates, signature algorithms)
• Certificates expiring within 30 days
• SHA-1 signed certificates (weak)

Containers

Docker containers

Name, image reference, tag, digest, state, restart count, uptime, security flags (IPC mode, UTS mode, privilege escalation, secret env vars, device access, log driver, image age).

Kubernetes pods

Pod name, namespace, phase, per-container image and restart data.

What is NOT collected

• File contents (except allowlisted config files)
• Database records or application data
• Private keys, passwords, or .env files
• User home directories or personal files
• Network traffic or packet captures
• Process memory or core dumps