How the agent works
- Utilizes a modern codebase and is written in a safe, performant language (Rust).
- Does not utilize a kernel module or any kernel code, it runs entirely in userspace.
- Collects CPU and memory utilization metrics that can be viewed within your Portal
CPU and memory reporting
Since the agent runs entirely in userspace, without the utilization of a kernel module or kernel code, CPU and memory utilization metrics reported by the operating system about the agent actually reflect reality.
Compare and contrast this with products that utilize a kernel module, where CPU and memory performance costs are associated, and folded into, the kernel. It's very difficult to answer questions about performance as a result of this, as you're left looking at metrics only relating to userland daemons that interface with the product's kernel module.
Our product philosophy
Use the memory and CPU needed to collect meaningful telemetry for the purposes of threat detection, without causing system degradation. It's not particularly relevant whether that results in 30MB, 60MB, or 150MB of memory consumption. That being said, we continue to make investments in performance, as we understand the importance of available compute and resources.