How the agent works

The agent utilizes a modern codebase and is written in a safe, performant language (Rust). It does not utilize a kernel module or any kernel code, it runs entirely in userspace. It collects CPU and memory utilization metrics that can be viewed within your Portal.

CPU and memory reporting

Because the agent runs entirely in userspace, without the utilization of a kernel module or kernel code, the operating system's CPU and memory utilization metrics about the agent genuinely represent reality.

Compare this to products that utilize a kernel module, in which CPU and memory performance costs are associated with and incorporated into the kernel. As a result, answering queries concerning performance is extremely difficult, as metrics only relate to userland daemons that interface with the product's kernel module.

Our product philosophy

Use the memory and CPU needed to collect meaningful telemetry for the purposes of threat detection, without causing system degradation. It's not particularly relevant whether that results in 30MB, 60MB, or 150MB of memory consumption. That being said, we continue to make investments in performance, as we understand the importance of available compute and resources.