A small agent for laptops and servers that gives Versus the client side of the picture — device posture, path checks from the user's seat, certificate stores, policy-gated packet captures, SSH-key and credential hygiene, Desk health checks and AI-tool visibility — all on the same signed task channel as the collectors.
The collectors see the network from the data centre side. The Endpoint Agent sees it from the user's seat: the laptop's DNS and proxy, the TLS handshake it actually negotiates, the certificates it trusts, the SSH keys that reach your devices, and the AI tools it talks to. It runs on Windows, macOS and Linux, enrolls with a device certificate from the Versus CA, and only ever acts on signed tasks from your Versus tenant.
It is a separate product from the collector. Same Go platform, same transport and signing, but its own binary, its own identity model and its own policies — an endpoint is a device bound to a person, not a site-bound operator.
Everything the agent collects is bounded by a policy you control. Captures and secrets scans are off until a policy allows them; nothing is ever executed or changed on the device by the features on this page; secret values never leave the machine (fingerprints and locations only).
System → Client Tools → Endpoint Agent lists the published builds (Windows, macOS, Linux; amd64 and arm64) as versus-endpoint-<os>-<arch>-<version> bundles — the binary plus a README. The same downloads appear in the enrollment-token dialog on the Endpoints page, so the person enrolling a device gets the build and the command in one place. Operators publish a build with Publish Bundle (product Endpoint agent) or manage.py publish_endpoint_release. Signed MSI / pkg installers for MDM distribution are planned; today the bundle is unpacked by hand or by your software-distribution tool.
versus-endpoint --enroll-url https://<your-versus>/api/endpoint/v1/enroll \
--enroll-token <token> \
--state-dir "C:\ProgramData\Versus\endpoint" # or /var/lib/versus-endpoint
The agent generates a key pair, sends a certificate request, and receives a 30-day device certificate with a SPIFFE identity (spiffe://versus/endpoint/<tenant>/<id>). Renewal is automatic. From then on it runs with just --control-url and --state-dir; the enrollment token is no longer needed.
Run it as a service with your usual wrapper (a Windows service, a launchd plist, a systemd unit). A minimal unit:
[Service]
ExecStart=/usr/local/bin/versus-endpoint --control-url https://<your-versus> --state-dir /var/lib/versus-endpoint
Restart=always
Revoke on the Endpoints page makes the agent inert: it keeps only its heartbeat and update checks until re-enrolled.
Useful flags: --once (one claim round-trip and exit), --renew-now (force certificate renewal), --observe-now (print one AI-activity observation and exit, offline), --posture-interval-s (override the policy interval locally).
Devices belong to a group; a group has a policy; a tenant has one default policy. The policy is sent to the agent on enrollment and refreshed on every check-in, so a change takes effect within seconds.
Policy key (collect.*) | Default | What it allows |
|---|---|---|
posture_interval_s | 3600 | Full posture snapshot interval |
probe_interval_s, probe_targets | off | Periodic client-side probes (DNS / TCP / TLS / HTTP) |
capture_allowed | false | Packet captures from the device |
secrets_scan | false | SSH-key and credential hygiene scans |
procnet | false | AI-tool and AI-provider observation (see Agent Security) |
procnet_interval_s | 0 | Periodic AI-activity observation (0 = on demand only) |
consent, privacy (IP masking, retention, excluded paths) and budget (probes per hour, capture MB per day) blocks round out the policy. Edit policies under Endpoints → Policies.
Every snapshot records OS and version, interfaces and addresses, default gateway, DNS servers, proxy configuration and the known network clients installed (browsers, VPN clients, and so on). Findings lower the score: a public resolver instead of the corporate one, no gateway or DNS, an unmanaged proxy, a public address on the device. Installed clients are matched against the vulnerability feeds, and open matches appear in the device drawer and in the Vulnerability Tracker.
Posture changes (gateway, DNS, proxy, OS, software added or removed) become timeline events, which also show in Rewind under the endpoint domain.
The agent measures DNS, TCP, TLS and HTTP from the device, including the negotiated TLS version, cipher and key-exchange group (so Quantum Readiness knows whether your clients already use hybrid post-quantum key exchange). A Path Monitor can include a client hop: the user's own device runs the check, and the result is folded into the path roll-up. From my device on a monitor runs it once from an endpoint you pick.
Certificates in the drawer inventories the OS and user stores (Windows ROOT / CA / MY / AuthRoot and the user's stores, macOS keychains, Linux trust directories) with findings for expired or expiring certificates, user-installed root CAs, weak keys, weak signatures and self-signed leaves. Certificates with findings, and anything in a personal store, also join the crypto inventory so they are scored for post-quantum readiness.
With capture_allowed, Capture runs a filtered, time-boxed capture on the device (dumpcap with Npcap on Windows, tcpdump on Linux and macOS) and uploads it straight into PCAP Analysis, where it can be correlated with captures from the ADC or firewall on the same flow.
With secrets_scan, Scan walks the user profiles for SSH private keys (type, bits, fingerprint, passphrase-protected or not, permissions), known_hosts and ssh_config entries, API keys and tokens by shape (cloud, Git, Slack, Stripe, LLM providers and more), passwords in configuration files, and credential stores (.netrc, Git, AWS / Azure / GCP CLIs, Docker, kubeconfig, .pgpass). The report carries fingerprints and locations only.
Known-hosts entries are mapped to your managed devices, so a passphrase-less key that can reach a BIG-IP or firewall is flagged high. Findings are triaged in the drawer (rotated, onboarded to the Vault, ignored) and disappear on their own when a later scan no longer sees them.
From the drawer, or from an incident, Run health check runs the standard probes plus a posture refresh and, when an incident number is given, attaches the outcome to the incident as a work note. The Support Copilot can ask the agent for the same evidence through its endpoint_evidence tool.
With procnet, Observe reports which processes talk to which AI providers, which AI clients and IDE extensions are installed, and which MCP servers the user's local agents are configured to reach. The triage lives on its own page — see Agent Security and Shadow AI.
| Windows | macOS | Linux | |
|---|---|---|---|
| Posture, probes, timeline | yes | yes | yes |
| Certificate stores | OS + user stores | keychains | trust directories |
| Packet capture | dumpcap + Npcap | tcpdump | tcpdump (root) |
| Secrets scan | yes (ACLs not evaluated) | yes | yes |
| AI activity | connections with owning process, DNS-cache host names | lsof / ps | /proc |
Runs as the logged-in user or as a service account. As root or SYSTEM, scans cover every local profile; otherwise only the current user's.
Operator endpoints live under /api/endpoints/ (fleet, enrollment tokens, groups, policies, tasks, probes, postures, summary) with per-device actions probe, posture, ping, cert_inventory, capture, secrets_scan, observe, health_check, revoke and set_target_version. The agent channel is /api/endpoint/v1/ (enroll, renew, claim, report, posture, capture upload, catalog, observe); it authenticates with the device certificate and verifies every task's signature before running it.