Settings | AI Agent Security
Most of what AI Agent Security reports depends on decisions made in Settings. Discovery has to be on for an inventory to fill, endpoints have to trust your tenant certificate before traffic can be inspected, and the agent version an endpoint runs determines what it can enforce. Settings is where you make those choices once and have them apply across your tenant.
Scope of this guide
This guide introduces Settings and what each page in it covers. For the individual tabs, fields, and controls, see the page's own guide.
Prerequisites
- You have administrator access to the tenant.
What Settings covers
Settings has three pages.
| Page | Description |
|---|---|
| Administration | Sets the defaults applied to every endpoint, holds your tenant root certificate, and records who changed which setting. |
| Deployment | Walks you through installing the AI Agent Security agent on your endpoints. |
| Update Strategy | Decides which agent version each endpoint runs, using ordered rules, and holds the controls for stopping a bad rollout. |
Administration
The tabs you use most are these:
- Fleet defaults: enforcement, health reporting, and discovery settings for every endpoint. A value pinned here applies unless one of the endpoint's tags, or the endpoint itself, sets the setting, so these are defaults rather than fleet-wide enforcement.
- Trust anchor: your tenant root certificate, available as a
.cerfile, PEM text, or a macOS configuration profile. Endpoints must trust it before the agent can inspect traffic. - Audit trail: every change to a fleet, tag, or endpoint setting, with who made it and when.
Update Strategy
Rules are ordered, and an endpoint follows the first rule whose scope matches it. The Default rule always sits last and catches everything else, so no endpoint is ever without a rule. The page also lists the agent releases available to you and has an Emergency controls tab for pausing updates, yanking a release for your tenant, or rolling back the fleet default.
How Settings is useful
It sets behavior once for the whole fleet. Scan intervals, discovery, and enforcement visibility are configured at the tenant level rather than machine by machine.
It explains empty results. An inventory that looks clean may only mean the matching discovery setting is off. Settings is where you confirm which is true.
It makes inspection possible. Nothing is inspected until endpoints trust your tenant root certificate, and Trust anchor is where you get it in the format your distribution tool expects.
It gives you control over agent versions. You can hold a group on a known-good version, test a release on a small scope first, and stop a rollout that is going wrong.
Verify the results
Changes apply as endpoints check in, not immediately. After changing a fleet default, confirm the row shows the value you set, and check the Audit trail tab for the change. After changing an update rule, check the endpoint counts on the Rules tab and the Overview tab rather than assuming the change has landed.
Next steps
- Confirm the discovery settings on Fleet defaults match the inventories you expect to see populated.
- Download your tenant certificate from Trust anchor in the format your device management tool expects.
- Agree in advance who can use the Emergency controls on the Update Strategy page.
Updated about 2 hours ago
