Agent Management

View Agents

To view all deployed agents:

1. Login go the Samurai MDR Portal

2. Click Telemetry and select SamurAI Agent from the main menu.

Agent Dashboard

The SamurAI Agent dashboard panel displays summary information as:

• Nodes: the total deployed and seen by the SamurAI platform
• Online: the total currently online (have communicated with the SamurAI platform within five minutes)
• Offline: the total number offline (have not communicated with the SamurAI platform for five minutes)
• Platforms: the total number of platforms i.e Windows / MacOS / Linux

A table displays all deployed agents with node specific information:

Delete Agent(s)

The SamurAI platform does not remove or delete offline agents that are displayed. For example you may have uninstalled or removed the agent from a node but it will still be displayed as offline.

You can delete SamurAI Agents from the table:

1. Select the nodes you wish to Delete
2. Click Actions and select Delete selected nodes
3. To ensure you intended to delete the agents you will need to type DELETE in the field and select Delete

Agent Settings

You can change the SamurAI Agent Update and Sysmon EULA selections by clicking Settings.

• Auto Managed : Auto updates of agents is enabled by default, select this option if you want the agent updates to occur automatically without any action needed on your part.
• Self Managed : Select this option should you wish to manage agent updates yourself.

Self Managed

If Self Managed is selected a new option entitled Update Tasks is displayed.

Update Tasks

Selecting Update Tasks allows you to configure tasks for updating your deployed agents.

1. Click on Create Update Task

2. Enter a Name for the task e.g Windows 10 Pro Update

3. Toggle whether you wish to Start immediately. If you do not start the task immediately you have the option to update the status at a later date/time. See Update the Task.

4. Select whether you wish to update:

• SamurAI agent version (the latest version will always be displayed)
• Sysmon version (applicable to Windows only)

5. Select if you wish to Rate Limit the update task. Read more about Rate Limiting

6. Once complete, select Review Selection and review your tasks

7. Click on Create Update Task

Rate Limiting

Rate limiting allows you to roll out updates to endpoint agents gradually instead of updating all systems at once. This controlled approach reduces risk of disruption, avoids overloading networks and ensures that if an unexpected issue occurs, only a small number of endpoints are affected.

Enabling rate limiting allows you to configure the number of agents to update per time duration (which can be set as minute/hour/day/month/week/year).

When rate limiting is recommended:

• Large fleets (typically 500+ endpoints)
• Networks with remote sites, VPN’s or limited bandwidth
• Critical workloads where uptime and stability are essential
• Major agent version upgrades or significant configuration changes

When rate limiting may not be necessary:

• Small fleets with a few hundred endpoints
• Minor, low-risk updates

View Update Tasks

1. From the SamurAI Agent view, click Update Tasks.

A table displays all Update Tasks with specific information:

Select an Update Task from the list to display status of individual agent updates.

A summary will be displayed including:

• Update task status
• Number completed
• Number failed
• Target
• Rate Limit

Additional details for each agent are also included:

Update the Task

You can update the State of an Update Task to either Paused or Running.

For example, if you previously set an Update Task NOT to Start Immediately you can set the state to Running to begin the update:

1. Select More Options ().

2. Click Update the Task

3. Select the State to Paused to pause the update task or to Running to begin or resume the update task.