Monitor a Linux host with Runtime Security

Open Runtime Security → Add Runtime Security Agent. Enter Agent Name, optionally Environment and Hostname, then select the Cloud Account used to attribute findings. Choose Linux and the host architecture.

Copy Agent Credential when it is shown. Follow the generated Install instructions on the target host. Replace the credential placeholder with your one-time value and use the deployment’s API URL. The app also provides Docker and build-from-source alternatives for appropriate environments.

Use Check status and logs. Look for connected: heartbeat accepted and sent-event messages. In Agent Detail, review Last Seen, Agent Version, Last Event, and Recent Events.

Use Investigate findings or the agent’s Findings view. Review the event context and resource identity before deciding whether activity is expected. Threat Intelligence can provide context for correlated URL and IP indicators.

Credential rotation immediately invalidates the current credential until the agent is updated and restarted. Revoking an agent permanently prevents that agent from authenticating; its events, findings, and audit trail remain. Read the confirmation before revoking.