Glossary: Security Monitoring and Automation

agent

Also written: agents, agent-based

A program installed on a monitored machine that reads local logs, files and processes and sends what it finds to the SIEM. Examples are EDR agents, the Wazuh agent and the Splunk Universal Forwarder; the shop's rsyslog forwarder works the same way.