Blumira Agents · diff
git:20260728.b7e78fc to git:20260804.f49efe8
13 added, 0 removed. Audit A to A.
---
name: "Blumira Agents"
description: >
Blumira agents (sensors) and the devices they run on: device inventory and
filtering, agent health via last-seen timestamps, and agent deployment keys.
when_to_use: >-
When inventorying Blumira devices, checking agent health, or working with agent
deployment keys. Use when: blumira agent, blumira device, agent
key, device inventory, agent health, or sensor status.
---
# Blumira Agents & Devices
## Overview
Blumira agents (sensors) are deployed on devices to collect log data and detect threats. This skill covers device inventory management, agent health monitoring, and agent key management for deployments.
+ ## Anti-triggers
+
+ - **Claude subagents** — "agent" here is a Blumira log sensor, never an
+ AI subagent definition under `agents/*.md`.
+ - **An EDR agent** — a Blumira agent ships logs; it does not detect or
+ remediate on the endpoint. Endpoint sensors are `huntress-agents`,
+ `sentinelone-inventory`, or `blackpoint-asset-inventory`.
+ - **What the agent detected** — telemetry becomes a finding; use
+ `blumira-findings`.
+ - **Devices in another client account** — these are `/org/*` calls;
+ per-account device lists are `blumira_msp_devices_list` in
+ `blumira-msp`.
+
## Key Concepts
### Devices
Devices represent endpoints, servers, or network appliances with Blumira agents installed. Each device record includes agent status, last seen time, OS information, and network details.
### Agent Keys
Agent keys are deployment tokens used to register new agents with your Blumira organization. Keys can be scoped and rotated as needed.
## API Patterns
### List Devices
```
blumira_agents_devices_list
page_size=50
order_by=-last_seen
```
Filter examples:
```
blumira_agents_devices_list
os.contains=Windows
status.eq=active
```
### Get Device Details
```
blumira_agents_devices_get
device_id=<UUID>
```
### List Agent Keys
```
blumira_agents_keys_list
```
### Get Agent Key Details
```
blumira_agents_keys_get
key_id=<UUID>
```
## Common Workflows
### Agent Health Check
1. `blumira_agents_devices_list` with `order_by=last_seen` to find stale agents
2. Identify devices that haven't checked in recently
3. Cross-reference with user/admin to determine if device is offline or agent needs attention
4. Document findings for remediation
### Device Inventory Audit
1. `blumira_agents_devices_list` with `page_size=100` to enumerate all devices
2. Page through results using pagination
3. Group by OS, status, or location for reporting
4. Identify gaps in coverage (known devices without agents)
### Agent Deployment
1. `blumira_agents_keys_list` to find available deployment keys
2. Use key details to provision new agents
3. After deployment, verify with `blumira_agents_devices_list` that the new device appears
## Error Handling
### Device Not Found
**Cause:** Invalid device ID or device not in current org scope
**Solution:** Verify the device ID with `blumira_agents_devices_list`.
### No Agent Keys Available
**Cause:** No keys have been created for the organization
**Solution:** Agent keys must be created in the Blumira portal. The API is read-only for key management.
## Best Practices
- Monitor `last_seen` timestamps to catch offline agents early
- Audit device inventory regularly against known asset lists
- Rotate agent keys periodically for security
- Use filtering to segment inventory by OS or status for targeted reporting
- For MSP environments, use `blumira_msp_devices_list` to audit across accounts
## Related Skills
- [API Patterns](../api-patterns/SKILL.md) — Filtering and pagination
- [MSP](../msp/SKILL.md) — MSP device management across accounts
- [Users](../users/SKILL.md) — Correlating devices with users