Enterprise-grade endpoint visibility and control with a local-authority trust model. Your machines, your rules.
╔═══════════════════════════════════════════════════════════╗ ║ EyeLog Agent ║ ╠═══════════════════════════════════════════════════════════╣ ║ Status: ● ACTIVE ║ ║ Manifest: standard v2.1.0 ║ ║ Collector: collector.example.com:9443 ║ ║ Connected: Yes (mTLS) ║ ╠═══════════════════════════════════════════════════════════╣ ║ INFO Capabilities: ║ ║ ✓ System Metrics ✓ Network Telemetry ║ ║ ✓ Inventory ✗ Security Monitoring ║ ╠═══════════════════════════════════════════════════════════╣ ║ CONTROL Capabilities: ║ ║ ✓ Config Push ✓ Diagnostics ║ ║ ✓ Lock Screen ✗ Remote Shell ║ ╚═══════════════════════════════════════════════════════════╝
A lightweight agent that provides real-time visibility into what's happening on your machines, with the control capabilities you need to respond.
Real-time visibility into processes, connections, services, and everything happening on your endpoints.
Local-authority trust model. Your machines, your rules. The agent decides what it will do—not the collector.
Execute commands, manage services, respond to incidents—all with capability-based permissions.
Separate channels for control and data. Each optimized for its purpose.
UDP-based, handles high throughput, multiplexed streams, 0-RTT reconnection
Reliable delivery, bidirectional streaming, strong typing with Protobuf
Mutual authentication, encrypted in transit, certificate-based identity
From basic visibility to full incident response. Choose what you need.
The agent—controlled by a local administrator—has final say over what it will do. No blind trust in centralized infrastructure.
To compromise an agent, an attacker needs ALL THREE layers:
Transport protection. Agent ↔ Collector connection encrypted and mutually authenticated.
Content protection. Capability manifests are cryptographically signed. Password required to sign.
Human gate. Local administrator must approve capability changes with elevated privileges.
A YAML document defines exactly what the agent will do:
manifest:
id: "standard"
version: "2.1.0"
name: "Standard Monitoring"
# What the agent will SEND
info:
metrics:
enabled: true
categories: [cpu, memory, disk, network]
inventory:
enabled: true
exclude: [user_accounts] # Privacy
security_monitoring:
enabled: false # Explicitly disabled
# What the agent will ACCEPT
control:
diagnostics:
ping: true
traceroute: true
execution:
shell: false # No remote shell!
system:
lock_screen: true
reboot: false
# Who controls capabilities
meta:
collector_can_manage_capabilities: falseFree tier for small teams. Premium features for organizations that need more.
Individual / Small Teams
Small Teams
Growing Orgs
Large Orgs / Regulated
All plans include: mTLS encryption, capability manifests, local admin control, and the same agent binary.
Feature availability is determined by your license, not a different agent build.
We don't hide our design thinking. Security through obscurity isn't security. You deserve to know how we protect your infrastructure.
Our architecture decisions, state machine design, capability system, and trust model are all documented publicly. You can understand exactly how EyeLog works before deploying.
We believe security should come from sound design principles, not from hiding how things work. Our defense-in-depth approach is strong enough to withstand scrutiny.
Every architectural decision has trade-offs. We document ours openly—why two channels, why local authority, why manifest signing. Informed customers make better decisions.
Agent connects outbound to collector. No inbound ports, no firewall rules, works through NAT automatically.
gRPC for control (reliable), QUIC for data (fast). Each protocol optimized for its purpose.
Agent decides what to do, not the collector. Collector compromise doesn't mean full estate compromise.
YAML documents define exactly what each agent can do. Explicit opt-in, no implicit permissions.
Cryptographic signatures prevent tampering. Password-protected keys, HSM support for enterprise.
Three layers: mTLS (transport) + Signing (content) + Local Admin (human). All three required.
Operational state tracking prevents command conflicts. No corrupted deployments from concurrent admins.
Deploy your first agent in under 5 minutes. Free tier includes up to 5 agents.