RocketCyber Agent Management
Overview
RocketAgent is the endpoint agent deployed by RocketCyber to customer workstations and servers. It provides the telemetry pipeline for threat detection -- collecting event data, monitoring processes, and reporting back to the RocketCyber SOC platform. Agent health directly impacts the MSP's security coverage.
Key agent functions:
- Threat Telemetry - Collects endpoint events (process execution, file changes, network connections)
- SOC Communication - Reports events to RocketCyber's cloud analysis engine
- Endpoint Visibility - Provides the SOC with real-time endpoint status
- Detection Coverage - Endpoints without healthy agents have no SOC coverage
Key Concepts
Agent Lifecycle
┌──────────────┐ Deploy ┌────────────┐ Checks In ┌──────────┐
│ Unmanaged │ ──────────> │ Installed │ ─────────────> │ Online │
│ Endpoint │ │ (Pending) │ │ │
└──────────────┘ └────────────┘ └──────────┘
│
Communication │ Lost
▼
┌──────────┐
│ Offline │
└──────────┘Communication Status
| Status | Description | Action | |--------|-------------|--------| | Online | Agent is communicating normally with the RocketCyber cloud | No action needed | | Offline | Agent has not communicated within the expected interval | Investigate connectivity, service status |
Agent Types and Platforms
RocketAgent supports multiple platforms (verify against current documentation):
| Platform | Description | |----------|-------------| | Windows | Primary platform -- workstations and servers | | macOS | Mac endpoint support | | Linux | Server monitoring (verify availability) |
Field Reference
| Field | Type | Description | |-------|------|-------------| | id | integer | Unique agent identifier | | hostname | string | Endpoint hostname | | accountId | integer | Customer account the agent belongs to | | accountName | string | Customer account name (verify against API docs) | | platform | string | Operating system platform (Windows, macOS, Linux) | | osVersion | string | OS version details (verify against API docs) | | status | string | Communication status: Online, Offline | | lastSeen | datetime | Last successful communication timestamp | | agentVersion | string | Installed RocketAgent version (verify against API docs) | | ipAddress | string | Last known IP address (verify against API docs) | | installedAt | datetime | When the agent was first installed (verify against API docs) |
Note: Field names are inferred from the Celerium PowerShell wrapper. Verify exact field names against RocketCyber API responses.
API Patterns
List All Agents
# All agents across all accounts
curl -s "https://api-${ROCKETCYBER_REGION:-us}.rocketcyber.com/v3/agents" \
-H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"Response (verify against API docs):
{
"data": [
{
"id": 5001,
"hostname": "WORKSTATION-01",
"accountId": 12345,
"platform": "Windows",
"status": "Online",
"lastSeen": "2026-02-23T10:15:00Z",
"agentVersion": "3.2.1"
}
],
"totalCount": 350,
"page": 1,
"limit": 50
}Filter Agents by Account
# Agents for a specific customer
curl -s "https://api-us.rocketcyber.com/v3/agents?accountId=12345" \
-H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"Get Agent Details
# Single agent with full details
curl -s "https://api-us.rocketcyber.com/v3/agents/5001" \
-H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"Response (verify against API docs):
{
"id": 5001,
"hostname": "WORKSTATION-01",
"accountId": 12345,
"accountName": "Acme Corporation",
"platform": "Windows",
"osVersion": "Windows 11 Pro 23H2",
"status": "Online",
"lastSeen": "2026-02-23T10:15:00Z",
"agentVersion": "3.2.1",
"ipAddress": "192.168.1.50",
"installedAt": "2025-06-15T09:00:00Z"
}Common Workflows
Agent Health Audit
- List all agents -- retrieve full agent inventory
- Identify offline agents -- filter for status=Offline or agents not seen recently
- Group by account -- identify which customers have coverage gaps
- Calculate coverage -- compare agent count to expected endpoint count
- Report findings -- generate per-customer agent health summary
Troubleshooting Offline Agents
When an agent shows as Offline:
- Check last seen timestamp -- determine how long the agent has been offline
- Verify endpoint is powered on -- check with RMM tool (Datto RMM, NinjaOne, etc.)
- Check RocketAgent service -- verify the service is running on the endpoint
``powershell Get-Service -Name "RocketAgent" | Select-Object Status, StartType ``
- Check network connectivity -- verify endpoint can reach
*.rocketcyber.com - Check agent version -- outdated agents may have communication issues
- Reinstall if needed -- redeploy the agent from the RocketCyber console
New Customer Onboarding
- Create customer account in RocketCyber (or verify it exists)
- Download agent installer from the RocketCyber console for the customer account
- Deploy agents to all customer endpoints via RMM tool or manual installation
- Verify agents check in -- confirm all agents show Online status
- Validate coverage -- ensure agent count matches expected endpoint count
Agent Version Compliance
- List all agents across accounts
- Group by
agentVersion - Identify agents on outdated versions
- Plan upgrade rollout for non-current agents
Error Handling
Common Errors
| Scenario | HTTP Code | Resolution | |----------|-----------|------------| | Invalid API key | 401 | Verify key in Provider Settings > API | | Agent not found | 404 | Verify agent ID; agent may have been removed | | Account has no agents | 200 (empty) | Agents not yet deployed to this customer | | Rate limited | 429 | Back off 30 seconds, retry |
No Agents Found
No agents found for account ID 12345.
This could mean:
- Agents have not been deployed to this customer
- The account ID is incorrect (verify with /accounts endpoint)
- Agents were recently removedRelated Skills
- [api-patterns](../api-patterns/SKILL.md) - Authentication, pagination, error handling
- [incidents](../incidents/SKILL.md) - Incidents reference affected devices/agents
- [accounts](../accounts/SKILL.md) - Account hierarchy (agent-to-account mapping)
- [apps](../apps/SKILL.md) - Applications detected on agent endpoints