The agent
Evidence from the machine that has it
Most investigations need nothing installed: code comes from GitHub and logs from Google Cloud Logging. When the evidence is a log file on a Windows server or an Event Log record on the host that ran the job, the optional agent fetches it.
When you need it
An optional collection path, for evidence that never leaves the host it was written on.
Decim starts from your code. It reads a GitHub repository, finds the pipelines in it and builds a step graph, then investigates an incident by walking those steps and reading their logs. For services that log to Google Cloud Logging, that is the whole story: you define named log sources as filters and the investigation reads from them directly.
Some evidence is not in a cloud logging service. A scheduled job on a Windows server writes its log to a folder on that server. A service crash shows up in the Windows Event Log of the machine and nowhere else. A file-based integration leaves its trail in a drop directory. For those, the Windows agent is the way in.
It is deliberately small. It is not a remote shell, not a database connector and not a monitoring agent: it runs three read tasks, on sources you name, when an investigation asks.
Where each kind of evidence comes from
The agent is one row in this table. Every other path is connected from the browser.
| Evidence | Path | Installation |
|---|---|---|
| Source code, commits, pull requests | GitHub App | Nothing to install |
| Cloud-hosted service and job logs | Google Cloud Logging (read-only logging.read) | Nothing to install |
| Ticket text, comments, attachments | Jira Cloud (read-only OAuth) | Nothing to install |
| An export or screenshot someone already has | File attachment on the incident, up to 500 MB | Nothing to install |
| Log files on a Windows server inside your network | Windows agent: directory listing and file read | Optional agent |
| Windows Event Log of the host that ran a job | Windows agent: Event Log read | Optional agent |
What the agent can collect
Three task types. Anything else is rejected as unsupported by this agent version.
Each task names a source by the name you gave it in configuration, not by a raw path, and every path in a task is resolved relative to that source.
| Task | Input | Returns | Typical use |
|---|---|---|---|
| Directory listing | A configured directory, or a folder inside it | Relative path, type, size and last-write time of each entry | Find the log file for the run that failed |
| File read | A file in a configured directory; optionally an offset and length | The bytes requested, or a sampled preview when the range is larger than 5 MB | Read the lines around the failure, by byte range |
| Windows Event Log read | A configured channel, a UTC time range, and levels allowed for that channel | Event records in the range | Find the service crash or restart that the application log never recorded |
One file decides what it may read
The agent's sources are set on the host, by whoever installs it, not by the service.
The configuration sits beside the executable. Directories are listed with a name and a path;
Event Log channels with a name, the channel and the levels that may be read. A task that names
a source not in this file fails with unknown_source, and a task asking for Event
Log levels outside the configured list fails with invalid_levels.
{
"apiBaseUrl": "https://decim.example.com/",
"apiKey": "<shown once when you register the agent>",
"tenantId": "<your workspace ID>",
"pollIntervalSeconds": 5,
"logDirectories": [
{ "name": "ledger-jobs", "path": "D:\\Jobs\\LedgerLoad\\Logs" }
],
"eventLogs": [
{
"name": "application",
"channel": "Application",
"allowedLevels": ["critical", "error", "warning"]
}
]
}The Windows account that runs the agent needs read access to these directories and channels, and nothing more. Giving it a narrow account is the simplest control you have.
How an evidence task travels
- 1. Register. An administrator creates the agent in the workspace and receives its key, shown once. The agent can optionally be scoped to one discovered pipeline.
- 2. Install. Download the Windows x64 release, copy the configuration template beside the executable, and fill in the API URL, the key, the workspace ID and the sources the agent may read.
- 3. Poll. The agent calls Decim over HTTPS to ask for work, every five seconds by default (configurable from 1 to 300). The service never opens a connection to it.
- 4. Collect. When an investigation needs a file or Event Log range, the agent receives that task on its next poll, performs the read and posts the result, or a coded failure such as unknown_source or file_unavailable.
- 5. Cite. The result becomes evidence on the incident. Findings that rest on it cite the exact lines, by byte offset or record ID, with an excerpt and a hash.
The workspace shows each agent's hostname, platform, version, status, configured source names and last poll, so you can see whether it is connected rather than guessing from a stale key.
Where it fits in an investigation
After Decim has matched an incident to a pipeline, it reads the logs step by step, most suspicious step first. For each step it knows where the logs live: a Cloud Logging source, or an agent directory or channel. It requests what it needs through the right path automatically, within fixed limits on requests, bytes and model calls.
Large files are read in pieces. The first request returns a sampled preview, and the investigation then asks for the byte range around the run it cares about. When it compares the failing run with earlier successful ones, up to 30 days back, it does the same for the baseline runs.
Each step ends as "looked fine", "found something", or an honest gap. If the agent is offline or a source is not configured, the step is marked "collection unavailable" rather than silently skipped, and the conclusion says what it could not see.
2026-10-13 02:14:09 usp_load_transactions Loaded 57911 rows for USD
2026-10-13 02:14:09 usp_load_transactions Loaded 12206 rows for GBP
2026-10-13 02:14:09 usp_load_transactions Step completed successfully (0 errors)In the demo workspace's worked example, these three lines are the finding: the nightly ledger load reported success, and the line for EUR that appeared every previous night is missing. The citation carries the byte offsets and a hash, so anyone can reopen the file and check. The full story is on the investigations page.
What is controlled today
- Outbound only. The agent polls over HTTPS; it exposes no listener.
- Sources set on the host. Only directories and channels in the local configuration can be read, and Event Log reads are limited to the configured levels.
- Path confinement. A path in a task must stay inside its configured directory: traversal (
..), alternate data streams, symbolic links and junctions are refused. - Bounded results. One result is capped at 5 MB; larger reads come back as a sampled preview.
- Optional pipeline scope. Registration can restrict an agent to one discovered pipeline.
- One-time key. The registration key is shown once and is specific to the agent.
- Readable source. The agent is MIT-licensed, so your team can read exactly what it does.
What it does not do
- No SQL. It cannot query a database. Database evidence comes from read-only checks Decim writes for your team to run.
- No redaction. What it reads is sent unchanged.
- No writes. It does not change files, services or settings on the host.
- Windows x64 only. A Linux agent is planned.
Common questions
Do we need the agent to use Decim?
No. Decim reads code from GitHub and logs from Google Cloud Logging without anything installed in your network, and you can attach files to any incident. The agent is for evidence that only lives on a Windows host: local log files and the Windows Event Log.
What does the agent read?
Directory listings, file contents and Windows Event Log records, and only from the directories and Event Log channels named in its own configuration file.
Does it run SQL queries or read databases?
No. The agent has no database access. When the deciding evidence is in a database, the investigation writes a read-only query for a person on your team to run, and the result goes back into the incident.
Does the agent redact evidence before sending it?
No. It sends what it reads unchanged, and the service does not redact either. Do not configure a directory or channel that routinely carries secrets or personal data you are not prepared to share. Evidence is processed by a third-party language-model provider; see the security page.
Can Decim connect into our network?
No. The agent initiates every request and receives tasks in the response to its own poll. It opens no listening port.
Does it run on Linux or in a container?
Not today. The supported build is Windows x64. A Linux agent is planned.
How do we stop it?
Stop the process, or delete its key in the workspace. Without a valid key the agent cannot receive or complete tasks.
Get started
Have logs that live on a server?
Bring an incident whose evidence sits on a Windows host. We will set up the agent next to GitHub and Cloud Logging and show you what the investigation can see.