The agent
It has to be inside to be useful, so it comes on a short leash
A webhook can only reason about the text of an alert that already fired. An agent can query the reject table and read the mapping — which is why it ships with hard limits rather than promises.
What it can and cannot do
Outbound HTTPS only
No inbound ports, no listening sockets. Nothing dials into your network.
A finite query catalogue
Read-only, row-capped, parameterised, and approved by you. Nothing outside it ever runs.
Redaction before transmission
Connection strings, tokens, card numbers and personal data are scrubbed at the agent — not on ingest, which would already be too late.
Scoped collection
Evidence is gathered around a specific incident and window, not streamed continuously.
Auditable
Every collection, query and permission is recorded, along with the agent that performed it.
Runs where you do
Windows Service, systemd, Docker, or Kubernetes.
Get started
Security review is the first conversation, not the last
We would rather hand your team the agent's permission model up front than discover an objection three months in.