blumira-agents

# Blumira Agents & Devices ## Overview Blumira agents (sensors) are deployed on devices to collect log data and detect threats. This skill covers device inventory management, agent health monitoring, and agent key management for deployments. ## Anti-triggers - **Claude subagents** — "agent" here is a Blumira log sensor, never an AI subagent definition under `agents/*.md`. - **An EDR agent** — a Blumira agent ships logs; it does not detect or remediate on the endpoint. Endpoint sensors are `huntress-agents`, `sentinelone-inventory`, or `blackpoint-asset-inventory`. - **What the agent detected** — telemetry becomes a finding; use `blumira-findings`. - **Devices in another client account** — these are `/org/*` calls; per-account device lists are `blumira_msp_devices_list` in `blumira-msp`. ## Key Concepts ### Devices Devices represent endpoints, servers, or network appliances with Blumira agents installed. Each device record includes agent status, last seen time, OS information, and network details. ### Agent Keys Agent keys are deployment tokens used to register new agents with your Blumira organization. Keys can be scoped and rotated as needed. ## API Patterns ### List Devices ``` blumira_agents_devices_list page_size=50 order_by=-last_seen ``` Filter examples: ``` blumira_agents_devices_list os.contains=Windows status.eq=active ``` ### Get Device Details ``` blumira_agents_devices_get device_id=<UUID> ``` ### List Agent Keys ``` blumira_...