Device Agent Overview
Learn what Device Agent does, from enrolling devices and running as an OS service to collecting posture checks and auto-updating from signed releases.
Device Agent (probo-agent) is a lightweight device posture agent. It runs as a managed OS service, enrolls a device against your Probo organization, and periodically reports security posture checks over the Device Agent API (/api/agent/v1).
What it does
Section titled “What it does”- Enrolls devices with a one-shot enrollment token from the Probo console
- Runs as an OS service on macOS (
launchd), Linux (systemd), FreeBSD (rc.d), and Windows (Service Control Manager) - Collects posture checks such as disk encryption, screen lock, firewall, time sync, OS version, auto-update, password policy, remote login, and malware protection
- Heartbeats and reports posture results to Probo on a server-configured interval
- Auto-updates from signed GitHub Releases (
probo-agent/v*), with Cosign/Sigstore verification before installing a new binary
It is not an MDM. The Probo server cannot push arbitrary checks, shell commands, or device control actions to the agent. See Security.
Supported platforms
Section titled “Supported platforms”| Platform | Install options | Enrollment |
|---|---|---|
| macOS | Signed universal .pkg | Browser / tray via Probo Agent.app and probo:// deeplink |
| Windows | Signed .msi | Tray-assisted browser enrollment from the Probo console |
| Linux | install.sh, CLI archive | CLI (install.sh or probo-agent install) |
| FreeBSD | install.sh, CLI archive | CLI (install.sh or probo-agent install) |
See Install to pick a platform, or go straight to macOS, Windows, Linux, or FreeBSD.
How enrollment works
Section titled “How enrollment works”- Create or open a device in the Probo console and generate an enrollment token.
- Install the agent — on desktops, prefer the package installer then enroll from us.probo.com/enroll or eu.probo.com/enroll; on servers, pass the server URL and token on the command line.
- The agent exchanges the one-shot token for a device API key, configures heartbeat/posture intervals, and starts the OS service.
- Posture results appear on the device in the Probo console.
Posture checks
Section titled “Posture checks”The agent evaluates this check set on each collection cycle:
| Check key | What it verifies |
|---|---|
DISK_ENCRYPTION | Full-disk encryption is enabled |
SCREEN_LOCK | Screen lock / idle lock is configured |
FIREWALL_ENABLED | Host firewall is enabled |
TIME_SYNC | System clock synchronization is active |
OS_VERSION | Operating system meets the expected version policy |
AUTO_UPDATE | Automatic updates are enabled |
PASSWORD_POLICY | Local password policy is present |
REMOTE_LOGIN | Remote login exposure is assessed |
MALWARE_PROTECTION | Built-in malware protection is enabled where applicable |
Use probo-agent collect to run the checks locally without pushing results.
Next steps
Section titled “Next steps” Install Choose the install and enrollment path for your OS
Security Push-only design, fixed checks, and why this is not an MDM
Contributing Contribute to the official agent; security review takes time
Device Agent API Build a custom agent with the enrollment and posture protocol