# Probo Agent Overview

Probo Agent (`probo-agent`) is a lightweight device posture agent. It runs as a managed OS service, enrolls a device against your Probo organization, and periodically reports security posture checks over the [Device Agent API](/docs/developers/api/agent/overview) (`/api/agent/v1`).

## What it does

- **Enrolls devices** with a one-shot enrollment token from the Probo console
- **Runs as an OS service** on macOS (`launchd`), Linux (`systemd`), FreeBSD (`rc.d`), and Windows (Service Control Manager)
- **Collects posture checks** such as disk encryption, screen lock, firewall, time sync, OS version, auto-update, password policy, remote login, and malware protection
- **Heartbeats and reports** posture results to Probo on a server-configured interval
- **Auto-updates** from signed GitHub Releases (`probo-agent/v*`), with Cosign/Sigstore verification before installing a new binary

It is **not** an MDM. The Probo server cannot push arbitrary checks, shell commands, or device control actions to the agent. See [Security](/docs/product/probo-agent/security).

## Supported platforms

| Platform | Install options           | Enrollment                                                   |
| -------- | ------------------------- | ------------------------------------------------------------ |
| macOS    | Signed universal `.pkg`   | Browser / tray via `Probo Agent.app` and `probo://` deeplink |
| Windows  | Signed `.msi`             | Tray-assisted browser enrollment from the Probo console      |
| Linux    | `install.sh`, CLI archive | CLI (`install.sh` or `probo-agent install`)                  |
| FreeBSD  | `install.sh`, CLI archive | CLI (`install.sh` or `probo-agent install`)                  |

See [Install](/docs/product/probo-agent/install) to pick a platform, or go straight to [macOS](/docs/product/probo-agent/macos), [Windows](/docs/product/probo-agent/windows), [Linux](/docs/product/probo-agent/linux), or [FreeBSD](/docs/product/probo-agent/freebsd).

## How enrollment works

1. Create or open a device in the Probo console and generate an enrollment token.
2. Install the agent — on desktops, prefer the package installer then enroll from [us.probo.com/enroll](https://us.probo.com/enroll) or [eu.probo.com/enroll](https://eu.probo.com/enroll); on servers, pass the server URL and token on the command line.
3. The agent exchanges the one-shot token for a device API key, configures heartbeat/posture intervals, and starts the OS service.
4. Posture results appear on the device in the Probo console.

## Posture checks

The agent evaluates this check set on each collection cycle:

| Check key            | What it verifies                                        |
| -------------------- | ------------------------------------------------------- |
| `DISK_ENCRYPTION`    | Full-disk encryption is enabled                         |
| `SCREEN_LOCK`        | Screen lock / idle lock is configured                   |
| `FIREWALL_ENABLED`   | Host firewall is enabled                                |
| `TIME_SYNC`          | System clock synchronization is active                  |
| `OS_VERSION`         | Operating system meets the expected version policy      |
| `AUTO_UPDATE`        | Automatic updates are enabled                           |
| `PASSWORD_POLICY`    | Local password policy is present                        |
| `REMOTE_LOGIN`       | Remote login exposure is assessed                       |
| `MALWARE_PROTECTION` | Built-in malware protection is enabled where applicable |

Use `probo-agent collect` to run the checks locally without pushing results.

## Next steps

- [Install](/docs/product/probo-agent/install) — Choose the install and enrollment path for your OS
- [Security](/docs/product/probo-agent/security) — Push-only design, fixed checks, and why this is not an MDM
- [Contributing](/docs/developers/api/agent/contributing) — Contribute to the official agent; security review takes time
- [Device Agent API](/docs/developers/api/agent/overview) — Build a custom agent with the enrollment and posture protocol