The agent uses the TLS plugin — the endpoint initiates all connections to iassets.io:443 (HTTPS). The server never opens a connection back.
Traffic (always outbound, agent → backend):
Endpoint | Frequency | What it does |
|---|---|---|
POST enroll | 1× on install | Exchanges enroll_secret for node_key |
GET config | About every ~1h (refresh) | Fetches query schedule |
POST logger | At each query schedule (hostname/OS 1h, software 2h) | Sends results |
POST distributed/read | About every ~10s (default) | Asks "any new query for me?" — polling, still outbound |
POST distributed/write | After executing live query | Sends live query result |
POST agent/checkin | Periodic heartbeat | Updates last_seen |
The Power Query (live query) feature is also outbound: the agent polls the backend to check whether there is a pending query. The backend never pushes anything — it only replies to whoever asks.
Endpoint firewall requirements
Direction | Port | Destination | Required? |
|---|---|---|---|
Outbound | TCP 443 (HTTPS) | iassets.io | ✅ Yes |
Outbound | TCP 53 / UDP 53 (DNS) | Internal or public DNS | ✅ Yes |
Inbound | — | — | ❌ None |
Why is this safe?
Works behind corporate NAT/proxy (just like any HTTPS client)
Does not expose the endpoint to the internet
Optional mutual TLS (client verifies server cert via certs.pem)
Compatible with Zero Trust / SASE — only need to allow destination iassets.io:443
If the security team wants to be more restrictive, they can allowlist by SNI (iassets.io) or by Cloud Run IP (us-central1) — but the Cloud Run IP changes, so SNI/FQDN is the way to go.