How does agentless monitoring differ from agent-based monitoring?

Agent-based monitoring utilizes a software agent installed directly on the monitored host. This agent can perform local data processing, aggregation, and filtering. By analyzing data at the source, it can be configured to transmit only the most critical or relevant events to the central monitoring server. This pre-processing significantly reduces the amount of data sent over the network. In contrast, agentless monitoring typically polls devices remotely using standard protocols (e.g., SNMP, WMI). This process often involves transferring larger, unfiltered datasets, which can result in higher network bandwidth consumption compared to the optimized transmissions from an agent.

A: WMI is a protocol commonly used for agentless monitoring of Windows systems, not a characteristic of agent-based methods. Both approaches can utilize APIs.

B: Agent-based monitoring is considered more intrusive because it requires the installation and maintenance of third-party software directly on the production system.

C: Agent-based monitoring typically has a higher operational overhead and cost due to the need to deploy, manage, and update agents across numerous endpoints.

1. Santos

O. (2020). Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) 200-201 Official Cert Guide. Cisco Press. Chapter 15

"Network Monitoring and Analysis

" in the section "Host-Based Data

" it is explained that endpoint security solutions (which use agents) provide deep visibility into the operating system. This local presence allows for intelligent

local processing before data is sent to a central manager

optimizing data transmission.

2. Cisco. (2023). Cisco Secure Endpoint User Guide. In the documentation describing the architecture

the connector (agent) is detailed as having local analysis capabilities. It processes events on the endpoint and sends select telemetry data to the cloud console

which exemplifies the principle of local filtering to reduce network traffic. (Reference: General architecture and connector function sections).

3. Stallings

W. (2013). SNMP

SNMPv2

SNMPv3

and RMON 1 and 2 (3rd ed.). Addison-Wesley Professional. Chapter 4

"SNMPv1

" describes the polling mechanism (get-request) inherent to SNMP

a primary agentless protocol. This model

without careful management

can lead to significant network overhead as the management station must repeatedly query for bulk data

contrasting with the event-driven

filtered reporting possible with an intelligent agent.