How does agentless monitoring differ from agent-based monitoring?

Agent-based monitoring utilizes a software agent installed directly on the monitored host. This agent can perform local data processing, aggregation, and filtering. By analyzing data at the source, it can be configured to transmit only the most critical or relevant events to the central monitoring server. This pre-processing significantly reduces the amount of data sent over the network. In contrast, agentless monitoring typically polls devices remotely using standard protocols (e.g., SNMP, WMI). This process often involves transferring larger, unfiltered datasets, which can result in higher network bandwidth consumption compared to the optimized transmissions from an agent.

A: WMI is a protocol commonly used for agentless monitoring of Windows systems, not a characteristic of agent-based methods. Both approaches can utilize APIs. B: Agent-based monitoring is considered more intrusive because it requires the installation and maintenance of third-party software directly on the production system. C: Agent-based monitoring typically has a higher operational overhead and cost due to the need to deploy, manage, and update agents across numerous endpoints.

1. Santos, O. (2020). Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) 200-201 Official Cert Guide. Cisco Press. Chapter 15, "Network Monitoring and Analysis," in the section "Host-Based Data," it is explained that endpoint security solutions (which use agents) provide deep visibility into the operating system. This local presence allows for intelligent, local processing before data is sent to a central manager, optimizing data transmission.

2. Cisco. (2023). Cisco Secure Endpoint User Guide. In the documentation describing the architecture, the connector (agent) is detailed as having local analysis capabilities. It processes events on the endpoint and sends select telemetry data to the cloud console, which exemplifies the principle of local filtering to reduce network traffic. (Reference: General architecture and connector function sections).

3. Stallings, W. (2013). SNMP, SNMPv2, SNMPv3, and RMON 1 and 2 (3rd ed.). Addison-Wesley Professional. Chapter 4, "SNMPv1," describes the polling mechanism (get-request) inherent to SNMP, a primary agentless protocol. This model, without careful management, can lead to significant network overhead as the management station must repeatedly query for bulk data, contrasting with the event-driven, filtered reporting possible with an intelligent agent.