Latest Release
Snare Agent v5.11.1 & Snare Agent Manager v2.3.0
Snare Agent — Endpoint Log Collection
Forensic-grade log collection. Global scale. One standard.
Snare Agent is a lightweight, tamper-resistant endpoint log collector that captures security events natively at the operating system and preserves chain of custody from source to SIEM. It covers Windows, Linux, macOS and Unix across 200+ OS and device types, on-premises and in the cloud, including ARM64 workloads.
Unlike agentless approaches that depend on network visibility or API polling, Snare captures events where they are generated, buffers them locally and delivers them in sequence, so your SIEM, data lake and archive receive the complete record.
✓✓ 256 simultaneous destinations| ✓ ETW collection for Windows✓ ARM64 cloud support ✓ Log translation to English
v5.11.0
Current Agent release
v2.3.0
Current SAM release
200+
OS & device types supported
40–60%
Typical SIEM ingest reduction
HOW SNARE AGENT WORKS
Four-stage log lifecycle — from capture to delivery
Every event passes through the same controlled pipeline on the endpoint, so what reaches your downstream platforms is complete, consistent and defensible.
01 // CAPTURE
OS-native event capture
Hooks into the native OS event subsystems (Windows Event Log, Linux auditd, macOS Unified Logging) as events are created. v5.11 adds Event Tracing for Windows (ETW) providers, such as DNS Analytic and Debug logs, that audit policies can’t reach.
OS-native | ETW
02 // TRANSLATE & FILTER
Normalise, translate and filter
Translates Windows audit data to English whatever the endpoint’s language. Filters at the source by event ID, type, user, process, severity, keyword or regex, so only the events you need reach paid ingestion.
log translation | event-ID rules
03 // SECURE
Buffer, encrypt and verify
Writes events to an encrypted local buffer before forwarding, so they survive network outages and SIEM maintenance. Transit uses TLS 1.2/1.3, and agent management interfaces enforce OpenSSL security level 3, accepting only strong cipher suites.
TLS 1.2/1.3 | local buffer
04 // ROUTE & FORWARD
Policy-to-destination routing
Routes each data set to the right platform using port-based parsing, purpose-built for Securonix and Devo, and supports Splunk and standards-based SIEMs. Delivers to up to 256 network destinations at once, so the same events can feed multiple SIEMs, data lakes and archives in parallel, with configurable heartbeat routing.
multi-destination | port-based routing
TECHNICAL SPECIFICATIONS
Built for enterprise-scale production environments
Platform Support
| Windows | Server 2008 R2 to 2025, Windows 10/11, Core and Server Core editions |
| Linux (x86-64) | RHEL 6+ including RHEL 10 NEW, AlmaLinux incl. 10 NEW, Oracle Linux incl. 10 NEW, Debian 9+ incl. 13 NEW, Ubuntu 16.04+, CentOS, Rocky |
| Linux (ARM64) | Ubuntu 22.04 and 24.04 NEW |
| macOS | macOS 10.14 to macOS 15 Sequoia, and macOS 26 NEW |
| Unix | Solaris 10/11, AIX 6.1+, HP-UX 11i v2/v3 |
| Cloud | AWS, Microsoft Azure, Google Cloud and Oracle Cloud NEW virtual machines, on x86-64 and ARM64 instances |
| Network devices | Syslog-capable devices via the Snare Syslog Agent |
Log Sources & Telemetry
| Windows | Security, System, Application, PowerShell, DNS, DHCP, IIS, RDP, WMI and custom logs, with log translation to English |
| Windows ETW | ETW providers and channels, including DNS Analytic/Debug and other manifest-based .etl providers, with per-provider filters and criticality NEW |
| Linux | auditd, syslog, journald, auth.log, /var/log/*, PAM and custom files |
| macOS | Unified Logging, ASL, system.log and security events, with Devo box.audit.macos.event routing |
| Integrity monitoring | FIM: create, modify, delete and rename events with SHA-256 hashing. RIM for the Windows registry. |
| Process events | PID, PPID, command line, user context and parent-child chain |
| Linux telemetry | CPU, disk, memory and network metrics |
Transport & Security
| Encryption in transit | TLS 1.2 and 1.3, with certificate-based mutual TLS |
| Management hardening | OpenSSL security level 3 on the agent web server: AES-256-GCM with ECDHE/DHE only. RSA keys of 2048 bits or smaller, SHA-1, RC4 and 3DES are rejected. NEW |
| Protocols | Syslog RFC 3164/5424, TCP, TLS, UDP, Snare native |
| Local buffering | Configurable encrypted disk buffer, delivered in sequence on recovery |
| Tamper protection | Signed configuration files, tamper-resistant process, sequence-numbered streams, path-validated config exports |
| Chain of custody | Source hostname, timestamp, sequence ID and integrity metadata on every record |
Performance, Deployment & Routing
| System footprint | <50 MB RAM and <1% CPU under typical load; much lighter Agent web UI in v5.11 NEW |
| Deployment | MSI (Windows), RPM/DEB (Linux), PKG (macOS); unattended and scripted install; AMI/VM images and cloud-init |
| Upgrades | Remote upgrades from SAM for Windows and Linux agents NEW |
| Destinations | Up to 256 simultaneous network destinations per agent, each with its own format and filters; configurable heartbeat destinations NEW |
| Policy-to-destination | Port-based parsing for Securonix, Devo, Splunk and others |
| Filters | Event ID and type include/exclude, user/group, process name/path, keyword, regex |
| Output formats | Snare native, Syslog, JSON, CEF, LEEF, custom templates |
KEY CAPABILITIES
Purpose-built for security — not a generic log shipper
Event Tracing for Windows (NEW)
Collect events from ETW providers that Windows audit policies can’t reach, including DNS Analytic and Debug logs, which are key telemetry for spotting command and control, DNS tunnelling and exfiltration. Configure providers, channels, filters and criticality on a dedicated Log Sources page. Audit policies remain the preferred source wherever they can collect the same events.
Hardened cryptography (NEW)
Agent and SAM management traffic is held to OpenSSL security level 3, with strong cipher suites only and legacy algorithms rejected. This is part of Snare’s ongoing cryptographic modernisation across the suite, aligned with NIST’s post-quantum standards and the ASD Information Security Manual’s 2030 transition guidance.
ARM64 and current Linux platforms (NEW)
ARM64 agent builds for Ubuntu 22.04 and 24.04 bring Arm-based cloud instances on AWS, Azure, Google Cloud and Oracle Cloud into the same collection standard. New support also covers RHEL 10, AlmaLinux 10, Oracle Linux 10 and Debian 13.
Log Translation — Windows Audit to English
Windows audit data arrives in English while endpoints keep their local language. That means one detection ruleset, consistent dashboards and no per-language parser changes across a global estate.
Tamper-Resistant by Design
OS-native capture, an encrypted local buffer, signed configurations and sequence-numbered streams preserve a verifiable record from endpoint to destination, supporting investigations and evidential requirements.
File and registry integrity monitoring
Real-time FIM with SHA-256 hashing, recursive directories and include/exclude rules, plus registry integrity monitoring on Windows. Policies are managed remotely through SAM, with no site visits.
Multi-SIEM and data lake routing
Send the same event stream to up to 256 network destinations at once, including Splunk HEC, Microsoft Sentinel, IBM QRadar, Securonix, Devo, Snare Central, Kafka, S3 and syslog.
Run multiple SIEMs side by side, feed data lakes and archives in parallel, or migrate between platforms without a collection gap. Port-based policy routing sends each data set to the right table or index first time.
Precision Filtering at Source
Filter by event ID, user, process, keyword or regex on the agent, before data reaches paid ingestion. Customers typically see 40–60% lower SIEM ingest with event-ID filtering; results depend on source mix and policy.
Cloud & Hybrid ready
Runs natively on cloud virtual machines across x86-64 and ARM64, with auto-scaling groups, image packaging and cloud-init deployment, managed from the same SAM console as on-premises agents.
SNARE AGENT MANAGER (SAM V23.0)
Run your entire agent fleet from one console
SAM is included at no additional cost. Each release moves more agent administration into the console, so teams make fewer changes on individual hosts. Version 2.3.0 adds single sign-on, remote Linux upgrades and centralised secrets management.
Monitoring & reporting
- Fleet health dashboard
- Event volume metrics per agent and destination group
- Offline agent alerting
- Licence management, with a modernised UI NEW
Identity & access
- OIDC single sign-on: Microsoft Entra ID, OktaNEW
- LDAP authentication
- Role-based access control
- Configurable session timeoutNEW
- Audit trail, including agent-deletion eventsNEW
Policy & configuration
- Default config templates, with no master agent needed
- Drag-and-drop policy group ordering NEW
- Remote policy for destinations, FIM, RIM and Linux audit
- Tree-style destination selector; agent ETW settings shown in Master Configuration NEW
- Bulk tagging; import/export for air-gapped networks
Secrets & keys
- Edit SAM and TLS authentication keys centrally NEW
- Reset agent passwords from Master Configuration NEW
- Apply a new key to all configurations in one step NEW
- Key rotation grace period (24 hours by default) NEW
Agent lifecycle
- Network scan discovery
- Remote upgrade: Windows and Linux NEW
- Filter, search and schedule upgrades at scale NEW
- Bulk delete with confirmation NEW
- Unmanaged group for local break-glass control
USE CASES
Proven in the environments where log integrity and scale matter most
MSSP / GLOBAL ENTERPRISE
Standardising Multilingual Estates with Log Translation
An MSSP managing enterprise clients across Europe, Asia, and the Americas was maintaining separate SIEM detection rulesets per region because Windows audit data arrived in local languages. Different event descriptions meant different parser logic, divergent alert thresholds, and inconsistent reporting. Log Translation normalised all Windows audit data to English at the agent — enabling one ruleset, one dashboard standard, and consistent SOC collaboration across time zones.
OUTCOME
Regional SIEM rulesets consolidated to a single standard. Dashboard consistency achieved across all customer environments. SOC collaboration measurably improved across time zones.
CISO / ENTERPRISE
Reducing SIEM Ingest Costs Without Creating Security Blind Spots
A large financial institution was significantly overspending on SIEM ingestion for Windows Security event logs dominated by high-volume, low-value noise. Deploying Snare Agent with precision event-ID filtering removed 65% of log volume before SIEM ingest while retaining all security-relevant events (Event IDs 4624, 4625, 4648, 4688, and equivalents). The filtering was applied at the endpoint with zero changes to SIEM configuration.
OUTCOME
40% reduction in annual SIEM ingest cost. Zero reduction in detection coverage. PCI-DSS audit passed with Snare FIM evidence for Requirement 11.5.
SECOPS ENGINEERING / DEVO CUSTOMER
Accelerating Parser Rollout with Policy-to-Destination Routing
A security team running Devo as their primary SIEM was experiencing parser delays and table mismatches from inconsistently tagged Snare Agent data. Policy-to-destination routing mapped log data directly to the correct Devo tables using custom tags — including macOS audit logs routing to box.audit.macos.event — without any code changes. Parser rollout that previously required engineering sprints was completed in hours.
OUTCOME
Parser deployment time reduced from sprints to hours. Devo table ingestion accuracy improved to 100%. Engineering time freed for higher-value security work.
GOVERNMENT / DEFENCE
Forensic Log Integrity for High-Security Compromise Investigation
A government agency required log evidence that could withstand legal scrutiny during a compromise investigation. Snare Agent’s tamper-resistant OS-level capture, local disk buffering, and chain-of-custody metadata provided a complete, unbroken record from the affected endpoints — even after hosts were taken offline for forensic imaging. SAM’s import/export capability had previously been used to manage agent policy across the air-gapped network without direct connectivity.
OUTCOME
Full forensic log chain admitted as evidence. Breach timeline reconstructed to the second. No log gaps despite host quarantine and offline forensic imaging.
COMPLIANCE COVERAGE
Built for the frameworks your auditors require
| Framework | Requirements | How Snare Agent supports it |
|---|---|---|
| PCI DSS v4.0.1 | Req 10.2–10.7 · 11.5.2 · 4.2.1 · 8.4 | Audit log coverage across Windows and Linux; FIM change detection with SHA-256; strong cryptography in transit; MFA-capable SSO to SAM via your identity provider |
| ISO/IEC 27001:2022 | A.8.15 · A.8.16 · A.8.5 · A.8.24 | Logging and monitoring with tamper-resistant capture and encrypted transport; secure authentication to SAM through OIDC/LDAP; hardened cryptography |
| NIST CSF 2.0 | DE.CM-01 · DE.CM-03 · DE.CM-09 | Endpoint, network and DNS telemetry (including ETW) feeding continuous monitoring |
| HIPAA | §164.312(b) · §164.312(e) | Audit controls for access, authentication and system activity; transmission security for event data |
| SOX | IT general controls | Audit trail for access, privilege use and configuration change, with SAM admin actions logged |
| NERC CIP | CIP-007-6 R4 · CIP-010-4 | Security event logging and FIM-based configuration change monitoring; air-gap-safe policy through SAM import/export |
| ASD ISM / Essential Eight | Event logging controls · cryptography guidelines | Centralised, protected event logging; ongoing cryptographic modernisation aligned with ASD’s post-quantum transition guidance |
FREQUENTLY ASKED QUESTIONS
Technical questions from security architects and engineers
Q: What is the current version of Snare Agent and Snare Agent Manager?
The current release is Snare Agent v5.10 and Snare Agent Manager v2.2.0. v5.10 introduces Windows log translation to English, Linux telemetry collection (CPU, disk, memory, network), policy-to-destination routing for Securonix and Devo, and macOS 15 Sequoia support. SAM v2.2.0 adds LDAP authentication, default configuration templates eliminating the master-agent pattern, bulk tagging, expanded remote policy management, agent import/export for air-gapped networks, and the ability to unmanage agents. For full release notes visit snaresolutions.com/products/snare-agents-v5-10/
Q: What is Log Translation and why does it matter for global deployments?
Log Translation normalises Windows audit event data to English regardless of the OS display language on the endpoint. This is critical for global enterprises and MSSPs with endpoints running in multiple languages — a single SIEM detection ruleset, dashboard, and threat hunting query works consistently across all regions without per-region parser maintenance or SIEM configuration changes. Endpoints continue running in their local language; translation happens at the agent before forwarding.
Q: What does Linux telemetry collect and is there a performance impact?
Snare Agent v5.10 collects CPU utilisation, disk I/O, memory usage, and network traffic metrics from Linux endpoints alongside security event data in the same pipeline. This operational context allows analysts to correlate security events with infrastructure conditions, improving root-cause analysis and mean time to resolve. Telemetry collection is lightweight and configurable — scope and frequency can be tuned per policy and environment requirements.
Q: What are default configuration templates in SAM and what problem do they solve?
Previously, SAM required a live master agent as the configuration reference for a group. Default templates replace this pattern by allowing policies to be built and managed entirely within SAM. New configuration groups can be stood up immediately without a running agent, configuration drift is reduced, and onboarding new customers or environments is significantly faster. Templates are managed via SAM and pushed to agents remotely.
Q: How does LDAP authentication work in Snare Agent Manager?
SAM v2.2.0 can delegate authentication to an enterprise LDAP directory. Operators authenticate using their directory credentials, and group membership maps to SAM permission levels. This centralises access management, applies consistent identity governance across the security tool stack, and provides a full audit trail of SAM actions attributed to directory users — simplifying compliance evidence for access management controls.
Q: How does agent import/export work for air-gapped or isolated networks?
SAM v2.2.0 provides a UI-based import/export for agent configurations. Policies can be exported from one environment and imported into an air-gapped or isolated network without requiring direct connectivity. This enables policy management for OT environments, defence networks, and any deployment where network segmentation prevents direct SAM access to managed agents. It also simplifies disaster recovery preparation by exporting configurations for backup.
