Blumira Agents

Blumira Agents & Devices

Overview

Blumira agents (sensors) are deployed on devices to collect log data and detect threats. This skill covers device inventory management, agent health monitoring, and agent key management for deployments.

Anti-triggers

• Claude subagents — "agent" here is a Blumira log sensor, never an AI subagent definition under agents/*.md.
• An EDR agent — a Blumira agent ships logs; it does not detect or remediate on the endpoint. Endpoint sensors are huntress-agents, sentinelone-inventory, or blackpoint-asset-inventory.
• What the agent detected — telemetry becomes a finding; use blumira-findings.
• Devices in another client account — these are /org/* calls; per-account device lists are blumira_msp_devices_list in blumira-msp.

Key Concepts

Devices

Devices represent endpoints, servers, or network appliances with Blumira agents installed. Each device record includes agent status, last seen time, OS information, and network details.

Agent Keys

Agent keys are deployment tokens used to register new agents with your Blumira organization. Keys can be scoped and rotated as needed.

API Patterns

List Devices

blumira_agents_devices_list
  page_size=50
  order_by=-last_seen

Filter examples:

blumira_agents_devices_list
  os.contains=Windows
  status.eq=active

Get Device Details

blumira_agents_devices_get
  device_id=<UUID>

List Agent Keys

blumira_agents_keys_list

Get Agent Key Details

blumira_agents_keys_get
  key_id=<UUID>

Common Workflows

Agent Health Check

1. blumira_agents_devices_list with order_by=last_seen to find stale agents
2. Identify devices that haven't checked in recently
3. Cross-reference with user/admin to determine if device is offline or agent needs attention
4. Document findings for remediation

Device Inventory Audit

1. blumira_agents_devices_list with page_size=100 to enumerate all devices
2. Page through results using pagination
3. Group by OS, status, or location for reporting
4. Identify gaps in coverage (known devices without agents)

Agent Deployment

1. blumira_agents_keys_list to find available deployment keys
2. Use key details to provision new agents
3. After deployment, verify with blumira_agents_devices_list that the new device appears

Error Handling

Device Not Found

Cause: Invalid device ID or device not in current org scope Solution: Verify the device ID with blumira_agents_devices_list.

No Agent Keys Available

Cause: No keys have been created for the organization Solution: Agent keys must be created in the Blumira portal. The API is read-only for key management.

Best Practices

• Monitor last_seen timestamps to catch offline agents early
• Audit device inventory regularly against known asset lists
• Rotate agent keys periodically for security
• Use filtering to segment inventory by OS or status for targeted reporting
• For MSP environments, use blumira_msp_devices_list to audit across accounts

Related Skills

• API Patterns — Filtering and pagination
• MSP — MSP device management across accounts
• Users — Correlating devices with users