How the agent works
The agent utilizes a modern codebase and is written in a safe, performant language (Rust). It does not utilize a kernel module or any kernel code, it runs entirely in userspace. It collects CPU and memory utilization metrics that can be viewed within your Portal.
CPU and memory reporting
Because the agent runs entirely in userspace, without the utilization of a kernel module or kernel code, the operating system's CPU and memory utilization metrics about the agent genuinely represent reality.
Compare this to products that utilize a kernel module, in which CPU and memory performance costs are associated with and incorporated into the kernel. As a result, answering queries concerning performance is extremely difficult, as metrics only relate to userland daemons that interface with the product's kernel module.
Our product philosophy
Use the memory and CPU needed to collect meaningful telemetry for the purposes of threat detection, without causing system degradation. It's not particularly relevant whether that results in 30MB, 60MB, or 150MB of memory consumption. That being said, we continue to make investments in performance, as we understand the importance of available compute and resources.