Remote monitoring and management

The Atlas agent runs on Windows, macOS and Linux. It is EV-signed and served
from our own domain, so most machines install it without antivirus exclusions.

What the agent does

- Reports hardware, software inventory and health on a schedule.
- Runs scripts and runbooks, with an approval hold on anything destructive.
- Patches the operating system and third-party applications, through winget on
Windows and brew on macOS.
- Provides remote access, and a file manager for the device.
- Runs a support tray the end user can chat to a technician through.

The support tray

The tray sits in the system tray or menu bar on all three platforms. From it a
user can start a chat with a technician, raise a common request without writing
an email, and see who is helping them. It polls quickly while somebody is
looking at it and slowly when they are not, so a fleet of trays does not become
a load problem.

The tray never holds the device key. If its session file is missing it degrades
to a launcher rather than failing.

Patching

Patches are staged through rings, so a patch reaches a pilot group before the
fleet. Approval gates can be required per ring. Third-party application patching
runs through the same rings.

Automated remediation

Remediations are proposed, not applied. Every one requires approval each time,
and nothing forces a reboot. A remediation that would restart a machine says so
before you approve it.

Antivirus exclusions

The installer and both resident scripts are EV-signed, so most machines need no
exclusions at all. Where a third-party AV does block the agent, the behavioural
or ATC exclusion matters as much as the on-access one — and Defender's logs stay
clean while a third-party product does the blocking, which is a common wrong
turn when diagnosing it.