# Managing Agent Settings

After onboarding, you can manage your configurations in SailPoint Human Fabric. These settings include [deploying sensors](#deploying-sensors), [deployment history](#viewing-deployment-history), [managing AI plugins](ai_plugins/managing_ai_plugins.md), connecting your organization's Endpoint Detection and Response (EDR) or Security Information and Event Management (SIEM) [platforms](#connecting-edr-or-siem-platforms), [configuring risk](#configuring-risk), [configuring exposed credentials discovery](#configuring-exposed-credentials-discovery), [managing API keys](#managing-api-keys), and [configuring organization details](#configuring-organization-details).

## Deploying Sensors

You can deploy SailPoint’s sensors to discover AI on your organization’s devices. The endpoint agent and browser extension are deployed separately with their own artifacts and configuration. You can deploy both the endpoint agent and browser extension to your fleet.

### Endpoint Agents

You can configure SailPoint Endpoint Agent Security (SEAS) to discover and monitor AI agent software that is installed and running on your organization’s managed laptops and desktops. Discovered agents, MCP servers, credentials, and related non-human identities are added to Agentic Fabric for users to review.

**To configure the endpoint agent:**

1. In SailPoint Human Fabric, go to **Admin > Global > Agent Settings**.

2. Select **Sensors** from the left navigation.

3. Select the **Endpoint Agent** tab.

4. [Generate the deployment package](onboarding/sensors/endpoint_sensor.md#generating-deployment-artifacts) for your MDM provider and [deploy the endpoint agent](onboarding/sensors/endpoint_sensor.md#deploying-endpoint-agent-security).

### Viewing Deployment History

You can review current and past deployments of the endpoint agent on the Agent Settings page.

**To view deployments:**

1. Go to **Admin > Global > Agent Settings**.

2. From the left pane, select **Sensors**.

3. Select the **Endpoint Agent** tab.

4. Scroll to the **Existing Deployments** section.

5. Review information about each deployment, including the selected operating system, deployment method, and version of SEAS.

### Browser Extensions

SailPoint Browser Agent Security (SBAS) provides visibility and supports GenAI governance processes across both managed and unmanaged SaaS environments. It operates in the browser to detect, correlate, and enhance governance of GenAI-related activities. The browser extension discovers AI business apps that users access and surfaces browser agent frameworks accessed through web browser.

Deployment is supported by MDM solutions like Intune and Jamf.

**To configure a browser extension:**

1. In SailPoint Human Fabric, go to **Admin > Global > Agent Settings**.

2. Select **Sensors** from the left navigation.

3. Select the **Browser Extension** tab.

4. Integrate the browser extension with your identity provider and then [deploy the browser extension](onboarding/sensors/browser_sensor/index.md#deployment-and-operation).

## Managing AI Plugins

You can download a new AI plugin package for the AI tools you select. The available AI tools are Claude, Codex, Cursor, Gemini CLI, GitHub Copilot, Kiro, and VS Code. The current package includes Agentic Audit and Prompt Security, depending on the tool.

**To open AI Plugins:**

1. In SailPoint Human Fabric, go to **Admin > Global > Agent Settings**.

2. Select **AI Plugins** from the left pane.

Refer to [Managing AI Plugins](ai_plugins/managing_ai_plugins.md) for more information.

## Connecting EDR or SIEM Platforms

You can connect your organization's EDR tool or SIEM solution to Agentic Fabric for agent discovery and monitoring.

You can connect the following tools and platforms:

- [CrowdStrike Falcon Data Replicator](onboarding/siem_connection.md#connecting-crowdstrike-falcon-data-replicator)
- [Sumo Logic SIEM](onboarding/siem_connection.md#connecting-sumo-logic-siem)

## Configuring Risk

You can define how security risks are detected, prioritized, and managed across their connected sources. These settings provide granular control over how activity patterns are interpreted, enabling administrators to fine-tune detection behavior according to internal security policies and operational workflows.

Each risk type includes adjustable parameters that determine when a risk is triggered and how severe it should be categorized. Administrators can enable or disable each risk type, modify thresholds such as duration or activity limits, and assign an appropriate severity level. These configurations allow SailPoint Agentic Fabric to surface the most relevant risks while minimizing unnecessary alerts.

Configuration options include:

- **Thresholds** - Define the criteria that determine when a risk should be triggered. These can include time-based limits, activity conditions, or state changes, depending on the risk type.
- **Severity** - Assign the appropriate importance level (Low, Medium, High, or Critical) to reflect how severe each risk type is within your organization's security framework.
- **Activation Controls** - Enable or disable specific detection rules to align monitoring with operational priorities and minimize unnecessary alerts.

## Configuring Exposed Credentials Discovery

You can configure how credential scanning runs in your environment, so detection stays focused on the risks you want to manage.

- [File Path Exclusions](#file-path-exclusions) - Define which files or paths should be ignored during scans, ensuring that detection efforts focus on relevant and high-value areas of the codebase.
- [Credential Type Rules](#credential-type-rules) - Configure customized rules for handling credentials based on their type, enabling tailored actions such as adjusting severity, modifying exposure status, or disabling scanning. This allows precise control over how different credential types are prioritized and managed across your environment.
- [Excluded Hashes](#excluded-hashes) - View all credentials that have been explicitly marked as "Not a credential" in the Exposed Credentials.

### File Path Exclusions

File path exclusion rules allow you to define which files or paths should be ignored during scans, ensuring that detection efforts focus on relevant and high-value areas of the codebase.

Configure exclusions to reduce noise from non-sensitive sources, improve scanning efficiency, and maintain clear visibility into meaningful exposures.

Each exclusion rule defines a rule type, a file path pattern, and the source type that determine which file paths SailPoint Agentic Fabric should ignore during scanning.

Exclusions can be applied at multiple levels, from entire repositories to individual files or file types using a variety of matching options:

- **Starts With** - Excludes paths that begin with the specified prefix.
- **Contains** - Excludes paths containing the defined string.
- **Ends With** - Excludes files or directories that end with a specific term or extension.
- **Exact** - Excludes a specific repository, file, or directory path.
- **Wildcard** - Allows flexible pattern matching using \* to exclude multiple or partial path matches.

These rules can be combined to create precise exclusion logic that aligns with your organization's code structure and scanning requirements.

To make setup easier, SailPoint Agentic Fabric automatically suggests exclusion rules based on file extensions that commonly contain false positive findings, such as `Ends With .html`, `Ends With .css`, and `Ends With .md`. These suggestions are enabled by default and can be removed at any time.

Supported sources include:

- GitHub (Commits)
- GitLab (Commits)
- Bitbucket (Commits)
- Azure DevOps (Commits, Wiki pages)
- SharePoint (Documents, Pages)
- Google Drive (Files)

The following table lists rule examples and their outcomes.

| Rule | Outcome |
| --- | --- |
| `Ends With .html` | Ignores HTML files across all scanned sources |
| `Wildcard sample\*config\*.yaml` | Ignores variations of config templates |
| `Contains /personal/` | Ignores files under the "/personal/" directory |

!!! note "Best Practices"

- Use specific and well-scoped patterns to avoid unintentionally excluding sensitive content.
    - Review and update exclusions periodically to reflect changes in your repositories or scanning policies.
    - Use wildcards cautiously, as broad expressions might unintentionally exclude important files.

### Credential Type Rules

Configure customized rules for handling credentials based on their type, enabling tailored actions such as adjusting severity, modifying exposure status, or disabling scanning. This allows precise control over how different credential types are prioritized and managed across your environment.

Each rule is applied to all existing and future findings of the selected credential type.

- **Automatically Promote to Exposed** - Add all findings of this credential type to the *Exposed Credentials and raise relevant risks associated*.
- **Automatically Demote to Generic Exposed** - Downgrade all findings of this credential type to *Generic Exposed Credentials*, and resolve any open risks.
- **Automatically Increase Severity** - Increase the severity score for all findings and risks associated with this credential type.
- **Automatically Decrease Severity** - Decrease the severity score for all findings and risks associated with this credential type.
- **Disable Scanning for This Secret Type** - Exclude this credential type from scanning. All current findings will be automatically archived and hidden from Inventory and Risks.

### Excluded Hashes

The Excluded hashes table lists all credentials that have been explicitly marked as "Not a credential" in the Exposed Credentials.

This process helps reduce noise in the system by removing non-sensitive values that may resemble credentials but pose no actual risk.

Each excluded entry includes:

- **Hash** - A unique identifier of the excluded credential.
- **Secret Snippet** - A short, redacted preview for reference.
- **Exclusion Timestamp** - The date and time when the credential was marked as "Not a credential".
- **Excluded By** - Indicates who or what performed the exclusion.

!!! caution

Once a credential is added to the exclusion list, it will no longer appear in scans or trigger risk alerts unless the exclusion is manually removed.

## Managing API Keys

Administrators can generate and manage access tokens for integrating with the SailPoint Agentic Fabric platform. API keys provide secure programmatic access to your organization’s data and functionalities through the SailPoint Agentic Fabric API.

!!! caution

Handle API keys with care and limit their distribution. Full Access keys should only be granted to authorized systems or users.

**To generate a new key:**

1. In SailPoint Agentic Fabric, go to **Admin > Global > Agent Settings**.

2. Select **API Keys** from the left navigation.

3. Select the access type for the new key:

- **Full Access API Key** - Grants complete access to all SailPoint Agentic Fabric platform data and features, including the SailPoint Agentic Fabric Scanner. Recommended for trusted internal automation or integration services.

- **Scanner-Only API Key** - Provides restricted access, limited to the SailPoint Agentic Fabric Scanner functionality. Ideal for scanning operations that don’t require modification of data or configurations.

4. In the **Token Name** field, enter a descriptive name to identify the purpose of the token.

5. In the **Expiration** field, select an expiration period. The expiration date will be displayed below automatically.

!!! caution

Tokens should have limited lifetimes. Regularly rotate and revoke keys to maintain strong security hygiene.

6. Select **Generate New Token**.

## Configuring Organization Details

Administrators can customize baseline and detection settings in SailPoint Agentic Fabric to better align with your organization’s environment. These configurations enhance the precision of detections, reduce unnecessary alerts, and ensure monitoring reflects your organization’s activity patterns.

### Geo-Locations Baseline

SailPoint Agentic Fabric automatically builds a baseline of countries where your organization’s accounts and tokens are active. Any new country detected after the initial learning period may indicate unfamiliar or potentially risky activity.

The baseline view displays each country’s token count, account types, and first-seen date, allowing administrators to review and approve trusted regions. If unexpected geographic activity appears, it will be flagged for further investigation.

### Organization IP Ranges

Administrators can define the IP ranges associated with your organization. By adding your known cloud and on-premise IP addresses, SailPoint Agentic Fabric establishes a trusted network profile and can more effectively detect anomalies or unauthorized activity.

IP ranges can be specified by provider and region. These entries can be updated at any time as infrastructure changes, ensuring SailPoint Agentic Fabric continuously reflects your current network perimeter.

Managing Agent Settings

After onboarding, you can manage your configurations in SailPoint Human Fabric. These settings include deploying sensors, deployment history, managing AI plugins, connecting your organization's Endpoint Detection and Response (EDR) or Security Information and Event Management (SIEM) platforms, configuring risk, configuring exposed credentials discovery, managing API keys, and configuring organization details.

Deploying Sensors

You can deploy SailPoint’s sensors to discover AI on your organization’s devices. The endpoint agent and browser extension are deployed separately with their own artifacts and configuration. You can deploy both the endpoint agent and browser extension to your fleet.

Endpoint Agents

You can configure SailPoint Endpoint Agent Security (SEAS) to discover and monitor AI agent software that is installed and running on your organization’s managed laptops and desktops. Discovered agents, MCP servers, credentials, and related non-human identities are added to Agentic Fabric for users to review.

To configure the endpoint agent:

In SailPoint Human Fabric, go to Admin > Global > Agent Settings.
Select Sensors from the left navigation.
Select the Endpoint Agent tab.
Generate the deployment package for your MDM provider and deploy the endpoint agent.

Viewing Deployment History

You can review current and past deployments of the endpoint agent on the Agent Settings page.

To view deployments:

Go to Admin > Global > Agent Settings.
From the left pane, select Sensors.
Select the Endpoint Agent tab.
Scroll to the Existing Deployments section.
Review information about each deployment, including the selected operating system, deployment method, and version of SEAS.

Browser Extensions

SailPoint Browser Agent Security (SBAS) provides visibility and supports GenAI governance processes across both managed and unmanaged SaaS environments. It operates in the browser to detect, correlate, and enhance governance of GenAI-related activities. The browser extension discovers AI business apps that users access and surfaces browser agent frameworks accessed through web browser.

Deployment is supported by MDM solutions like Intune and Jamf.

To configure a browser extension:

In SailPoint Human Fabric, go to Admin > Global > Agent Settings.
Select Sensors from the left navigation.
Select the Browser Extension tab.
Integrate the browser extension with your identity provider and then deploy the browser extension.

Managing AI Plugins

You can download a new AI plugin package for the AI tools you select. The available AI tools are Claude, Codex, Cursor, Gemini CLI, GitHub Copilot, Kiro, and VS Code. The current package includes Agentic Audit and Prompt Security, depending on the tool.

To open AI Plugins:

In SailPoint Human Fabric, go to Admin > Global > Agent Settings.
Select AI Plugins from the left pane.

Refer to Managing AI Plugins for more information.

Connecting EDR or SIEM Platforms

You can connect your organization's EDR tool or SIEM solution to Agentic Fabric for agent discovery and monitoring.

You can connect the following tools and platforms:

Configuring Risk

You can define how security risks are detected, prioritized, and managed across their connected sources. These settings provide granular control over how activity patterns are interpreted, enabling administrators to fine-tune detection behavior according to internal security policies and operational workflows.

Each risk type includes adjustable parameters that determine when a risk is triggered and how severe it should be categorized. Administrators can enable or disable each risk type, modify thresholds such as duration or activity limits, and assign an appropriate severity level. These configurations allow SailPoint Agentic Fabric to surface the most relevant risks while minimizing unnecessary alerts.

Configuration options include:

Thresholds - Define the criteria that determine when a risk should be triggered. These can include time-based limits, activity conditions, or state changes, depending on the risk type.
Severity - Assign the appropriate importance level (Low, Medium, High, or Critical) to reflect how severe each risk type is within your organization's security framework.
Activation Controls - Enable or disable specific detection rules to align monitoring with operational priorities and minimize unnecessary alerts.

Configuring Exposed Credentials Discovery

You can configure how credential scanning runs in your environment, so detection stays focused on the risks you want to manage.

File Path Exclusions - Define which files or paths should be ignored during scans, ensuring that detection efforts focus on relevant and high-value areas of the codebase.
Credential Type Rules - Configure customized rules for handling credentials based on their type, enabling tailored actions such as adjusting severity, modifying exposure status, or disabling scanning. This allows precise control over how different credential types are prioritized and managed across your environment.
Excluded Hashes - View all credentials that have been explicitly marked as "Not a credential" in the Exposed Credentials.

File Path Exclusions

File path exclusion rules allow you to define which files or paths should be ignored during scans, ensuring that detection efforts focus on relevant and high-value areas of the codebase.

Configure exclusions to reduce noise from non-sensitive sources, improve scanning efficiency, and maintain clear visibility into meaningful exposures.

Each exclusion rule defines a rule type, a file path pattern, and the source type that determine which file paths SailPoint Agentic Fabric should ignore during scanning.

Exclusions can be applied at multiple levels, from entire repositories to individual files or file types using a variety of matching options:

Starts With - Excludes paths that begin with the specified prefix.
Contains - Excludes paths containing the defined string.
Ends With - Excludes files or directories that end with a specific term or extension.
Exact - Excludes a specific repository, file, or directory path.
Wildcard - Allows flexible pattern matching using * to exclude multiple or partial path matches.

These rules can be combined to create precise exclusion logic that aligns with your organization's code structure and scanning requirements.

To make setup easier, SailPoint Agentic Fabric automatically suggests exclusion rules based on file extensions that commonly contain false positive findings, such as Ends With .html, Ends With .css, and Ends With .md. These suggestions are enabled by default and can be removed at any time.

Supported sources include:

GitHub (Commits)
GitLab (Commits)
Bitbucket (Commits)
Azure DevOps (Commits, Wiki pages)
SharePoint (Documents, Pages)
Google Drive (Files)

The following table lists rule examples and their outcomes.

Rule	Outcome
`Ends With .html`	Ignores HTML files across all scanned sources
`Wildcard sample\config\.yaml`	Ignores variations of config templates
`Contains /personal/`	Ignores files under the "/personal/" directory

Best Practices

Use specific and well-scoped patterns to avoid unintentionally excluding sensitive content.
Review and update exclusions periodically to reflect changes in your repositories or scanning policies.
Use wildcards cautiously, as broad expressions might unintentionally exclude important files.

Credential Type Rules

Configure customized rules for handling credentials based on their type, enabling tailored actions such as adjusting severity, modifying exposure status, or disabling scanning. This allows precise control over how different credential types are prioritized and managed across your environment.

Each rule is applied to all existing and future findings of the selected credential type.

Automatically Promote to Exposed - Add all findings of this credential type to the Exposed Credentials and raise relevant risks associated.
Automatically Demote to Generic Exposed - Downgrade all findings of this credential type to Generic Exposed Credentials, and resolve any open risks.
Automatically Increase Severity - Increase the severity score for all findings and risks associated with this credential type.
Automatically Decrease Severity - Decrease the severity score for all findings and risks associated with this credential type.
Disable Scanning for This Secret Type - Exclude this credential type from scanning. All current findings will be automatically archived and hidden from Inventory and Risks.

Excluded Hashes

The Excluded hashes table lists all credentials that have been explicitly marked as "Not a credential" in the Exposed Credentials.

This process helps reduce noise in the system by removing non-sensitive values that may resemble credentials but pose no actual risk.

Each excluded entry includes:

Hash - A unique identifier of the excluded credential.
Secret Snippet - A short, redacted preview for reference.
Exclusion Timestamp - The date and time when the credential was marked as "Not a credential".
Excluded By - Indicates who or what performed the exclusion.

Caution

Once a credential is added to the exclusion list, it will no longer appear in scans or trigger risk alerts unless the exclusion is manually removed.

Managing API Keys

Administrators can generate and manage access tokens for integrating with the SailPoint Agentic Fabric platform. API keys provide secure programmatic access to your organization’s data and functionalities through the SailPoint Agentic Fabric API.

Caution

Handle API keys with care and limit their distribution. Full Access keys should only be granted to authorized systems or users.

To generate a new key:

In SailPoint Agentic Fabric, go to Admin > Global > Agent Settings.
Select API Keys from the left navigation.
Select the access type for the new key:
- Full Access API Key - Grants complete access to all SailPoint Agentic Fabric platform data and features, including the SailPoint Agentic Fabric Scanner. Recommended for trusted internal automation or integration services.
- Scanner-Only API Key - Provides restricted access, limited to the SailPoint Agentic Fabric Scanner functionality. Ideal for scanning operations that don’t require modification of data or configurations.
In the Token Name field, enter a descriptive name to identify the purpose of the token.
In the Expiration field, select an expiration period. The expiration date will be displayed below automatically.

Caution

Tokens should have limited lifetimes. Regularly rotate and revoke keys to maintain strong security hygiene.
Select Generate New Token.

Configuring Organization Details

Administrators can customize baseline and detection settings in SailPoint Agentic Fabric to better align with your organization’s environment. These configurations enhance the precision of detections, reduce unnecessary alerts, and ensure monitoring reflects your organization’s activity patterns.

Geo-Locations Baseline

SailPoint Agentic Fabric automatically builds a baseline of countries where your organization’s accounts and tokens are active. Any new country detected after the initial learning period may indicate unfamiliar or potentially risky activity.

The baseline view displays each country’s token count, account types, and first-seen date, allowing administrators to review and approve trusted regions. If unexpected geographic activity appears, it will be flagged for further investigation.

Organization IP Ranges

Administrators can define the IP ranges associated with your organization. By adding your known cloud and on-premise IP addresses, SailPoint Agentic Fabric establishes a trusted network profile and can more effectively detect anomalies or unauthorized activity.

IP ranges can be specified by provider and region. These entries can be updated at any time as infrastructure changes, ensuring SailPoint Agentic Fabric continuously reflects your current network perimeter.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.