What the agent does on the endpoint
For IT admins doing change control or egress filtering: what runs, what it talks to, and how often.
Outbound allowlist
The agent makes two outbound HTTPS connections, never inbound, no firewall rule needed.
| Host | Port | Purpose |
|---|---|---|
api.snitchos.com | TCP 443 | Enrollment, activity and screenshot upload, configuration |
cdn.snitchos.com | TCP 443 | Update manifest and signed installer downloads |
Both are plain HTTPS; a proxy works if it keeps the update-verification cert chain intact. Category blocking? Allow both by name, IPs aren't stable.
api.snitchos.com doesn't fail quietly, the device stops reporting, shows offline on the tenant overview.What runs
SnitchOSAgent: a Windows service as LocalSystem, visible in Task Manager andservices.msc; a local admin can stop or uninstall it. From 1.0.20.0 it is installed as a system component, so usemsiexec /xrather than Settings → Apps to remove it.- A per-session helper: the service can't see a desktop from session 0, so it launches one per session, capturing screenshots and window activity.
How often it samples
| Activity sampling | Every 10 seconds by default, adjustable 5–300 |
|---|---|
| Screenshots | Every 60 seconds by default, adjustable 30–3600; skipped after a minute of idle, and visually-identical frames are discarded rather than uploaded |
| Upload | Batched every 60 seconds by default, adjustable 15–900 |
These are shipped defaults; an administrator can adjust them per tenant within the ranges above. Events buffer locally when offline and upload once reconnected.
What it does not send
Input is counted, never captured: keystroke, mouse-click, and mouse-distance totals only. Browser URLs reduce to scheme, host, and path; query strings/fragments are stripped before leaving the machine, since they carry SSO tokens. See data handling for details.
Verify the binary before you deploy
The installer and service are code-signed. Check the publisher first:
Get-AuthenticodeSignature .\SnitchOS.msi |
Select-Object Status, @{n='Signer';e={$_.SignerCertificate.Subject}}Expect Status: Valid, subject CN=OS Labs Inc. (current, SSL.com) or CN=Shield Management Inc (older, Microsoft), both ours.
Uninstall
Removal is deliberately possible, for a local admin or MSP support. Uninstall/repair: deploying with your RMM.