Reference
What the agent does on the endpoint
What runs, what it talks to, how often, for change control and egress filtering.
Outbound allowlist
The agent makes two outbound HTTPS connections, never inbound, no firewall rule needed.
| Host | Port | Purpose |
|---|---|---|
api.snitchos.com | TCP 443 | Enrollment, activity and screenshot upload, configuration |
cdn.snitchos.com | TCP 443 | Update manifest and signed installer downloads |
Both are plain HTTPS; a proxy works if it keeps the update-verification cert chain intact. Category blocking? Allow both by name, IPs aren't stable.
api.snitchos.com doesn't fail quietly, the device stops reporting, shows offline on the tenant overview.What runs
SnitchOSAgent: a Windows service as LocalSystem, visible in Task Manager andservices.msc; a local admin can stop or uninstall it. From 1.0.20.0 it is deliberately absent from Programs and Features, so uninstall ismsiexec /xrather than the GUI list.- A per-session helper: the service can't see a desktop from session 0, so it launches one per session, capturing screenshots and window activity.
How often it samples
| Activity sampling | Every 10 seconds by default, adjustable 5–300 |
|---|---|
| Screenshots | Every 60 seconds by default, adjustable 30–3600; skipped after a minute of idle, and visually-identical frames are discarded rather than uploaded |
| Upload | Batched every 60 seconds by default, adjustable 15–900 |
These are the shipped defaults, not fixed values: an administrator sets them per tenant, within the ranges above. Events buffer locally when offline, sent once reconnected; a laptop offline for a meeting doesn't lose its day.
What it does not send
Input is counted, never captured: keystroke, mouse-click, and mouse-distance totals only. Browser URLs reduce to scheme, host, and path; query strings/fragments are stripped before leaving the machine, since they carry SSO tokens. See data handling for the full boundary.
Verify the binary before you deploy
The installer and service are code-signed. Check the publisher first:
Get-AuthenticodeSignature .\SnitchOS.msi |
Select-Object Status, @{n='Signer';e={$_.SignerCertificate.Subject}}Expect Status: Valid, subject CN=OS Labs Inc. (current, SSL.com) or CN=Shield Management Inc (older, Microsoft), both ours.
Uninstall
Removal is deliberately possible for a local admin, for MSP support. Uninstall/repair live in deploying with your RMM.