Agent Discovery Integrations
Arthur finds the AI agents running across your organization by connecting to systems you already use. Each integration has its own page covering what it discovers, the fields it takes, and the permissions its credentials need.
How a discovery source is configured
A discovery source has two parts:
- Source fields: how Arthur connects to the system: its URL, project or account, and credentials. Fields marked Sensitive are stored as secrets and never appear in logs or error messages.
- Scan configs: what each scan does. A source can have more than one scan config. Each one has:
| Setting | Description |
|---|---|
name | A name for this scan, unique within the source. |
query | Integration-specific: an SPL or ES|QL query for a SIEM, an agent catalog for an endpoint source, or empty. Each integration's page says what it expects. |
query_language | spl, esql or none. |
lookback_window_seconds | How far back each scan looks, rounded up to whole hours. 0 means "everything" for the integrations that support it. Inventory sources such as Vertex AI ignore this setting. |
Every integration accepts only https:// URLs.
Available integrations
| Category | Integration | Vendor key |
|---|---|---|
| Cloud AI platforms | Google Cloud Vertex AI Agent Engine | gcp_vertex |
| Cloud AI platforms | Google Cloud Compute Engine | gcp_compute_engine |
| Employee endpoints | Jamf Pro | jamf_pro |
| Security telemetry (SIEM) | Splunk Enterprise | splunk_enterprise |
| Security telemetry (SIEM) | Elastic Security | elastic_security |
| Arthur Evaluation Engine | OTEL sink | (no configuration) |
SIEM query output contract
Splunk and Elastic queries must return one row per agent, using only these column names. If a query returns a column not listed here, the scan fails as not_configured. Rename helper columns or drop them.
| Column | Required | Type | Description |
|---|---|---|---|
external_id | Yes | String | A stable, unique identifier for the agent. It's the agent's permanent key, so don't change how you build it once you've scanned. |
name | Yes | String | A human-readable agent name. |
last_seen | Yes | Timestamp | When the agent was last observed. |
llm_models | No | String or list of strings | Models the agent called. |
tools | No | String or list of strings | Tools the agent used. |
sub_agents | No | String or list of strings | Other agents this agent called. |
data_sources | No | String or list of URLs | Data sources the agent read. |
A row with a blank external_id or name, or a last_seen that isn't a timestamp, is skipped and logged. The rest of the rows are still published. Leave out optional columns your data can't supply rather than returning them empty.
Coming soon
| Category | Integration |
|---|---|
| Cloud AI platforms | AWS Bedrock AgentCore |
| Cloud AI platforms | Azure AI Foundry |
| Cloud AI platforms | Vercel |
| Cloud AI platforms | AWS EC2 |
| Employee endpoints | CrowdStrike Falcon |
| Employee endpoints | Microsoft Defender for Endpoint |
| Security telemetry (SIEM) | Microsoft Sentinel |
| Network and gateway logs | AWS CloudWatch Logs |
| Network and gateway logs | Google Cloud Logging |
| Network and gateway logs | LiteLLM proxy |
| Network and gateway logs | Kong Konnect |
Don't see a system you use? Contact us. We prioritize new integrations based on customer demand.
Updated 34 minutes ago