Configurable Settings

Configuration Options Reference

Audience: IT administrators and integrators who need a complete reference for Keeper Endpoint Privilege Manager (KEPM) configuration options on the agent.

This page documents configuration settings used by the Keeper EPM agent. Settings may live in appsettings.json next to the agent service, in plugin JSON under Plugins/, in job or inventory configuration files, in content files under Config/ or intel/, in Windows injector .dat lists, or in MDM profiles. At runtime, unified storage can override on-disk plugin settings until reverted.

For each setting this page provides the data type, default value, a detailed description of behavior and operational impact, appropriate values, and the configuration location.

How Settings Are Applied

• Global settings - Values under appsettings.json (and related host sections) apply to the whole agent service. Port and path changes typically require a service restart.

• Plugin settings - Each plugin has a JSON file under Plugins/ (for example Plugins/KeeperPolicy.json). Behavioral options usually appear under metadata. Read or update them with the Plugin Settings API (GET / PUT /api/PluginSettings/{pluginName}/...). After editing a file on disk, use POST /api/PluginSettings/{pluginName}/revert (or revert-all) so unified storage matches the file, then restart the plugin if needed.

• SettingsUpdate policy - A configuration policy can push plugin or appsettings.json changes to endpoints. The Configuration Policy Processor applies them.

• Content and list files - Agentic intel rules, basename lists, inventory scan options, and Windows allow.dat / exclude.dat files are deployed with the agent or updated as content. Treat them as structured configuration, not free-form text.

• MDM (macOS) - Registration code, Full Disk Access, and system-extension allowlisting are delivered with configuration profiles during deployment.

For narrative guidance, see Plugins & Settings and Plugin & Task Settings. For local API details, see the HTTP Reference.

Contents

• Agentic AI and Risk Content (11)

• Boot and Performance (6)

• Client and Agent UI (16)

• Deployment and MDM (3)

• Elevation Chain (RunAs / RunElevated) (6)

• Host Service and Networking (14)

• Inventory Scan (14)

• Jobs and Orchestration (4)

• KeeperApi and Cloud Connectivity (8)

• KeeperPolicy (19)

• Linux Agent (11)

• Logging and Monitoring (20)

• macOS System Extension (10)

• MFA, Justification, and Execution Grants (6)

• MQTT Topics and Messaging Topology (5)

• Other Plugins (2)

• Path Protection (5)

• Path Variables (1)

• Plugin Manifest Fields (11)

• Redirect Evaluator (3)

• Runtime Files and Localization (1)

• Security, Certificates, and Trust (11)

• Session Monitoring and Watchdog (12)

• Windows Process Injection Lists (3)

Total settings in this reference: 201

Agentic AI and Risk Content

Files under Config/ and Plugins/bin/KeeperAgenticSnapshotWriter/intel/ (and mirrored copies beside inventory binaries) drive AI likelihood, vulnerability, and risk-behavior scoring.

AgenticChainIntermediaryBasenames.json

Property	Value
Type	file / content
Default	cmd, powershell, wt, wsl, …
Location	Config/AgenticChainIntermediaryBasenames.json (install)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Shell/terminal basenames allowed to sit between an AI agent and a tool subprocess (MarkAgentic / OriginatingAgent stamps). Allows cmd/pwsh/wt/wsl to carry originating-agent stamps between AI parent and tools--required for accurate chains.

AiLikelihoodCapSettings.json

Property	Value
Type	file / content
Default	maxAiLikelihoodPercent=75
Location	Config/AiLikelihoodCapSettings.json (install root + plugin Config)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Caps AI likelihood for browser/webview-like basenames; also inventoryExclusions path segments for Keeper PEDM binaries. Prevents browsers/WebView2 from being scored as AI agents and excludes Keeper binaries from inventory noise.

AiLikelihoodFloorSettings.json

Property	Value
Type	file / content
Default	minAiLikelihoodPercent=100
Location	Config/AiLikelihoodFloorSettings.json (install root + plugin Config)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Curated native AI-agent executables (basename + PE identity + Authenticode subject). Sets cold-start AI likelihood floor for policy attribution. Curated signed AI apps (Cursor, Claude, etc.) get correct high AI likelihood for agentic policies--must update as products ship.

intel/app-catalog.ndjson(.gz)

Property	Value
Type	file / content
Default	(via KeeperApi refresh)
Location	KeeperApi cveCatalog + AgenticIntel shared folder
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Current vuln/product catalog source for vulnerabilityRiskPercent. Authoritative product/CVE catalog for vuln baselines--must be refreshable and versioned for agentic risk.

intel/normalized-vulnerability.jsonl

Property	Value
Type	file / content
Default	(feed present on install)
Location	Plugins/bin/KeeperAgenticSnapshotWriter/intel/ (install)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Legacy CVE feed still shipped on current Windows install. Prefer app-catalog.ndjson(.gz) going forward. Legacy CVE corpus still on disk; ops need a content-update path until fully migrated to app-catalog.

intel/rules/AI_Detection.json

Property	Value
Type	file / content
Default	staticAnalysis + signatures
Location	Plugins/bin/KeeperAgenticSnapshotWriter/intel/rules/
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Heuristic rules for AI/static-scan scoring (enable/disable rules, patterns, severity). Same ControlPlane rules configured. Tenant/product rules that decide AI likelihood from imports/signatures--directly drives agentic policy outcomes.

intel/rules/Risk_Behavior.json

Property	Value
Type	file / content
Default	identity privilege tiers
Location	Plugins/bin/KeeperAgenticSnapshotWriter/intel/rules/
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Risk-behavior heuristic rules (e.g. local admin / RDP identity tiers) that boost riskBehavior scores. Identity/privilege-tier heuristics feeding riskBehavior scores for policy gates.

intel/rules/Vulnerability.json

Property	Value
Type	file / content
Default	CVE/KEV boost rules
Location	Plugins/bin/KeeperAgenticSnapshotWriter/intel/rules/
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Vulnerability heuristic rules (CVSS thresholds, CISA KEV, component hints) that boost vulnerabilityRiskPercent. CVSS/KEV boost rules that raise vulnerabilityRiskPercent--security teams must tune thresholds.

ShellMediatedParentBasenames.json

Property	Value
Type	file / content
Default	svchost, RuntimeBroker, shells…
Location	Plugins/bin/KeeperPolicy/Config/ShellMediatedParentBasenames.json
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Parent basenames eligible for shell-mediated spawn bridge when OsShellExclusion also matches (KeeperPolicy). Broker/shell parents eligible for shell-mediated spawn bridging; wrong list drops AI lineage across AppX/broker hops.

static-scan-product-haystack.json

Property	Value
Type	file / content
Default	scoreBuckets (embedded)
Location	KeeperAgenticSnapshotWriter/config (repo; may be embedded on install)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Static-scan product haystack buckets for AI scoring. Often embedded in snapshot writer. Static-scan score buckets for AI detection; updating patterns improves detection without agent rebuilds.

SystemShellBasenames.json

Property	Value
Type	file / content
Default	explorer, cmd, powershell, …
Location	Config/SystemShellBasenames.json (install root + plugin Config)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

OS shell/system basenames that must never be classified as AI agents (OsShellExclusion). Ensures shells/OS hosts never classify as AI agents; misclassification breaks agentic attribution.

Boot and Performance

Settings:BootPhase:DeferNonCriticalJobsAfterBootMinutes

Property	Value
Type	integer
Default	3
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Post-boot grace window (minutes). Tunes post-boot quiet period so inventory/updater do not contend with Group Policy/logon scripts.

Settings:BootPhase:DeferNonCriticalJobsAfterLogonMinutes

Property	Value
Type	integer
Default	2
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Post-logon grace window (minutes). Per-user logon grace for multi-session hosts where boot grace alone is insufficient.

Settings:BootPhase:DeferPolicyPathObservedDuringGrace

Property	Value
Type	boolean
Default	true
Location	appsettings
Appropriate values	true or false

Buffer inventory/path triggers during grace. Buffers inventory path storms at logon that would otherwise queue dozens of scans.

Settings:BootPhase:Enabled

Property	Value
Type	boolean
Default	true
Location	appsettings
Appropriate values	true or false

Defer non-critical jobs after boot/logon. Protects login-time UX by deferring heavy jobs; VDI/boot storms require this toggle.

Settings:BootPhase:KeeperUpdaterLogonDeferralSeconds

Property	Value
Type	integer
Default	90
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Updater deferral after logon (seconds). Stops updater UI/IO from colliding with first-login software installs.

Settings:BootPhase:MaxConcurrentExternalProcessesDuringGrace

Property	Value
Type	integer
Default	3
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Max external job processes during grace. Caps job fan-out during grace to protect CPU/disk on thin clients.

Client and Agent UI

elevation-allowed-extensions.json (executable-extensions)

Property	Value
Type	string
Default	windows: .exe/.bat/.cmd/.msi/.ps1
Location	Plugins/bin/KeeperClient & keeperAgent (install)
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Allowed Request Elevation file types per OS. No separate executable-extensions file exists on disk; this JSON (or KEEPER_ELEVATION_EXTENSIONS_CONFIG) is the admin configured. Inventory uses PriorityExtensions / EnableExecutableOnlyScanning separately. Defines which file types users may Request Elevate; wrong list blocks .msi/.ps1 or opens risky types.

keeperAgent.metadata.approvalExpirationHours

Property	Value
Type	integer
Default	72
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Hours until a pending approval expires. Pending approvals must expire or queues grow stale--SLA for approvers.

keeperAgent.metadata.approvedRequestExpirationHours

Property	Value
Type	integer
Default	24
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Hours until an approved grant can no longer launch. How long a granted launch remains usable; short TTL reduces lingering privilege.

keeperAgent.metadata.historyRetentionDays

Property	Value
Type	integer
Default	30
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Local request history retention. Controls the $key configuration value (default: 30). Changing it affects agent behavior according to the setting type (integer).

keeperAgent.metadata.maxExceptionMessageLength

Property	Value
Type	integer
Default	500
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

UI exception truncation. Controls the $key configuration value (default: 500). Changing it affects agent behavior according to the setting type (integer).

keeperAgent.metadata.maxHistoryItems

Property	Value
Type	integer
Default	20
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Max history items shown in UI. Bounds history rendering cost on busy approvers' machines.

keeperAgent.metadata.maxPayloadSizeBytes

Property	Value
Type	integer
Default	1048576
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Max MQTT payload. Protocol ceiling; raising without coordinated clients causes silent drops.

keeperAgent.metadata.maxRequestItems

Property	Value
Type	integer
Default	20
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Max pending requests shown in UI. UI list cap prevents huge pending queues from freezing the dialog.

keeperAgent.metadata.showInTray

Property	Value
Type	boolean
Default	false
Location	Plugins/keeperAgent.json
Appropriate values	true or false

Show keeperAgent tray icon. Separate tray presence for keeperAgent vs KeeperClient--avoid dual icons or missing UX.

KeeperAgenticSnapshotWriter.metadata.hostProcess

Property	Value
Type	string
Default	KeeperPrivilegeManager
Location	Plugins/KeeperAgenticSnapshotWriter.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Expected host process name. Security/identity expectation for the writer; must stay product-fixed.

KeeperAgenticSnapshotWriter.metadata.taskDelay

Property	Value
Type	integer
Default	250
Location	Plugins/KeeperAgenticSnapshotWriter.json
Appropriate values	Positive integer, or the documented range for this setting

Writer loop delay. Controls the $key configuration value (default: 250). Changing it affects agent behavior according to the setting type (integer).

KeeperClient.metadata.LanguageOverride

Property	Value
Type	string
Default	DEFAULT
Location	Plugins/KeeperClient.json
Appropriate values	DEFAULT or a culture code such as en_US, fr_FR

UI language override (e.g. en_US, fr_FR). Forces UI locale independent of OS language for multinational estates.

KeeperClient.metadata.menu.autoRefresh

Property	Value
Type	boolean
Default	true
Location	Plugins/KeeperClient.json
Appropriate values	true or false

Auto-refresh tray menu on a timer. Disabling stops timer churn on locked-down thin clients.

KeeperClient.metadata.menu.items

Property	Value
Type	array / object
Default	product menu
Location	Plugins/KeeperClient.json
Appropriate values	JSON array or object matching the documented schema

Tray menu jobs, dialogs, and visibility filters. Customizes which request/approval jobs appear in the tray--core UX branding per org.

KeeperClient.metadata.menu.refreshIntervalMinutes

Property	Value
Type	integer
Default	5
Location	Plugins/KeeperClient.json
Appropriate values	Positive integer, or the documented range for this setting

Tray menu refresh interval. How fresh tray actions stay vs API load--tune for VDI density.

KeeperClient.metadata.showInTray

Property	Value
Type	boolean
Default	true
Location	Plugins/KeeperClient.json
Appropriate values	true or false

Show KeeperClient system tray icon. Visibility of the user agent; some kiosks hide tray icons while interactive desktops require them.

Deployment and MDM

macOS deployment settings delivered with MDM configuration profiles. See also the macOS deployment guides on docs.keeper.io.

Full Disk Access (SystemPolicyAllFiles)

Property	Value
Type	string
Default	KEPM paths
Location	MDM mobileconfig
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

FDA grants for KEPM launcher/daemon/notify/trash. FDA is mandatory for reliable process/file visibility on macOS; deploy UX must configured the required TCC profile.

KEEPERREGCODE

Property	Value
Type	string
Default	(MDM-supplied)
Location	MDM mobileconfig
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

macOS managed preference for agent registration code. Device join secret for macOS MDM enrollment--must be pushed via Admin/MDM, not left unset.

System Extension allowlist (Team ID 234QNB7GCA)

Property	Value
Type	string
Default	com.keeper...monitor
Location	MDM mobileconfig
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Allow Endpoint Security system extension via MDM. Without MDM allowlisting, macOS blocks the Endpoint Security extension and monitoring never starts.

Elevation Chain (RunAs / RunElevated)

KeeperRunAs.metadata.credentialHandling

Property	Value
Type	string
Default	ephemeral-accounts
Location	Plugins/KeeperRunAs.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Credential strategy label. Descriptive product contract, not a selectable account model for tenants.

KeeperRunAs.metadata.elevationStage

Property	Value
Type	string
Default	first
Location	Plugins/KeeperRunAs.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Marks first stage of two-stage elevation. Hard-wired stage identity. Changing it does not re-architect elevation; it only confuses diagnostics.

KeeperRunAs.metadata.launches

Property	Value
Type	string
Default	KeeperRunElevated
Location	Plugins/KeeperRunAs.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Downstream elevated executable name. ; wrong target breaks all Windows elevations.

KeeperRunElevated.metadata.apiEndpoints

Property	Value
Type	string
Default	elevation API paths
Location	Plugins/KeeperRunElevated.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Documents local elevation API routes. Reference metadata; routes are compiled into the product.

KeeperRunElevated.metadata.elevationProxy

Property	Value
Type	boolean
Default	true
Location	Plugins/KeeperRunElevated.json
Appropriate values	true or false

Marks elevation proxy role. Controls the $key configuration value (default: true). Changing it affects agent behavior according to the setting type (boolean).

KeeperRunElevated.metadata.requiresEphemeralCredentials

Property	Value
Type	boolean
Default	true
Location	Plugins/KeeperRunElevated.json
Appropriate values	true or false

Requires ephemeral admin creds. Product security invariant, not a toggle (disabling would be unsupported).

Host Service and Networking

These options live primarily in appsettings.json next to the agent service executable and apply to the whole service.

AllowedHosts

Property	Value
Type	string
Default	*
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

ASP.NET Core AllowedHosts header filter. Host-filter bootstrap for Kestrel. Changing it without understanding reverse-proxy/header behavior breaks the local API; Incorrect Host header filtering can make the local management API unreachable.

JobStore:StorePath

Property	Value
Type	string (path)
Default	"" (data dir)
Location	appsettings
Appropriate values	Valid path; may use path variables such as {approot}

Override path for persisted job store. Persisted job state can outgrow the default data dir; deployments may need an override for large fleets/storage policies.

Messaging:MalformedJsonRepair:EscapeMap

Property	Value
Type	string
Default	Unicode control escapes
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Map of control characters to JSON escapes for MQTT payload repair. This map is used by the MQTT JSON repair path. Incorrect escape mappings can corrupt event payloads during repair.

Messaging:MalformedJsonRepair:UnmappedControlCharacterFormat

Property	Value
Type	string
Default	\u{X4}
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Format string for unmapped control chars during JSON repair. Controls the $key configuration value (default: \u{X4}). Changing it affects agent behavior according to the setting type (string).

MqttBrokerSettings:IpAddress

Property	Value
Type	string
Default	127.0.0.1
Location	appsettings
Appropriate values	127.0.0.1 or localhost (must remain loopback for security)

Embedded MQTT broker bind address (must stay localhost). Must remain loopback for isolation; surfacing it lets admins audit/bind policy and reject non-localhost drift.

MqttBrokerSettings:Port

Property	Value
Type	integer
Default	8675
Location	appsettings
Appropriate values	1024-65535; must be free on the endpoint

Embedded MQTT broker port. Broker port collisions break all plugins; admins need to reassign 8675 without reinstalling the agent.

Settings:KestrelHttpPort

Property	Value
Type	integer
Default	6988
Location	appsettings
Appropriate values	1024-65535; must be free on the endpoint

Local HTTP port for the agent management API (loopback). Plugins, jobs, and local tools call this endpoint. Change it when the default port conflicts with other software on the endpoint. A service restart is required after changing the port.

Settings:KestrelHttpsPort

Property	Value
Type	integer
Default	6989
Location	appsettings
Appropriate values	1024-65535; must be free on the endpoint

Local HTTPS port for the agent management API (loopback). Prefer HTTPS for sensitive local operations. Plugins and jobs use this port to call the agent. Change it when 6989 is unavailable or blocked. A service restart is required after changing the port.

Settings:PluginPath

Property	Value
Type	string
Default	Plugins
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Plugin manifest directory. Non-default plugin layouts (side-by-side builds, golden images) require an admin-visible path override.

Settings:RepositoryPath

Property	Value
Type	string
Default	KeeperStorage
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Encrypted local repository root. Storage relocation is needed for custom data volumes, disk quotas, or separating encrypted state from Program Files.

Settings:ScriptsPath

Property	Value
Type	string (path)
Default	Jobs/Scripts
Location	appsettings
Appropriate values	Valid path; may use path variables such as {approot}

Job script assets directory ({ScriptsPath}). Job scripts are referenced as {ScriptsPath}; ops teams relocate them for least-privilege ACLs or content sync.

Settings:ServiceName

Property	Value
Type	string
Default	KeeperPrivilegeManager
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Windows service / process display name. Some enterprises require a branded or environment-specific Windows service name for SCM inventories and change control.

Settings:SharedRepositoryPath

Property	Value
Type	string
Default	SharedRepository
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Shared cross-plugin storage root. Cross-plugin shared state (e.g. AgenticIntel) may need a tenant-chosen volume for backup and capacity planning.

Settings:system.logging.level

Property	Value
Type	string
Default	Warning
Location	appsettings
Appropriate values	Critical, Error, Warning, Information, Debug, Trace

Main service log level shorthand. Primary troubleshooting lever; support escalations need Debug across endpoints without RDP to each endpoint.

Inventory Scan

InventoryFull.EnableExecutableOnlyScanning

Property	Value
Type	boolean
Default	true
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	true or false

Limit scan to executable/package types. Focuses inventory on runnable content for agentic/vuln value vs whole-disk crawl cost.

InventoryFull.EnableHashCaching

Property	Value
Type	boolean
Default	true
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	true or false

Cache file hashes between runs. Speeds incremental-ish full runs; disable when hash correctness must be forced.

InventoryFull.ExcludeDevelopmentDirectories

Property	Value
Type	boolean
Default	false
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	true or false

Exclude development tool directories. Dev workstations generate huge trees; excluding them keeps fleet scans tractable.

InventoryFull.ExcludePaths

Property	Value
Type	array / object
Default	cross-platform list
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	JSON array or object matching the documented schema

Paths excluded from full inventory scan. Skipping WinSxS/node_modules/etc. is required to finish scans and avoid false inventory bloat.

InventoryFull.ExcludeUserSpecificDirectories

Property	Value
Type	boolean
Default	false
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	true or false

Exclude per-user directories from scan. Privacy/perf option to skip user profiles on shared kiosks or when inventory is machine-scoped.

InventoryFull.ExcludeVirtualizationDirectories

Property	Value
Type	boolean
Default	true
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	true or false

Exclude VM/container directories. Containers/VM images explode scan time; default exclude is a capacity control.

InventoryFull.HashCacheValidityDays

Property	Value
Type	integer
Default	7
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	Positive integer, or the documented range for this setting

Hash cache validity window. Staleness window for cached hashes vs rescan cost. Controls the $key configuration value (default: 7). Changing it affects agent behavior according to the setting type (integer).

InventoryFull.MaxConcurrentFiles

Property	Value
Type	integer
Default	3
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	Positive integer, or the documented range for this setting

Parallel file-processing limit. Parallelism knob for SSD vs spinning disk / AV-contention hosts.

InventoryFull.MaxDirectoryDepth

Property	Value
Type	integer
Default	20
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	Positive integer, or the documented range for this setting

Maximum directory recursion depth. Stops pathological deep trees from hanging the job.

InventoryFull.MaxFileSizeBytes

Property	Value
Type	integer
Default	500000000
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	Positive integer, or the documented range for this setting

Skip files larger than this size. Skips huge blobs that burn hash time without security value.

InventoryFull.MaxMemoryUsageBytes

Property	Value
Type	integer
Default	268435456
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	Positive integer, or the documented range for this setting

Memory budget for inventory process. Keeps inventory from OOM-killing thin VDI agents.

InventoryFull.MinDaysBetweenRuns

Property	Value
Type	integer
Default	3
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	Positive integer, or the documented range for this setting

Minimum days between full inventory scans. Full scans are expensive; cadence must match change rate and endpoint capacity.

InventoryFull.PriorityExtensions

Property	Value
Type	string
Default	exe/script/package
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

File extensions prioritized during scan. Ensures high-value extensions are scanned first when time-budgeted.

InventoryFull.ThrottleDelayMs

Property	Value
Type	integer
Default	25
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	Positive integer, or the documented range for this setting

Throttle delay between file ops. Inserts yield for AV-friendly scanning on contended endpoints.

Jobs and Orchestration

Job definition JSON under Jobs/ describes task graphs (policy controls, risk assessment, launch helpers, maintenance). Behavior is usually selected by policies and event-to-job mappings rather than by editing individual keys in isolation.

JobService.metadata.category

Property	Value
Type	string
Default	Job Scheduler
Location	Plugins/JobService.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Category label. Controls the $key configuration value (default: Job Scheduler). Changing it affects agent behavior according to the setting type (string).

JobService.metadata.transactionTracking

Property	Value
Type	boolean
Default	false
Location	Plugins/JobService.json
Appropriate values	true or false

Track transactions in JobService. Controls the $key configuration value (default: false). Changing it affects agent behavior according to the setting type (boolean).

KeeperPAM.executablePath

Property	Value
Type	string (path)
Default	/Library/Keeper/lib/pam_keeper.so
Location	Plugins/PamModule.json
Appropriate values	Valid path; may use path variables such as {approot}

PAM shared library path. Installer/OS layout; must not be freely edited from console.

KeeperPAM.metadata.transaction.enabletracking

Property	Value
Type	boolean
Default	false
Location	Plugins/PamModule.json
Appropriate values	true or false

PAM transaction tracking. Rare debug; SystemExtension equivalent is Soft/Advanced on configured—PAM duplicate not needed.

KeeperApi and Cloud Connectivity

KeeperApi.metadata.approval.useNewTypes

Property	Value
Type	boolean
Default	true
Location	Plugins/KeeperApi.json
Appropriate values	true or false

Use new approval type mapping for agentic policies. Feature flag for agentic approval type mapping during rollout of new policy schemas.

KeeperApi.metadata.category

Property	Value
Type	string
Default	Keeper API
Location	Plugins/KeeperApi.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Category label. Controls the $key configuration value (default: Keeper API). Changing it affects agent behavior according to the setting type (string).

KeeperApi.metadata.cveCatalog.refreshHours

Property	Value
Type	integer
Default	6
Location	Plugins/KeeperApi.json
Appropriate values	Positive integer, or the documented range for this setting

CVE catalog refresh interval (hours). How fresh CVE/app-catalog data is on endpoints; air-gapped or bandwidth-limited sites need longer intervals.

KeeperApi.metadata.cveCatalog.subfolder

Property	Value
Type	string
Default	AgenticIntel
Location	Plugins/KeeperApi.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Subfolder name under data dir for CVE intel. Folder naming is product layout; refresh hours already on configured.

KeeperApi.metadata.maxJustificationTextLength

Property	Value
Type	integer
Default	512
Location	Plugins/KeeperApi.json
Appropriate values	Positive integer, or the documented range for this setting

Max justification text synced with cloud. Cloud sync truncation boundary for justifications--must match ticket systems and Controls limit.

KeeperApi.metadata.transactionTracking

Property	Value
Type	boolean
Default	true
Location	Plugins/KeeperApi.json
Appropriate values	true or false

Track cloud transaction state for API calls. Enables cloud txn correlation for support/audit; disable only if it creates unwanted chatter.

ROUTER_URL

Property	Value
Type	string
Default	(env unset)
Location	environment
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Environment override for Keeper cloud router URL. Air-gap / private Keeper router deployments must override the cloud endpoint without rebuilding the agent.

KeeperPolicy

KeeperPolicy.metadata.admin.enforce_policies_for_administrators

Property	Value
Type	boolean
Default	true
Location	Plugins/KeeperPolicy.json
Appropriate values	true or false

When true, wildcard-user policies also apply to administrators. When enabled, policies that match all users also apply to local administrators. When disabled, administrators bypass wildcard-user policies and follow OS default behavior unless a policy specifically targets them. This is a core enforcement posture setting.

KeeperPolicy.metadata.agentApplicationInventory.maxAgeSeconds

Property	Value
Type	integer
Default	86400
Location	Plugins/KeeperPolicy.json
Appropriate values	Positive integer, or the documented range for this setting

Stale inventory threshold for agentic/vuln gates. Stale AI/vuln inventory invalidates agentic gates; tune for offline or slow-sync endpoints.

KeeperPolicy.metadata.agentApplicationInventory.path

Property	Value
Type	string
Default	""
Location	Plugins/KeeperPolicy.json
Appropriate values	Valid path; may use path variables such as {approot}

Filesystem path for AI/vuln inventory mirror. Empty = platform default / env. Path overrides are bootstrap/airgap; configured covers freshness (maxAgeSeconds).

KeeperPolicy.metadata.agenticSnapshot.maxAgeSeconds

Property	Value
Type	integer
Default	120
Location	Plugins/KeeperPolicy.json
Appropriate values	Positive integer, or the documented range for this setting

Deprecated snapshot max age. Dead with deprecated snapshot path; vuln contribution is on configured.

KeeperPolicy.metadata.agenticSnapshot.path

Property	Value
Type	string
Default	""
Location	Plugins/KeeperPolicy.json
Appropriate values	Valid path; may use path variables such as {approot}

Deprecated telemetry snapshot path. Marked deprecated; realtime writer uses inventory mirror. Surfacing invites use of dead paths.

KeeperPolicy.metadata.agenticSnapshot.vulnerabilityRiskMaxContribution

Property	Value
Type	number
Default	3.0
Location	Plugins/KeeperPolicy.json
Appropriate values	Non-negative number; tune based on latency and load

Max vulnerability risk contribution from inventory mirror. Caps how much CVE signal can drive decisions--prevents vuln noise from dominating policy scores.

KeeperPolicy.metadata.eventTypeJobMapping

Property	Value
Type	array / object
Default	product map
Location	Plugins/KeeperPolicy.json
Appropriate values	JSON array or object matching the documented schema

EventType → control job ID mapping. Routes event types to control workflows; custom event types need remapping without code drops.

KeeperPolicy.metadata.eventTypeRiskJobMapping

Property	Value
Type	array / object
Default	product map
Location	Plugins/KeeperPolicy.json
Appropriate values	JSON array or object matching the documented schema

EventType → risk assessment job mapping. Chooses URL vs composite risk jobs per event type--accuracy and performance are tenant-specific.

KeeperPolicy.metadata.execution_grant.default_duration_minutes

Property	Value
Type	integer
Default	240
Location	Plugins/KeeperPolicy.json
Appropriate values	Positive integer, or the documented range for this setting

Policy-level override for grant TTL. Policy-engine grant TTL independent of host ExecutionGrant defaults for tighter JIT control.

KeeperPolicy.metadata.lookup.slowCallTimeoutSeconds

Property	Value
Type	integer
Default	5
Location	Plugins/KeeperPolicy.json
Appropriate values	Positive integer, or the documented range for this setting

macOS/Linux slow policy lookup timeout. macOS/Linux directory/FDA-slow calls hang without this; raise when directory servers are slow.

KeeperPolicy.metadata.maxRetryAttempts

Property	Value
Type	integer
Default	3
Location	Plugins/KeeperPolicy.json
Appropriate values	Positive integer, or the documented range for this setting

Retries for failed policy operations. Transient MQTT/API failure resilience for policy ops--reduces false denies during blips.

KeeperPolicy.metadata.processCatalog.path

Property	Value
Type	string
Default	""
Location	Plugins/KeeperPolicy.json
Appropriate values	Valid path; may use path variables such as {approot}

Durable process catalog path. Empty = in-memory. Path is deployment plumbing; retention hours already on configured.

KeeperPolicy.metadata.processCatalog.retentionHours

Property	Value
Type	integer
Default	24
Location	Plugins/KeeperPolicy.json
Appropriate values	Positive integer, or the documented range for this setting

Cross-session process catalog retention. Cross-session AI attribution memory; longer retention helps RDP/JIT users but grows disk use.

KeeperPolicy.metadata.processTreeDebug.logToEventLog

Property	Value
Type	boolean
Default	false
Location	Plugins/KeeperPolicy.json
Appropriate values	true or false

High-volume PROCESS_TREE_DEBUG logging. Explicitly debug-only; floods Event Log. Support flag, not tenant setting.

KeeperPolicy.metadata.riskscore.default_score

Property	Value
Type	number
Default	5.0
Location	Plugins/KeeperPolicy.json
Appropriate values	allow or deny

Default risk score when assessment unavailable. Fallback risk when assessors fail; sets allow/deny bias for incomplete risk data.

KeeperPolicy.metadata.riskscore.use_default_on_failure

Property	Value
Type	boolean
Default	false
Location	Plugins/KeeperPolicy.json
Appropriate values	true or false

Use default score vs fail when risk job errors. Fail-open vs fail-closed when risk jobs error--security-critical behavioral switch.

KeeperPolicy.metadata.storage.sharedContainers

Property	Value
Type	string
Default	PolicyRegistry, AgentApplicationInventory
Location	Plugins/KeeperPolicy.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Named shared storage container defs. Storage schema for plugins. Renaming containers orphans encrypted data.

KeeperPolicy.metadata.taskDelay

Property	Value
Type	integer
Default	250
Location	Plugins/KeeperPolicy.json
Appropriate values	Positive integer, or the documented range for this setting

MQTT message loop delay (ms). MQTT loop pacing under load; advanced tuning when policy latency or CPU spikes appear.

Plugins\bin\KeeperPolicy\currentPolicies.json

Property	Value
Type	file / content
Default	local policy snapshot
Location	KeeperPolicy runtime
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

On-disk policy snapshot used by enforcement. Derived from cloud/policy sync. Editing it bypasses policy governance and will be overwritten.

Linux Agent

KeeperLinuxAgent.metadata.commandLine.allowPaths

Property	Value
Type	string (path)
Default	systemd / apport paths
Location	Plugins/KeeperLinuxAgent.json
Appropriate values	Valid path; may use path variables such as {approot}

Command-line allow paths (noise reduction). Controls the $key configuration value (default: systemd / apport paths). Changing it affects agent behavior according to the setting type (string (path)).

KeeperLinuxAgent.metadata.fileAccess.allowPaths

Property	Value
Type	string (path)
Default	systemd / apport paths
Location	Plugins/KeeperLinuxAgent.json
Appropriate values	Valid path; may use path variables such as {approot}

File-access allow paths (noise reduction). Noise allowlist for systemd/apport paths so FileAccess policies stay usable.

KeeperLinuxAgent.metadata.fileAccess.uidThreshold

Property	Value
Type	integer
Default	1000
Location	Plugins/KeeperLinuxAgent.json
Appropriate values	Positive integer, or the documented range for this setting

UID threshold for file-access event filtering. Ignores system UIDs below threshold to cut event floods from daemons.

KeeperLinuxAgent.metadata.mqttOutages.connectionFailureBehavior

Property	Value
Type	string
Default	allow
Location	Plugins/KeeperLinuxAgent.json
Appropriate values	allow or deny

allow/deny when MQTT broker is unavailable (security-critical). Fail-open vs fail-closed when broker is down--defines offline enforcement posture on Linux.

KeeperLinuxAgent.metadata.policy.cache.cleanupInterval

Property	Value
Type	integer
Default	30
Location	Plugins/KeeperLinuxAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Decision cache cleanup interval. Reclaims stale cache entries; tune under memory pressure.

KeeperLinuxAgent.metadata.policy.cache.expireAfter

Property	Value
Type	integer
Default	60
Location	Plugins/KeeperLinuxAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Decision cache TTL (seconds). Caches decisions to cut latency/load; TTL balances freshness vs performance.

KeeperLinuxAgent.metadata.policy.maxResponseTimeout

Property	Value
Type	number
Default	5.0
Location	Plugins/KeeperLinuxAgent.json
Appropriate values	Non-negative number; tune based on latency and load

Max wait for policy decision (seconds). How long Linux waits for policy before applying timeout behavior; FDA/slow disks need higher values.

KeeperLinuxAgent.metadata.policy.onPolicyTimeout

Property	Value
Type	string
Default	allow
Location	Plugins/KeeperLinuxAgent.json
Appropriate values	allow or deny

allow/deny when policy evaluation times out (security-critical). Timeout allow/deny decides whether hangs become silent permits--security-critical.

KeeperLinuxAgent.metadata.policy.sessionInfrastructureProcesses

Property	Value
Type	string
Default	gnome-shell, plasmashell, ...
Location	Plugins/KeeperLinuxAgent.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Desktop infrastructure processes excluded from heavy policy. Desktop compositor processes that must not be over-policed or sessions break.

KeeperLinuxAgent.metadata.policy.sessionShellProcesses

Property	Value
Type	string
Default	bash, sh, zsh, ...
Location	Plugins/KeeperLinuxAgent.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Shell processes treated as session infrastructure. Login shells treated as infrastructure for session modeling--customize per org shells.

LinuxProtectedDirectories.json

Property	Value
Type	file / content
Default	filesystem defaults
Location	Linux PathResolution / KeeperLinuxAgent docs
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Linux fanotify/path exclusions for protected system directories. Linux-specific protected paths for fanotify noise and system integrity--distro layouts differ.

Logging and Monitoring

KeeperLogger.metadata.logFileName

Property	Value
Type	string
Default	Log/KeeperLogger.log
Location	Plugins/KeeperLogger.json
Appropriate values	Valid path; may use path variables such as {approot}

Log file path. Redirects logs to approved paths (e.g. central log volume) for ACL and collection agents.

KeeperLogger.metadata.loggingHttpEndpoint

Property	Value
Type	string
Default	""
Location	Plugins/KeeperLogger.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Remote HTTP log sink URL. Target URL for remote log sink when HTTP forwarding is enabled.

KeeperLogger.metadata.logRetentionDays

Property	Value
Type	integer
Default	15
Location	Plugins/KeeperLogger.json
Appropriate values	Positive integer, or the documented range for this setting

Days to keep rotated logs. Retention must match legal hold / SIEM ingest SLAs. Controls the $key configuration value (default: 15). Changing it affects agent behavior according to the setting type (integer).

KeeperLogger.metadata.logToFile

Property	Value
Type	boolean
Default	true
Location	Plugins/KeeperLogger.json
Appropriate values	true or false

Write aggregated logs to disk. Disk logging is required for offline forensics; some locked-down images forbid it and need console control.

KeeperLogger.metadata.logToHttpEndpoint

Property	Value
Type	boolean
Default	false
Location	Plugins/KeeperLogger.json
Appropriate values	true or false

Forward logs to an HTTP sink. Enables shipping logs to a tenant HTTP collector without a separate forwarder.

KeeperLogger.metadata.maxFileSizeMB

Property	Value
Type	integer
Default	100
Location	Plugins/KeeperLogger.json
Appropriate values	Positive integer, or the documented range for this setting

Log rotation size (MB). Rotation size affects disk usage and how much history survives before wrap.

KeeperLogger.metadata.taskDelay

Property	Value
Type	integer
Default	250
Location	Plugins/KeeperLogger.json
Appropriate values	Positive integer, or the documented range for this setting

MQTT loop delay (ms). Micro-tuning; changing this across many endpoints risks message backlog without clear tenant benefit.

KeeperSystemLogging:DebugFilteredMessages

Property	Value
Type	boolean
Default	false
Location	appsettings
Appropriate values	true or false

Verbose diagnostics for filtered system-log messages. Shows what the system logger dropped--needed when validating SIEM filter tuning.

KeeperSystemLogging:EnableInfoFallback

Property	Value
Type	boolean
Default	true
Location	appsettings
Appropriate values	true or false

Fallback Info logging when KeeperLogger is down. Keeps critical Info events when KeeperLogger is down--availability of audit breadcrumbs during outages.

KeeperSystemLogging:MinimumSystemLogLevel

Property	Value
Type	string
Default	Information
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Floor for OS system-log entries. Filters OS-log volume vs security-event fidelity for SIEM cost and noise.

KeeperSystemLogging:PluginCheckIntervalMinutes

Property	Value
Type	integer
Default	5
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

How often Logger plugin health is verified. How often Logger health is verified; HA teams lower this to detect silent log loss faster.

KeeperSystemLogging:SystemLoggingEnabled

Property	Value
Type	boolean
Default	true
Location	appsettings
Appropriate values	true or false

Master switch for OS event-log / syslog output. Toggles Windows Event Log / syslog emission required by many SIEM/compliance pipelines.

Logging:LogLevel:Default

Property	Value
Type	string
Default	Information
Location	appsettings
Appropriate values	Critical, Error, Warning, Information, Debug, Trace

ASP.NET framework default log level. ASP.NET host verbosity; useful when Kestrel/auth middleware issues must be captured.

Logging:LogLevel:Microsoft

Property	Value
Type	string
Default	Information
Location	appsettings
Appropriate values	Critical, Error, Warning, Information, Debug, Trace

ASP.NET Microsoft.* category log level. Framework noise knob; configured already exposes Default / service logging. Category-level ASP.NET tuning is support/debug only.

Logging:LogLevel:Microsoft.AspNetCore.Server.Kestrel

Property	Value
Type	string
Default	Information
Location	appsettings
Appropriate values	Critical, Error, Warning, Information, Debug, Trace

Kestrel category log level. Controls the $key configuration value (default: Information). Changing it affects agent behavior according to the setting type (string).

Logging:LogLevel:Microsoft.Hosting.Lifetime

Property	Value
Type	string
Default	Information
Location	appsettings
Appropriate values	Critical, Error, Warning, Information, Debug, Trace

Hosting lifetime category log level. Startup/shutdown framework logs; not a tenant control plane setting.

Logging:LogLevel:System

Property	Value
Type	string
Default	Information
Location	appsettings
Appropriate values	Critical, Error, Warning, Information, Debug, Trace

System.* framework log level. Framework category; overlaps with KeeperSystemLogging / KeeperLogger already on configured.

PluginMonitoring:CheckIntervalMinutes

Property	Value
Type	number
Default	0.5
Location	appsettings
Appropriate values	Non-negative number; tune based on latency and load

Plugin process health-check cadence. Controls auto-restart responsiveness for crashed plugins--availability vs CPU tradeoff.

PluginMonitoring:Enabled

Property	Value
Type	boolean
Default	true
Location	appsettings
Appropriate values	true or false

Documented master switch for plugin monitoring. Code/docs note monitoring effectively always runs; exposing a no-op (or misleading) switch can be misleading if monitoring is always active regardless of the value.

PluginMonitoring:LogHealthChecks

Property	Value
Type	boolean
Default	false
Location	appsettings
Appropriate values	true or false

Log every plugin health-check result. Enables verbose health spam for short-lived diagnosis of restart loops.

macOS System Extension

SystemExtension.metadata.commandLine.allowPaths

Property	Value
Type	string (path)
Default	/Library/Keeper, sudo
Location	Plugins/SystemExtension.json
Appropriate values	Valid path; may use path variables such as {approot}

Command-line allow paths. Allowlists expected cmdline monitors (e.g. sudo/Keeper) to avoid alert fatigue.

SystemExtension.metadata.fileAccess.allowPaths

Property	Value
Type	string
Default	system + Keeper paths
Location	Plugins/SystemExtension.json
Appropriate values	Valid path; may use path variables such as {approot}

File-access allow paths. Reduces macOS FileAccess noise from system frameworks while keeping real apps evaluated.

SystemExtension.metadata.mqttOutages.connectionFailureBehavior

Property	Value
Type	string
Default	allow
Location	Plugins/SystemExtension.json
Appropriate values	allow or deny

allow/deny when MQTT broker is unavailable (security-critical). macOS fail-open/closed when MQTT is down--defines offline Endpoint Security posture.

SystemExtension.metadata.policy.cache.expireAfter

Property	Value
Type	integer
Default	60
Location	Plugins/SystemExtension.json
Appropriate values	Positive integer, or the documented range for this setting

Decision cache TTL (seconds). macOS decision cache TTL for ES performance vs freshness.

SystemExtension.metadata.policy.highLoad.fallbackAllowPaths

Property	Value
Type	string (path)
Default	system + /Library/Keeper
Location	Plugins/SystemExtension.json
Appropriate values	Valid path; may use path variables such as {approot}

Paths allowed under high-load fallback. Which paths keep working under load fallback--must include system+Keeper or logon breaks.

SystemExtension.metadata.policy.highLoad.inflightThreshold

Property	Value
Type	integer
Default	200
Location	Plugins/SystemExtension.json
Appropriate values	Positive integer, or the documented range for this setting

In-flight events before high-load fallback. Tripwire before high-load fallback; protects UI freezes under event storms.

SystemExtension.metadata.policy.maxResponseTimeout

Property	Value
Type	number
Default	5.0
Location	Plugins/SystemExtension.json
Appropriate values	Non-negative number; tune based on latency and load

Max wait for policy decision (seconds). Wait budget before timeout behavior; FDA-denied lookups need longer timeouts.

SystemExtension.metadata.policy.onPolicyTimeout

Property	Value
Type	string
Default	allow
Location	Plugins/SystemExtension.json
Appropriate values	allow or deny

allow/deny when policy evaluation times out (security-critical). Timeout allow/deny for macOS ES events; wrong default creates silent permits or freezes.

SystemExtension.metadata.privilegeElevation.allowPaths

Property	Value
Type	string
Default	loginwindow, Keeper, ...
Location	Plugins/SystemExtension.json
Appropriate values	Valid path; may use path variables such as {approot}

Privilege-elevation allow paths. Lets loginwindow/authtrampoline elevate without false policy hits during logon.

SystemExtension.metadata.transaction.enabletracking

Property	Value
Type	boolean
Default	false
Location	Plugins/SystemExtension.json
Appropriate values	true or false

Enable transaction tracking in System Extension. Optional txn correlation for macOS ES debugging/audit pipelines.

MFA, Justification, and Execution Grants

Controls:maxJustificationTextLength

Property	Value
Type	integer
Default	512
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Max characters in justification control text. Caps justification payload size for UI and cloud sync; prevents abuse and aligns with ticket-field limits.

ExecutionGrant:DefaultDurationMinutes

Property	Value
Type	integer
Default	240
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Default execution grant lifetime (minutes). Default JIT grant lifetime for approved elevations; too long widens exposure, too short floods re-approvals.

ExecutionGrant:MaxDurationMinutes

Property	Value
Type	integer
Default	10080
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Maximum execution grant lifetime (7 days). Hard ceiling so policies/plugins cannot issue week-plus grants that violate least-privilege standards.

MfaGracePeriod:GracePeriodMinutes

Property	Value
Type	integer
Default	5
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Skip MFA re-prompt window after success. Controls re-prompt friction after successful MFA; productivity vs session-hijack risk is a tenant tradeoff.

MfaLockout:LockoutDurationMinutes

Property	Value
Type	integer
Default	15
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

MFA lockout duration after max failures. Balances lockout pain vs attacker retry windows; helpdesk and security teams typically set duration to balance lockout friction and attacker retry windows.

MfaLockout:MaxFailedAttempts

Property	Value
Type	integer
Default	5
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Failed MFA attempts before lockout. Directly sets brute-force resistance for MFA controls; security policy must tune attempts per compliance posture.

MQTT Topics and Messaging Topology

Topic names and allowlists that connect the host, plugins, and jobs over the local MQTT broker. Values must stay consistent across components.

*.metadata.mqttRole

Property	Value
Type	string
Default	subscriber/publisher
Location	Plugins/*.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Declares plugin MQTT roles. Loader/auth topology metadata; It describes messaging roles used by the loader and authentication path.

MqttJobPublishSettings:PublishMqtt:AllowedTopics

Property	Value
Type	array / object
Default	product wildcards
Location	appsettings
Appropriate values	JSON array or object matching the documented schema

Global allowlist of topics jobs may publish to. Security-critical product fence for job processes. Incorrect edits can open # publishes or brick job status. Keep aligned with the product topic contract so jobs and plugins can communicate.

MqttTopics:AuditTopic

Property	Value
Type	string
Default	AuditMessage
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Logical audit topic name. Renaming breaks every publisher/subscriber that hard-expects AuditMessage.

MqttTopics:publish

Property	Value
Type	array / object
Default	product topic list
Location	appsettings
Appropriate values	JSON array or object matching the documented schema

Host MQTT client publish allowlist. Product pub/sub contract. Tenant edits desync plugins from the broker ACL and drop audit/policy traffic.

MqttTopics:subscribe

Property	Value
Type	array / object
Default	product topic list
Location	appsettings
Appropriate values	JSON array or object matching the documented schema

Host MQTT client subscribe allowlist. Controls the $key configuration value (default: product topic list). Changing it affects agent behavior according to the setting type (array / object).

Other Plugins

arguments

Property	Value
Type	string
Default	""
Location	Plugins/*.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Command-line args passed to plugin exe. Product launch contract; free-form args can disable security flags or break AOT hosts.

KeeperUSession.metadata.taskDelay

Property	Value
Type	integer
Default	250
Location	Plugins/KeeperUSession.json
Appropriate values	Positive integer, or the documented range for this setting

USession MQTT loop delay. Controls the $key configuration value (default: 250). Changing it affects agent behavior according to the setting type (integer).

Path Protection

{Platform}ProtectedDirectories.json

Property	Value
Type	file / content
Default	OS defaults
Location	PathResolution platform defaults
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Platform default protected directories seeded by PathConfigurationService. Baseline OS protected directories; hardening teams review/extend defaults per platform.

LeastPrivilegeExclusions

Property	Value
Type	string
Default	(policy/storage)
Location	Policy registry + Settings API
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Accounts excluded from least-privilege enforcement. Break-glass accounts that must keep admin rights; when unchanged, LPE strands IT admins.

PolicyProtectedDirectories.json

Property	Value
Type	file / content
Default	(from ProtectedPaths)
Location	PathResolution / PolicyProtectedDirectories.json
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Protected directories written from ProtectedPaths policies (merged with platform defaults). Materialized output of ProtectedPaths policies; ops need visibility/export of what the agent is enforcing.

ProtectedPaths (policy type)

Property	Value
Type	string
Default	(policy-driven)
Location	Policy / PolicyUpdateService
Appropriate values	Valid path; may use path variables such as {approot}

Keeper configuration policy type: paths that must not be modified by conflicting FileAccess policies. Policy type that hardens paths against conflicting FileAccess grants--primary admin protection UX.

UserProtectedDirectories.json

Property	Value
Type	file / content
Default	(optional overlay)
Location	PathResolution / UserProtectedDirectories.json
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Admin/local overlay of wildcard FileAccess protected directories under PathResolution storage. Local/admin overlay for protected dirs beyond platform defaults--site-specific sensitive trees.

Path Variables

Custom path variables (arbitrary name->value)

Property	Value
Type	string
Default	(none)
Location	PathVariables API
Appropriate values	Valid path; may use path variables such as {approot}

Admin-defined path placeholders via /api/PathVariables (built-ins are read-only). Lets policies/jobs use org path aliases ({CorpApps}) without hardcoding drive letters per site.

Plugin Manifest Fields

Common fields on every file under Plugins/*.json. They describe how the agent loads and starts the plugin process.

autoRestart

Property	Value
Type	boolean
Default	true/false
Location	Plugins/*.json
Appropriate values	true or false

Restart on unexpected exit. Controls the $key configuration value (default: true/false). Changing it affects agent behavior according to the setting type (boolean).

autoStart

Property	Value
Type	boolean
Default	true/false
Location	Plugins/*.json
Appropriate values	true or false

Whether host launches plugin at startup. Some plugins must stay on-demand (elevation). Flipping autoStart from console breaks elevation or burns sessions.

debugExecutablePath

Property	Value
Type	string
Default	repo-relative Debug path
Location	Plugins/*.json
Appropriate values	Valid path; may use path variables such as {approot}

Visual Studio / debug build path. Intended for development builds. Meaningless (and dangerous) on production endpoints.

executablePath

Property	Value
Type	string (path)
Default	bin/...
Location	Plugins/*.json
Appropriate values	Valid path; may use path variables such as {approot}

Release executable path under install root. Path is fixed by installer layout. Tenant edits → plugin fails to start after upgrades.

executionContext

Property	Value
Type	string
Default	Service / User
Location	Plugins/*.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Account context for the process. Security boundary (SYSTEM vs user). should be changed only with a coordinated product or deployment change.

id

Property	Value
Type	string
Default	plugin id
Location	Plugins/*.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Stable plugin identifier. Must match process/API keys; renaming orphans storage and MQTT. Display name belongs in product packaging, not tenant edit.

modifiedAt

Property	Value
Type	string
Default	ISO timestamp
Location	Plugins/*.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Last metadata change stamp. Controls the $key configuration value (default: ISO timestamp). Changing it affects agent behavior according to the setting type (string).

pluginType

Property	Value
Type	string
Default	Executable / Service / …
Location	Plugins/*.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

How the loader starts the plugin. Wrong type prevents start or mis-classifies libraries as services.

requiresMonitoring

Property	Value
Type	boolean
Default	true/false
Location	Plugins/*.json
Appropriate values	true or false

Include in plugin health monitoring. Coupled to Watchdog/PluginMonitoring design; configured already covers monitoring cadence.

startupPriority

Property	Value
Type	string
Default	numeric
Location	Plugins/*.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Lower starts earlier. Ordering is carefully chosen for broker/API dependencies. Tenant reordering causes racey boots.

supportedPlatforms

Property	Value
Type	array / object
Default	OS list
Location	Plugins/*.json
Appropriate values	JSON array or object matching the documented schema

Platforms this plugin may run on. Filtering is build/installer concern. Console toggles won’t add missing binaries for other OS.

Redirect Evaluator

RedirectEvaluator.metadata.redirect.enabled

Property	Value
Type	boolean
Default	true
Location	Plugins/RedirectEvaluator.json
Appropriate values	true or false

Enable launch redirects during privilege elevation. Master switch for launch redirects (e.g. ncpa→NetworkConnections); security feature tenants enable/disable.

RedirectEvaluator.metadata.redirect.rules

Property	Value
Type	array / object
Default	ncpa, Notepad, Terminal, MSI...
Location	Plugins/RedirectEvaluator.json
Appropriate values	JSON array or object matching the documented schema

Redirect rules (sourceExePattern, commandLinePattern, targetExe, ...). Maps elevation requests to safer substitutes--core customization for org-specific tools and installers.

RedirectEvaluator.metadata.redirect.rulesPath

Property	Value
Type	string
Default	(optional)
Location	Plugins/RedirectEvaluator.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Optional external file for redirect rules. Lets large rule sets live in a managed file synced by config management.

Runtime Files and Localization

Jobs\locale-cache-cleanup.json

Property	Value
Type	file / content
Default	cleanup job
Location	Jobs/locale-cache-cleanup.json
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Clears locale caches. Maintenance job graph—see Job workflow section. Controls the $key configuration value (default: cleanup job). Changing it affects agent behavior according to the setting type (file / content).

Security, Certificates, and Trust

ConfigurationLkg:Enabled

Property	Value
Type	boolean
Default	true
Location	appsettings
Appropriate values	true or false

Last-known-good reconciliation for policy-written config. Turns last-known-good config recovery on/off--critical after bad SettingsUpdate pushes so fleets can self-heal.

Plugins:JobService:AgentInactiveJobAllowlist

Property	Value
Type	string
Default	registration, StartKeeperClient, ...
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Jobs allowed to run when agent is inactive. Limits which jobs run without an interactive session; misuse can launch user UI jobs headlessly--security-sensitive allowlist.

Settings:AllowedNonAdminExecutables

Property	Value
Type	array / object
Default	product UI list
Location	appsettings
Appropriate values	JSON array or object matching the documented schema

Binaries allowed without admin in user context. Controls which Keeper UI helpers may run unelevated; tightening/loosening this is a security policy decision per estate.

Settings:AlternativeSignatures

Property	Value
Type	array / object
Default	[]
Location	appsettings
Appropriate values	JSON array or object matching the documented schema

Extra trusted code-signing thumbprints for plugins. Partners and internal builds sign plugins with non-Keeper certs; without this list those plugins are rejected at load.

Settings:CertName

Property	Value
Type	string
Default	""
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Certificate subject/name in store. Subject/name lookup for store-based TLS; required whenever CertStore is used in corporate PKI deployments.

Settings:CertPassword

Property	Value
Type	string
Default	""
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

TLS certificate password (secret store, not plaintext). Companion secret for file-based TLS certs; should be stored and rotated as a secret, never left as cleartext ops debt.

Settings:CertPath

Property	Value
Type	string
Default	""
Location	appsettings
Appropriate values	Valid path; may use path variables such as {approot}

TLS certificate file path (mask as secret). Custom TLS for the local API needs enterprise PKI paths--should be managed centrally rather than edited per machine.

Settings:CertStore

Property	Value
Type	string
Default	""
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Windows certificate store name. Enterprises using Windows cert stores (not files) need this selector to attach the correct store for local HTTPS.

Settings:CriticalSystemDirectories

Property	Value
Type	string
Default	OS critical dirs
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Directories protected from elevation/redirect tampering. Blocks grants that target OS-critical trees; regulated environments require visible, adjustable denylists.

Settings:CriticalSystemFiles

Property	Value
Type	string
Default	OS critical exes
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Files protected from elevation/redirect tampering. Defines OS binaries elevation/redirect must never rewrite; security teams may extend for custom protected tools.

Settings:MaintainKeeperAccount

Property	Value
Type	boolean
Default	false
Location	appsettings
Appropriate values	true or false

Persist KeeperUserSession across restarts (Windows hybrid AAD + Intune). Hybrid AAD+Intune endpoints fail elevation after reboot unless the KeeperUserSession account is retained--tenant policy must choose this.

Session Monitoring and Watchdog

SessionEventDispatcher:StartKeeperClientCoalesceSeconds

Property	Value
Type	integer
Default	12
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Debounce rapid session events before starting client. Debounces bursty logon events that would otherwise spawn duplicate KeeperClient processes.

SessionMonitoring:Enabled

Property	Value
Type	boolean
Default	true
Location	appsettings
Appropriate values	true or false

Enable user-session polling. Master switch for detecting logons/sessions that start KeeperClient--disabling breaks tray UX and session-aware jobs.

SessionMonitoring:ExcludedUsers

Property	Value
Type	string
Default	SYSTEM, LOCAL SERVICE, ...
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Accounts excluded from session handling. Stops session handling for service accounts; incorrect lists spam SYSTEM sessions or miss real users.

SessionMonitoring:LinuxDesktopProcesses

Property	Value
Type	string
Default	gnome-shell, kwin, ...
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Linux processes that indicate interactive desktop. Desktop-session heuristics differ by distro/DE; wrong lists leave Linux users without KeeperClient.

SessionMonitoring:MacOSDesktopProcesses

Property	Value
Type	string
Default	Dock, Finder, WindowServer
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

macOS processes that indicate interactive desktop. macOS session detection depends on Dock/Finder/WindowServer signals--customize for atypical environments.

SessionMonitoring:PollingIntervalSeconds

Property	Value
Type	integer
Default	5
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

How often active sessions are scanned. CPU vs session-detection latency knob for VDI/dense hosts where 5s polling is too aggressive.

SessionMonitoring:StartKeeperClientOnLogin

Property	Value
Type	boolean
Default	true
Location	appsettings
Appropriate values	true or false

Launch KeeperClient when user logs in. Determines whether users get the agent UI at logon; required for request/approval workflows to be reachable.

SessionMonitoring:StartKeeperClientOnReconnect

Property	Value
Type	boolean
Default	true
Location	appsettings
Appropriate values	true or false

Relaunch KeeperClient on session reconnect. RDP/reconnect scenarios drop the tray client unless this relaunch path is enabled--ops must control it.

Watchdog:AutoRemediate

Property	Value
Type	boolean
Default	true
Location	appsettings
Appropriate values	true or false

Automatically restart unhealthy KEPM components. Chooses self-healing vs alert-only when KEPM is unhealthy--availability policy for production fleets.

Watchdog:CheckIntervalSec

Property	Value
Type	integer
Default	10
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Watchdog health-check interval. How fast outages are detected; shorter intervals recover faster but add host noise.

Watchdog:StartupDelaySec

Property	Value
Type	integer
Default	90
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Grace period after boot before remediation. Avoids false unhealthy restarts during slow boots/AV scans--must match image boot SLAs.

Watchdog:UnhealthyRestartThreshold

Property	Value
Type	integer
Default	3
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Consecutive failures before restart. Consecutive failure count before restart; prevents flapping on transient API blips.

Windows Process Injection Lists

allow.dat

Property	Value
Type	array / object
Default	Keeper + Windows allowlist
Location	Plugins/bin/KeeperUSession/allow.dat (install)
Appropriate values	JSON array or object matching the documented schema

Process allowlist beside KeeperUSession: listed apps bypass policy checks (auto-allow). Supports %BINDIR%, %WINDIR%, basename-only entries. Processes listed here skip policy evaluation (auto-allow). Include only trusted Keeper components and carefully reviewed exceptions. Incorrect entries create silent bypasses.

exclude.dat

Property	Value
Type	file / content
Default	OS/AV/browser exclusions
Location	Plugins/bin/KeeperUSession/exclude.dat (install)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Process/path exclusion list for injector attach: listed processes are not injected. Supports %WINDIR%, %BINDIR%, %PROGDIR%, %PROGDIRX86%, directory trailing \. Critical for AV/EDR coexistence. Use this list to prevent injection into antivirus, EDR, browsers, and other sensitive processes. Incorrect exclusions can cause instability; missing exclusions can break coexistence with security products.

noautoinject.dat

Property	Value
Type	file / content
Default	(empty on install)
Location	Plugins/bin/KeeperUSession/noautoinject.dat (install)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Optional list of processes that should not be auto-injected at session start (beside allow.dat/exclude.dat under KeeperUSession). Fine-grained opt-out of session-start injection for fragile apps without full exclude.dat denylists.

Where to Configure

What	Where	Notes
Global settings (ports, paths, logging, MFA, sessions)	appsettings.json	Restart the agent service for port and path changes
Plugin behavioral settings	Plugins/{PluginName}.json or PUT /api/PluginSettings/{id}/{key}	Restart the plugin after change when it caches settings at startup
Inventory scan options	Jobs/bin/InventoryFull/InventoryFullConfiguration.json	Applied on the next inventory job run
Windows injector lists	Plugins/bin/KeeperUSession/allow.dat, exclude.dat, noautoinject.dat	Reloaded by the injector on its refresh interval
Agentic content	Config/*.json, intel/rules/*.json, app catalog under intel / shared storage	Deployed as agent content; refresh via KeeperApi catalog settings where applicable
Path variables	Path Variables API / policies	Built-in variables are read-only; custom variables are admin-defined
macOS registration / FDA / system extension	MDM configuration profiles	Required for reliable macOS deployment

After editing plugin JSON on disk, use POST /api/PluginSettings/{pluginName}/revert (or revert-all) to reload from file into unified storage, then restart the plugin so it picks up the new values.

---

Related Documentation:

• Plugins & Settings

• Plugin & Task Settings

• Job & Plugin Settings Keys