> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/custom-tooling/configurable-settings.md).
# Configurable Settings
## Configuration Options Reference
**Audience:** IT administrators and integrators who need a complete reference for Keeper Endpoint Privilege Manager (KEPM) configuration options on the agent.
This page documents configuration settings used by the Keeper EPM agent. Settings may live in `appsettings.json` next to the agent service, in plugin JSON under `Plugins/`, in job or inventory configuration files, in content files under `Config/` or `intel/`, in Windows injector `.dat` lists, or in MDM profiles. At runtime, unified storage can override on-disk plugin settings until reverted.
For each setting this page provides the data type, default value, a detailed description of behavior and operational impact, appropriate values, and the configuration location.
## How Settings Are Applied
* **Global settings** - Values under `appsettings.json` (and related host sections) apply to the whole agent service. Port and path changes typically require a service restart.
* **Plugin settings** - Each plugin has a JSON file under `Plugins/` (for example `Plugins/KeeperPolicy.json`). Behavioral options usually appear under `metadata`. Read or update them with the Plugin Settings API (`GET` / `PUT /api/PluginSettings/{pluginName}/...`). After editing a file on disk, use `POST /api/PluginSettings/{pluginName}/revert` (or `revert-all`) so unified storage matches the file, then restart the plugin if needed.
* **SettingsUpdate policy** - A configuration policy can push plugin or `appsettings.json` changes to endpoints. The Configuration Policy Processor applies them.
* **Content and list files** - Agentic intel rules, basename lists, inventory scan options, and Windows `allow.dat` / `exclude.dat` files are deployed with the agent or updated as content. Treat them as structured configuration, not free-form text.
* **MDM (macOS)** - Registration code, Full Disk Access, and system-extension allowlisting are delivered with configuration profiles during deployment.
For narrative guidance, see [Plugins & Settings](/en/keeperpam/endpoint-privilege-manager/setup/plugins-and-settings.md) and [Plugin & Task Settings](/en/keeperpam/endpoint-privilege-manager/custom-tooling/jobs-and-plugins/custom-plugin-guide/plugins-reference/plugin-and-task-settings.md). For local API details, see the [HTTP Reference](/en/keeperpam/endpoint-privilege-manager/custom-tooling/http-reference-guide.md).
## Contents
* [Agentic AI and Risk Content](#agentic-ai-and-risk-content) (11)
* [Boot and Performance](#boot-and-performance) (6)
* [Client and Agent UI](#client-and-agent-ui) (16)
* [Deployment and MDM](#deployment-and-mdm) (3)
* [Elevation Chain (RunAs / RunElevated)](#elevation-chain-runas-runelevated) (6)
* [Host Service and Networking](#host-service-and-networking) (14)
* [Inventory Scan](#inventory-scan) (14)
* [Jobs and Orchestration](#jobs-and-orchestration) (4)
* [KeeperApi and Cloud Connectivity](#keeperapi-and-cloud-connectivity) (8)
* [KeeperPolicy](#keeperpolicy) (19)
* [Linux Agent](#linux-agent) (11)
* [Logging and Monitoring](#logging-and-monitoring) (20)
* [macOS System Extension](#macos-system-extension) (10)
* [MFA, Justification, and Execution Grants](#mfa-justification-and-execution-grants) (6)
* [MQTT Topics and Messaging Topology](#mqtt-topics-and-messaging-topology) (5)
* [Other Plugins](#other-plugins) (2)
* [Path Protection](#path-protection) (5)
* [Path Variables](#path-variables) (1)
* [Plugin Manifest Fields](#plugin-manifest-fields) (11)
* [Redirect Evaluator](#redirect-evaluator) (3)
* [Runtime Files and Localization](#runtime-files-and-localization) (1)
* [Security, Certificates, and Trust](#security-certificates-and-trust) (11)
* [Session Monitoring and Watchdog](#session-monitoring-and-watchdog) (12)
* [Windows Process Injection Lists](#windows-process-injection-lists) (3)
**Total settings in this reference:** 201
### Agentic AI and Risk Content
Files under `Config/` and `Plugins/bin/KeeperAgenticSnapshotWriter/intel/` (and mirrored copies beside inventory binaries) drive AI likelihood, vulnerability, and risk-behavior scoring.
#### `AgenticChainIntermediaryBasenames.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | cmd, powershell, wt, wsl, … |
| **Location** | Config/AgenticChainIntermediaryBasenames.json (install) |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Shell/terminal basenames allowed to sit between an AI agent and a tool subprocess (MarkAgentic / OriginatingAgent stamps). Allows cmd/pwsh/wt/wsl to carry originating-agent stamps between AI parent and tools--required for accurate chains.
#### `AiLikelihoodCapSettings.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | maxAiLikelihoodPercent=75 |
| **Location** | Config/AiLikelihoodCapSettings.json (install root + plugin Config) |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Caps AI likelihood for browser/webview-like basenames; also inventoryExclusions path segments for Keeper PEDM binaries. Prevents browsers/WebView2 from being scored as AI agents and excludes Keeper binaries from inventory noise.
#### `AiLikelihoodFloorSettings.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | minAiLikelihoodPercent=100 |
| **Location** | Config/AiLikelihoodFloorSettings.json (install root + plugin Config) |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Curated native AI-agent executables (basename + PE identity + Authenticode subject). Sets cold-start AI likelihood floor for policy attribution. Curated signed AI apps (Cursor, Claude, etc.) get correct high AI likelihood for agentic policies--must update as products ship.
#### `intel/app-catalog.ndjson(.gz)`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | (via KeeperApi refresh) |
| **Location** | KeeperApi cveCatalog + AgenticIntel shared folder |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Current vuln/product catalog source for vulnerabilityRiskPercent. Authoritative product/CVE catalog for vuln baselines--must be refreshable and versioned for agentic risk.
#### `intel/normalized-vulnerability.jsonl`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | (feed present on install) |
| **Location** | Plugins/bin/KeeperAgenticSnapshotWriter/intel/ (install) |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Legacy CVE feed still shipped on current Windows install. Prefer app-catalog.ndjson(.gz) going forward. Legacy CVE corpus still on disk; ops need a content-update path until fully migrated to app-catalog.
#### `intel/rules/AI_Detection.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | staticAnalysis + signatures |
| **Location** | Plugins/bin/KeeperAgenticSnapshotWriter/intel/rules/ |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Heuristic rules for AI/static-scan scoring (enable/disable rules, patterns, severity). Same ControlPlane rules configured. Tenant/product rules that decide AI likelihood from imports/signatures--directly drives agentic policy outcomes.
#### `intel/rules/Risk_Behavior.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | identity privilege tiers |
| **Location** | Plugins/bin/KeeperAgenticSnapshotWriter/intel/rules/ |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Risk-behavior heuristic rules (e.g. local admin / RDP identity tiers) that boost riskBehavior scores. Identity/privilege-tier heuristics feeding riskBehavior scores for policy gates.
#### `intel/rules/Vulnerability.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | CVE/KEV boost rules |
| **Location** | Plugins/bin/KeeperAgenticSnapshotWriter/intel/rules/ |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Vulnerability heuristic rules (CVSS thresholds, CISA KEV, component hints) that boost vulnerabilityRiskPercent. CVSS/KEV boost rules that raise vulnerabilityRiskPercent--security teams must tune thresholds.
#### `ShellMediatedParentBasenames.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | svchost, RuntimeBroker, shells… |
| **Location** | Plugins/bin/KeeperPolicy/Config/ShellMediatedParentBasenames.json |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Parent basenames eligible for shell-mediated spawn bridge when OsShellExclusion also matches (KeeperPolicy). Broker/shell parents eligible for shell-mediated spawn bridging; wrong list drops AI lineage across AppX/broker hops.
#### `static-scan-product-haystack.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | scoreBuckets (embedded) |
| **Location** | KeeperAgenticSnapshotWriter/config (repo; may be embedded on install) |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Static-scan product haystack buckets for AI scoring. Often embedded in snapshot writer. Static-scan score buckets for AI detection; updating patterns improves detection without agent rebuilds.
#### `SystemShellBasenames.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | explorer, cmd, powershell, … |
| **Location** | Config/SystemShellBasenames.json (install root + plugin Config) |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
OS shell/system basenames that must never be classified as AI agents (OsShellExclusion). Ensures shells/OS hosts never classify as AI agents; misclassification breaks agentic attribution.
### Boot and Performance
#### `Settings:BootPhase:DeferNonCriticalJobsAfterBootMinutes`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 3 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Post-boot grace window (minutes). Tunes post-boot quiet period so inventory/updater do not contend with Group Policy/logon scripts.
#### `Settings:BootPhase:DeferNonCriticalJobsAfterLogonMinutes`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 2 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Post-logon grace window (minutes). Per-user logon grace for multi-session hosts where boot grace alone is insufficient.
#### `Settings:BootPhase:DeferPolicyPathObservedDuringGrace`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Buffer inventory/path triggers during grace. Buffers inventory path storms at logon that would otherwise queue dozens of scans.
#### `Settings:BootPhase:Enabled`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Defer non-critical jobs after boot/logon. Protects login-time UX by deferring heavy jobs; VDI/boot storms require this toggle.
#### `Settings:BootPhase:KeeperUpdaterLogonDeferralSeconds`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 90 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Updater deferral after logon (seconds). Stops updater UI/IO from colliding with first-login software installs.
#### `Settings:BootPhase:MaxConcurrentExternalProcessesDuringGrace`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 3 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Max external job processes during grace. Caps job fan-out during grace to protect CPU/disk on thin clients.
### Client and Agent UI
#### `elevation-allowed-extensions.json (executable-extensions)`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | windows: .exe/.bat/.cmd/.msi/.ps1 |
| **Location** | Plugins/bin/KeeperClient & keeperAgent (install) |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Allowed Request Elevation file types per OS. No separate executable-extensions file exists on disk; this JSON (or KEEPER\_ELEVATION\_EXTENSIONS\_CONFIG) is the admin configured. Inventory uses PriorityExtensions / EnableExecutableOnlyScanning separately. Defines which file types users may Request Elevate; wrong list blocks .msi/.ps1 or opens risky types.
#### `keeperAgent.metadata.approvalExpirationHours`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 72 |
| **Location** | Plugins/keeperAgent.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Hours until a pending approval expires. Pending approvals must expire or queues grow stale--SLA for approvers.
#### `keeperAgent.metadata.approvedRequestExpirationHours`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 24 |
| **Location** | Plugins/keeperAgent.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Hours until an approved grant can no longer launch. How long a granted launch remains usable; short TTL reduces lingering privilege.
#### `keeperAgent.metadata.historyRetentionDays`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 30 |
| **Location** | Plugins/keeperAgent.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Local request history retention. Controls the $key configuration value (default: 30). Changing it affects agent behavior according to the setting type (integer).
#### `keeperAgent.metadata.maxExceptionMessageLength`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 500 |
| **Location** | Plugins/keeperAgent.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
UI exception truncation. Controls the $key configuration value (default: 500). Changing it affects agent behavior according to the setting type (integer).
#### `keeperAgent.metadata.maxHistoryItems`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 20 |
| **Location** | Plugins/keeperAgent.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Max history items shown in UI. Bounds history rendering cost on busy approvers' machines.
#### `keeperAgent.metadata.maxPayloadSizeBytes`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 1048576 |
| **Location** | Plugins/keeperAgent.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Max MQTT payload. Protocol ceiling; raising without coordinated clients causes silent drops.
#### `keeperAgent.metadata.maxRequestItems`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 20 |
| **Location** | Plugins/keeperAgent.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Max pending requests shown in UI. UI list cap prevents huge pending queues from freezing the dialog.
#### `keeperAgent.metadata.showInTray`
| Property | Value |
| ---------------------- | ------------------------ |
| **Type** | boolean |
| **Default** | false |
| **Location** | Plugins/keeperAgent.json |
| **Appropriate values** | `true` or `false` |
Show keeperAgent tray icon. Separate tray presence for keeperAgent vs KeeperClient--avoid dual icons or missing UX.
#### `KeeperAgenticSnapshotWriter.metadata.hostProcess`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | KeeperPrivilegeManager |
| **Location** | Plugins/KeeperAgenticSnapshotWriter.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Expected host process name. Security/identity expectation for the writer; must stay product-fixed.
#### `KeeperAgenticSnapshotWriter.metadata.taskDelay`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 250 |
| **Location** | Plugins/KeeperAgenticSnapshotWriter.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Writer loop delay. Controls the $key configuration value (default: 250). Changing it affects agent behavior according to the setting type (integer).
#### `KeeperClient.metadata.LanguageOverride`
| Property | Value |
| ---------------------- | ---------------------------------------------------- |
| **Type** | string |
| **Default** | DEFAULT |
| **Location** | Plugins/KeeperClient.json |
| **Appropriate values** | `DEFAULT` or a culture code such as `en_US`, `fr_FR` |
UI language override (e.g. en\_US, fr\_FR). Forces UI locale independent of OS language for multinational estates.
#### `KeeperClient.metadata.menu.autoRefresh`
| Property | Value |
| ---------------------- | ------------------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | Plugins/KeeperClient.json |
| **Appropriate values** | `true` or `false` |
Auto-refresh tray menu on a timer. Disabling stops timer churn on locked-down thin clients.
#### `KeeperClient.metadata.menu.items`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | array / object |
| **Default** | product menu |
| **Location** | Plugins/KeeperClient.json |
| **Appropriate values** | JSON array or object matching the documented schema |
Tray menu jobs, dialogs, and visibility filters. Customizes which request/approval jobs appear in the tray--core UX branding per org.
#### `KeeperClient.metadata.menu.refreshIntervalMinutes`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 5 |
| **Location** | Plugins/KeeperClient.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Tray menu refresh interval. How fresh tray actions stay vs API load--tune for VDI density.
#### `KeeperClient.metadata.showInTray`
| Property | Value |
| ---------------------- | ------------------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | Plugins/KeeperClient.json |
| **Appropriate values** | `true` or `false` |
Show KeeperClient system tray icon. Visibility of the user agent; some kiosks hide tray icons while interactive desktops require them.
### Deployment and MDM
macOS deployment settings delivered with MDM configuration profiles. See also the macOS deployment guides on docs.keeper.io.
#### `Full Disk Access (SystemPolicyAllFiles)`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | KEPM paths |
| **Location** | MDM mobileconfig |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
FDA grants for KEPM launcher/daemon/notify/trash. FDA is mandatory for reliable process/file visibility on macOS; deploy UX must configured the required TCC profile.
#### `KEEPERREGCODE`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | (MDM-supplied) |
| **Location** | MDM mobileconfig |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
macOS managed preference for agent registration code. Device join secret for macOS MDM enrollment--must be pushed via Admin/MDM, not left unset.
#### `System Extension allowlist (Team ID 234QNB7GCA)`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | com.keeper...monitor |
| **Location** | MDM mobileconfig |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Allow Endpoint Security system extension via MDM. Without MDM allowlisting, macOS blocks the Endpoint Security extension and monitoring never starts.
### Elevation Chain (RunAs / RunElevated)
#### `KeeperRunAs.metadata.credentialHandling`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | ephemeral-accounts |
| **Location** | Plugins/KeeperRunAs.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Credential strategy label. Descriptive product contract, not a selectable account model for tenants.
#### `KeeperRunAs.metadata.elevationStage`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | first |
| **Location** | Plugins/KeeperRunAs.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Marks first stage of two-stage elevation. Hard-wired stage identity. Changing it does not re-architect elevation; it only confuses diagnostics.
#### `KeeperRunAs.metadata.launches`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | KeeperRunElevated |
| **Location** | Plugins/KeeperRunAs.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Downstream elevated executable name. ; wrong target breaks all Windows elevations.
#### `KeeperRunElevated.metadata.apiEndpoints`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | elevation API paths |
| **Location** | Plugins/KeeperRunElevated.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Documents local elevation API routes. Reference metadata; routes are compiled into the product.
#### `KeeperRunElevated.metadata.elevationProxy`
| Property | Value |
| ---------------------- | ------------------------------ |
| **Type** | boolean |
| **Default** | true |
| **Location** | Plugins/KeeperRunElevated.json |
| **Appropriate values** | `true` or `false` |
Marks elevation proxy role. Controls the $key configuration value (default: true). Changing it affects agent behavior according to the setting type (boolean).
#### `KeeperRunElevated.metadata.requiresEphemeralCredentials`
| Property | Value |
| ---------------------- | ------------------------------ |
| **Type** | boolean |
| **Default** | true |
| **Location** | Plugins/KeeperRunElevated.json |
| **Appropriate values** | `true` or `false` |
Requires ephemeral admin creds. Product security invariant, not a toggle (disabling would be unsupported).
### Host Service and Networking
These options live primarily in `appsettings.json` next to the agent service executable and apply to the whole service.
#### `AllowedHosts`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | `*` |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
ASP.NET Core AllowedHosts header filter. Host-filter bootstrap for Kestrel. Changing it without understanding reverse-proxy/header behavior breaks the local API; Incorrect Host header filtering can make the local management API unreachable.
#### `JobStore:StorePath`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string (path) |
| **Default** | "" (data dir) |
| **Location** | appsettings |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Override path for persisted job store. Persisted job state can outgrow the default data dir; deployments may need an override for large fleets/storage policies.
#### `Messaging:MalformedJsonRepair:EscapeMap`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | Unicode control escapes |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Map of control characters to JSON escapes for MQTT payload repair. This map is used by the MQTT JSON repair path. Incorrect escape mappings can corrupt event payloads during repair.
#### `Messaging:MalformedJsonRepair:UnmappedControlCharacterFormat`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | `\u{X4}` |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Format string for unmapped control chars during JSON repair. Controls the $key configuration value (default: `\u{X4}`). Changing it affects agent behavior according to the setting type (string).
#### `MqttBrokerSettings:IpAddress`
| Property | Value |
| ---------------------- | -------------------------------------------------------------- |
| **Type** | string |
| **Default** | 127.0.0.1 |
| **Location** | appsettings |
| **Appropriate values** | `127.0.0.1` or `localhost` (must remain loopback for security) |
Embedded MQTT broker bind address (must stay localhost). Must remain loopback for isolation; surfacing it lets admins audit/bind policy and reject non-localhost drift.
#### `MqttBrokerSettings:Port`
| Property | Value |
| ---------------------- | ---------------------------------------- |
| **Type** | integer |
| **Default** | 8675 |
| **Location** | appsettings |
| **Appropriate values** | 1024-65535; must be free on the endpoint |
Embedded MQTT broker port. Broker port collisions break all plugins; admins need to reassign 8675 without reinstalling the agent.
#### `Settings:KestrelHttpPort`
| Property | Value |
| ---------------------- | ---------------------------------------- |
| **Type** | integer |
| **Default** | 6988 |
| **Location** | appsettings |
| **Appropriate values** | 1024-65535; must be free on the endpoint |
Local HTTP port for the agent management API (loopback). Plugins, jobs, and local tools call this endpoint. Change it when the default port conflicts with other software on the endpoint. A service restart is required after changing the port.
#### `Settings:KestrelHttpsPort`
| Property | Value |
| ---------------------- | ---------------------------------------- |
| **Type** | integer |
| **Default** | 6989 |
| **Location** | appsettings |
| **Appropriate values** | 1024-65535; must be free on the endpoint |
Local HTTPS port for the agent management API (loopback). Prefer HTTPS for sensitive local operations. Plugins and jobs use this port to call the agent. Change it when 6989 is unavailable or blocked. A service restart is required after changing the port.
#### `Settings:PluginPath`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | Plugins |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Plugin manifest directory. Non-default plugin layouts (side-by-side builds, golden images) require an admin-visible path override.
#### `Settings:RepositoryPath`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | KeeperStorage |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Encrypted local repository root. Storage relocation is needed for custom data volumes, disk quotas, or separating encrypted state from Program Files.
#### `Settings:ScriptsPath`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string (path) |
| **Default** | Jobs/Scripts |
| **Location** | appsettings |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Job script assets directory ({ScriptsPath}). Job scripts are referenced as {ScriptsPath}; ops teams relocate them for least-privilege ACLs or content sync.
#### `Settings:ServiceName`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | KeeperPrivilegeManager |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Windows service / process display name. Some enterprises require a branded or environment-specific Windows service name for SCM inventories and change control.
#### `Settings:SharedRepositoryPath`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | SharedRepository |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Shared cross-plugin storage root. Cross-plugin shared state (e.g. AgenticIntel) may need a tenant-chosen volume for backup and capacity planning.
#### `Settings:system.logging.level`
| Property | Value |
| ---------------------- | --------------------------------------------------------------- |
| **Type** | string |
| **Default** | Warning |
| **Location** | appsettings |
| **Appropriate values** | `Critical`, `Error`, `Warning`, `Information`, `Debug`, `Trace` |
Main service log level shorthand. Primary troubleshooting lever; support escalations need Debug across endpoints without RDP to each endpoint.
### Inventory Scan
#### `InventoryFull.EnableExecutableOnlyScanning`
| Property | Value |
| ---------------------- | ------------------------------------ |
| **Type** | boolean |
| **Default** | true |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | `true` or `false` |
Limit scan to executable/package types. Focuses inventory on runnable content for agentic/vuln value vs whole-disk crawl cost.
#### `InventoryFull.EnableHashCaching`
| Property | Value |
| ---------------------- | ------------------------------------ |
| **Type** | boolean |
| **Default** | true |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | `true` or `false` |
Cache file hashes between runs. Speeds incremental-ish full runs; disable when hash correctness must be forced.
#### `InventoryFull.ExcludeDevelopmentDirectories`
| Property | Value |
| ---------------------- | ------------------------------------ |
| **Type** | boolean |
| **Default** | false |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | `true` or `false` |
Exclude development tool directories. Dev workstations generate huge trees; excluding them keeps fleet scans tractable.
#### `InventoryFull.ExcludePaths`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | array / object |
| **Default** | cross-platform list |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | JSON array or object matching the documented schema |
Paths excluded from full inventory scan. Skipping WinSxS/node\_modules/etc. is required to finish scans and avoid false inventory bloat.
#### `InventoryFull.ExcludeUserSpecificDirectories`
| Property | Value |
| ---------------------- | ------------------------------------ |
| **Type** | boolean |
| **Default** | false |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | `true` or `false` |
Exclude per-user directories from scan. Privacy/perf option to skip user profiles on shared kiosks or when inventory is machine-scoped.
#### `InventoryFull.ExcludeVirtualizationDirectories`
| Property | Value |
| ---------------------- | ------------------------------------ |
| **Type** | boolean |
| **Default** | true |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | `true` or `false` |
Exclude VM/container directories. Containers/VM images explode scan time; default exclude is a capacity control.
#### `InventoryFull.HashCacheValidityDays`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 7 |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Hash cache validity window. Staleness window for cached hashes vs rescan cost. Controls the $key configuration value (default: 7). Changing it affects agent behavior according to the setting type (integer).
#### `InventoryFull.MaxConcurrentFiles`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 3 |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Parallel file-processing limit. Parallelism knob for SSD vs spinning disk / AV-contention hosts.
#### `InventoryFull.MaxDirectoryDepth`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 20 |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Maximum directory recursion depth. Stops pathological deep trees from hanging the job.
#### `InventoryFull.MaxFileSizeBytes`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 500000000 |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Skip files larger than this size. Skips huge blobs that burn hash time without security value.
#### `InventoryFull.MaxMemoryUsageBytes`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 268435456 |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Memory budget for inventory process. Keeps inventory from OOM-killing thin VDI agents.
#### `InventoryFull.MinDaysBetweenRuns`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 3 |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Minimum days between full inventory scans. Full scans are expensive; cadence must match change rate and endpoint capacity.
#### `InventoryFull.PriorityExtensions`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | exe/script/package |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
File extensions prioritized during scan. Ensures high-value extensions are scanned first when time-budgeted.
#### `InventoryFull.ThrottleDelayMs`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 25 |
| **Location** | Jobs/InventoryFullConfiguration.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Throttle delay between file ops. Inserts yield for AV-friendly scanning on contended endpoints.
### Jobs and Orchestration
Job definition JSON under `Jobs/` describes task graphs (policy controls, risk assessment, launch helpers, maintenance). Behavior is usually selected by policies and event-to-job mappings rather than by editing individual keys in isolation.
#### `JobService.metadata.category`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | Job Scheduler |
| **Location** | Plugins/JobService.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Category label. Controls the $key configuration value (default: Job Scheduler). Changing it affects agent behavior according to the setting type (string).
#### `JobService.metadata.transactionTracking`
| Property | Value |
| ---------------------- | ----------------------- |
| **Type** | boolean |
| **Default** | false |
| **Location** | Plugins/JobService.json |
| **Appropriate values** | `true` or `false` |
Track transactions in JobService. Controls the $key configuration value (default: false). Changing it affects agent behavior according to the setting type (boolean).
#### `KeeperPAM.executablePath`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string (path) |
| **Default** | `/Library/Keeper/lib/pam_keeper.so` |
| **Location** | Plugins/PamModule.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
PAM shared library path. Installer/OS layout; must not be freely edited from console.
#### `KeeperPAM.metadata.transaction.enabletracking`
| Property | Value |
| ---------------------- | ---------------------- |
| **Type** | boolean |
| **Default** | false |
| **Location** | Plugins/PamModule.json |
| **Appropriate values** | `true` or `false` |
PAM transaction tracking. Rare debug; SystemExtension equivalent is Soft/Advanced on configured—PAM duplicate not needed.
### KeeperApi and Cloud Connectivity
#### `KeeperApi.metadata.approval.useNewTypes`
| Property | Value |
| ---------------------- | ---------------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | Plugins/KeeperApi.json |
| **Appropriate values** | `true` or `false` |
Use new approval type mapping for agentic policies. Feature flag for agentic approval type mapping during rollout of new policy schemas.
#### `KeeperApi.metadata.category`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | Keeper API |
| **Location** | Plugins/KeeperApi.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Category label. Controls the $key configuration value (default: Keeper API). Changing it affects agent behavior according to the setting type (string).
#### `KeeperApi.metadata.cveCatalog.refreshHours`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 6 |
| **Location** | Plugins/KeeperApi.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
CVE catalog refresh interval (hours). How fresh CVE/app-catalog data is on endpoints; air-gapped or bandwidth-limited sites need longer intervals.
#### `KeeperApi.metadata.cveCatalog.subfolder`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | AgenticIntel |
| **Location** | Plugins/KeeperApi.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Subfolder name under data dir for CVE intel. Folder naming is product layout; refresh hours already on configured.
#### `KeeperApi.metadata.maxJustificationTextLength`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 512 |
| **Location** | Plugins/KeeperApi.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Max justification text synced with cloud. Cloud sync truncation boundary for justifications--must match ticket systems and Controls limit.
#### `KeeperApi.metadata.transactionTracking`
| Property | Value |
| ---------------------- | ---------------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | Plugins/KeeperApi.json |
| **Appropriate values** | `true` or `false` |
Track cloud transaction state for API calls. Enables cloud txn correlation for support/audit; disable only if it creates unwanted chatter.
#### `ROUTER_URL`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | (env unset) |
| **Location** | environment |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Environment override for Keeper cloud router URL. Air-gap / private Keeper router deployments must override the cloud endpoint without rebuilding the agent.
### KeeperPolicy
#### `KeeperPolicy.metadata.admin.enforce_policies_for_administrators`
| Property | Value |
| ---------------------- | ------------------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | `true` or `false` |
When true, wildcard-user policies also apply to administrators. When enabled, policies that match all users also apply to local administrators. When disabled, administrators bypass wildcard-user policies and follow OS default behavior unless a policy specifically targets them. This is a core enforcement posture setting.
#### `KeeperPolicy.metadata.agentApplicationInventory.maxAgeSeconds`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 86400 |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Stale inventory threshold for agentic/vuln gates. Stale AI/vuln inventory invalidates agentic gates; tune for offline or slow-sync endpoints.
#### `KeeperPolicy.metadata.agentApplicationInventory.path`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string |
| **Default** | `""` |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Filesystem path for AI/vuln inventory mirror. Empty = platform default / env. Path overrides are bootstrap/airgap; configured covers freshness (`maxAgeSeconds`).
#### `KeeperPolicy.metadata.agenticSnapshot.maxAgeSeconds`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 120 |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Deprecated snapshot max age. Dead with deprecated snapshot path; vuln contribution *is* on configured.
#### `KeeperPolicy.metadata.agenticSnapshot.path`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string |
| **Default** | `""` |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Deprecated telemetry snapshot path. Marked deprecated; realtime writer uses inventory mirror. Surfacing invites use of dead paths.
#### `KeeperPolicy.metadata.agenticSnapshot.vulnerabilityRiskMaxContribution`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | number |
| **Default** | 3.0 |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | Non-negative number; tune based on latency and load |
Max vulnerability risk contribution from inventory mirror. Caps how much CVE signal can drive decisions--prevents vuln noise from dominating policy scores.
#### `KeeperPolicy.metadata.eventTypeJobMapping`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | array / object |
| **Default** | product map |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | JSON array or object matching the documented schema |
EventType → control job ID mapping. Routes event types to control workflows; custom event types need remapping without code drops.
#### `KeeperPolicy.metadata.eventTypeRiskJobMapping`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | array / object |
| **Default** | product map |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | JSON array or object matching the documented schema |
EventType → risk assessment job mapping. Chooses URL vs composite risk jobs per event type--accuracy and performance are tenant-specific.
#### `KeeperPolicy.metadata.execution_grant.default_duration_minutes`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 240 |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Policy-level override for grant TTL. Policy-engine grant TTL independent of host ExecutionGrant defaults for tighter JIT control.
#### `KeeperPolicy.metadata.lookup.slowCallTimeoutSeconds`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 5 |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
macOS/Linux slow policy lookup timeout. macOS/Linux directory/FDA-slow calls hang without this; raise when directory servers are slow.
#### `KeeperPolicy.metadata.maxRetryAttempts`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 3 |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Retries for failed policy operations. Transient MQTT/API failure resilience for policy ops--reduces false denies during blips.
#### `KeeperPolicy.metadata.processCatalog.path`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string |
| **Default** | `""` |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Durable process catalog path. Empty = in-memory. Path is deployment plumbing; retention hours already on configured.
#### `KeeperPolicy.metadata.processCatalog.retentionHours`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 24 |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Cross-session process catalog retention. Cross-session AI attribution memory; longer retention helps RDP/JIT users but grows disk use.
#### `KeeperPolicy.metadata.processTreeDebug.logToEventLog`
| Property | Value |
| ---------------------- | ------------------------- |
| **Type** | boolean |
| **Default** | false |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | `true` or `false` |
High-volume PROCESS\_TREE\_DEBUG logging. Explicitly debug-only; floods Event Log. Support flag, not tenant setting.
#### `KeeperPolicy.metadata.riskscore.default_score`
| Property | Value |
| ---------------------- | ------------------------- |
| **Type** | number |
| **Default** | 5.0 |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | `allow` or `deny` |
Default risk score when assessment unavailable. Fallback risk when assessors fail; sets allow/deny bias for incomplete risk data.
#### `KeeperPolicy.metadata.riskscore.use_default_on_failure`
| Property | Value |
| ---------------------- | ------------------------- |
| **Type** | boolean |
| **Default** | false |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | `true` or `false` |
Use default score vs fail when risk job errors. Fail-open vs fail-closed when risk jobs error--security-critical behavioral switch.
#### `KeeperPolicy.metadata.storage.sharedContainers`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | PolicyRegistry, AgentApplicationInventory |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Named shared storage container defs. Storage schema for plugins. Renaming containers orphans encrypted data.
#### `KeeperPolicy.metadata.taskDelay`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 250 |
| **Location** | Plugins/KeeperPolicy.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
MQTT message loop delay (ms). MQTT loop pacing under load; advanced tuning when policy latency or CPU spikes appear.
#### `Plugins\bin\KeeperPolicy\currentPolicies.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | local policy snapshot |
| **Location** | KeeperPolicy runtime |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
On-disk policy snapshot used by enforcement. Derived from cloud/policy sync. Editing it bypasses policy governance and will be overwritten.
### Linux Agent
#### `KeeperLinuxAgent.metadata.commandLine.allowPaths`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string (path) |
| **Default** | systemd / apport paths |
| **Location** | Plugins/KeeperLinuxAgent.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Command-line allow paths (noise reduction). Controls the $key configuration value (default: systemd / apport paths). Changing it affects agent behavior according to the setting type (string (path)).
#### `KeeperLinuxAgent.metadata.fileAccess.allowPaths`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string (path) |
| **Default** | systemd / apport paths |
| **Location** | Plugins/KeeperLinuxAgent.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
File-access allow paths (noise reduction). Noise allowlist for systemd/apport paths so FileAccess policies stay usable.
#### `KeeperLinuxAgent.metadata.fileAccess.uidThreshold`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 1000 |
| **Location** | Plugins/KeeperLinuxAgent.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
UID threshold for file-access event filtering. Ignores system UIDs below threshold to cut event floods from daemons.
#### `KeeperLinuxAgent.metadata.mqttOutages.connectionFailureBehavior`
| Property | Value |
| ---------------------- | ----------------------------- |
| **Type** | string |
| **Default** | allow |
| **Location** | Plugins/KeeperLinuxAgent.json |
| **Appropriate values** | `allow` or `deny` |
allow/deny when MQTT broker is unavailable (security-critical). Fail-open vs fail-closed when broker is down--defines offline enforcement posture on Linux.
#### `KeeperLinuxAgent.metadata.policy.cache.cleanupInterval`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 30 |
| **Location** | Plugins/KeeperLinuxAgent.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Decision cache cleanup interval. Reclaims stale cache entries; tune under memory pressure.
#### `KeeperLinuxAgent.metadata.policy.cache.expireAfter`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 60 |
| **Location** | Plugins/KeeperLinuxAgent.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Decision cache TTL (seconds). Caches decisions to cut latency/load; TTL balances freshness vs performance.
#### `KeeperLinuxAgent.metadata.policy.maxResponseTimeout`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | number |
| **Default** | 5.0 |
| **Location** | Plugins/KeeperLinuxAgent.json |
| **Appropriate values** | Non-negative number; tune based on latency and load |
Max wait for policy decision (seconds). How long Linux waits for policy before applying timeout behavior; FDA/slow disks need higher values.
#### `KeeperLinuxAgent.metadata.policy.onPolicyTimeout`
| Property | Value |
| ---------------------- | ----------------------------- |
| **Type** | string |
| **Default** | allow |
| **Location** | Plugins/KeeperLinuxAgent.json |
| **Appropriate values** | `allow` or `deny` |
allow/deny when policy evaluation times out (security-critical). Timeout allow/deny decides whether hangs become silent permits--security-critical.
#### `KeeperLinuxAgent.metadata.policy.sessionInfrastructureProcesses`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | gnome-shell, plasmashell, ... |
| **Location** | Plugins/KeeperLinuxAgent.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Desktop infrastructure processes excluded from heavy policy. Desktop compositor processes that must not be over-policed or sessions break.
#### `KeeperLinuxAgent.metadata.policy.sessionShellProcesses`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | bash, sh, zsh, ... |
| **Location** | Plugins/KeeperLinuxAgent.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Shell processes treated as session infrastructure. Login shells treated as infrastructure for session modeling--customize per org shells.
#### `LinuxProtectedDirectories.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | filesystem defaults |
| **Location** | Linux PathResolution / KeeperLinuxAgent docs |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Linux fanotify/path exclusions for protected system directories. Linux-specific protected paths for fanotify noise and system integrity--distro layouts differ.
### Logging and Monitoring
#### `KeeperLogger.metadata.logFileName`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string |
| **Default** | Log/KeeperLogger.log |
| **Location** | Plugins/KeeperLogger.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Log file path. Redirects logs to approved paths (e.g. central log volume) for ACL and collection agents.
#### `KeeperLogger.metadata.loggingHttpEndpoint`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | "" |
| **Location** | Plugins/KeeperLogger.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Remote HTTP log sink URL. Target URL for remote log sink when HTTP forwarding is enabled.
#### `KeeperLogger.metadata.logRetentionDays`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 15 |
| **Location** | Plugins/KeeperLogger.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Days to keep rotated logs. Retention must match legal hold / SIEM ingest SLAs. Controls the $key configuration value (default: 15). Changing it affects agent behavior according to the setting type (integer).
#### `KeeperLogger.metadata.logToFile`
| Property | Value |
| ---------------------- | ------------------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | Plugins/KeeperLogger.json |
| **Appropriate values** | `true` or `false` |
Write aggregated logs to disk. Disk logging is required for offline forensics; some locked-down images forbid it and need console control.
#### `KeeperLogger.metadata.logToHttpEndpoint`
| Property | Value |
| ---------------------- | ------------------------- |
| **Type** | boolean |
| **Default** | false |
| **Location** | Plugins/KeeperLogger.json |
| **Appropriate values** | `true` or `false` |
Forward logs to an HTTP sink. Enables shipping logs to a tenant HTTP collector without a separate forwarder.
#### `KeeperLogger.metadata.maxFileSizeMB`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 100 |
| **Location** | Plugins/KeeperLogger.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Log rotation size (MB). Rotation size affects disk usage and how much history survives before wrap.
#### `KeeperLogger.metadata.taskDelay`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 250 |
| **Location** | Plugins/KeeperLogger.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
MQTT loop delay (ms). Micro-tuning; changing this across many endpoints risks message backlog without clear tenant benefit.
#### `KeeperSystemLogging:DebugFilteredMessages`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | false |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Verbose diagnostics for filtered system-log messages. Shows what the system logger dropped--needed when validating SIEM filter tuning.
#### `KeeperSystemLogging:EnableInfoFallback`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Fallback Info logging when KeeperLogger is down. Keeps critical Info events when KeeperLogger is down--availability of audit breadcrumbs during outages.
#### `KeeperSystemLogging:MinimumSystemLogLevel`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | Information |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Floor for OS system-log entries. Filters OS-log volume vs security-event fidelity for SIEM cost and noise.
#### `KeeperSystemLogging:PluginCheckIntervalMinutes`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 5 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
How often Logger plugin health is verified. How often Logger health is verified; HA teams lower this to detect silent log loss faster.
#### `KeeperSystemLogging:SystemLoggingEnabled`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Master switch for OS event-log / syslog output. Toggles Windows Event Log / syslog emission required by many SIEM/compliance pipelines.
#### `Logging:LogLevel:Default`
| Property | Value |
| ---------------------- | --------------------------------------------------------------- |
| **Type** | string |
| **Default** | Information |
| **Location** | appsettings |
| **Appropriate values** | `Critical`, `Error`, `Warning`, `Information`, `Debug`, `Trace` |
ASP.NET framework default log level. ASP.NET host verbosity; useful when Kestrel/auth middleware issues must be captured.
#### `Logging:LogLevel:Microsoft`
| Property | Value |
| ---------------------- | --------------------------------------------------------------- |
| **Type** | string |
| **Default** | Information |
| **Location** | appsettings |
| **Appropriate values** | `Critical`, `Error`, `Warning`, `Information`, `Debug`, `Trace` |
ASP.NET Microsoft.\* category log level. Framework noise knob; configured already exposes Default / service logging. Category-level ASP.NET tuning is support/debug only.
#### `Logging:LogLevel:Microsoft.AspNetCore.Server.Kestrel`
| Property | Value |
| ---------------------- | --------------------------------------------------------------- |
| **Type** | string |
| **Default** | Information |
| **Location** | appsettings |
| **Appropriate values** | `Critical`, `Error`, `Warning`, `Information`, `Debug`, `Trace` |
Kestrel category log level. Controls the $key configuration value (default: Information). Changing it affects agent behavior according to the setting type (string).
#### `Logging:LogLevel:Microsoft.Hosting.Lifetime`
| Property | Value |
| ---------------------- | --------------------------------------------------------------- |
| **Type** | string |
| **Default** | Information |
| **Location** | appsettings |
| **Appropriate values** | `Critical`, `Error`, `Warning`, `Information`, `Debug`, `Trace` |
Hosting lifetime category log level. Startup/shutdown framework logs; not a tenant control plane setting.
#### `Logging:LogLevel:System`
| Property | Value |
| ---------------------- | --------------------------------------------------------------- |
| **Type** | string |
| **Default** | Information |
| **Location** | appsettings |
| **Appropriate values** | `Critical`, `Error`, `Warning`, `Information`, `Debug`, `Trace` |
System.\* framework log level. Framework category; overlaps with KeeperSystemLogging / KeeperLogger already on configured.
#### `PluginMonitoring:CheckIntervalMinutes`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | number |
| **Default** | 0.5 |
| **Location** | appsettings |
| **Appropriate values** | Non-negative number; tune based on latency and load |
Plugin process health-check cadence. Controls auto-restart responsiveness for crashed plugins--availability vs CPU tradeoff.
#### `PluginMonitoring:Enabled`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Documented master switch for plugin monitoring. Code/docs note monitoring effectively always runs; exposing a no-op (or misleading) switch can be misleading if monitoring is always active regardless of the value.
#### `PluginMonitoring:LogHealthChecks`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | false |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Log every plugin health-check result. Enables verbose health spam for short-lived diagnosis of restart loops.
### macOS System Extension
#### `SystemExtension.metadata.commandLine.allowPaths`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string (path) |
| **Default** | /Library/Keeper, sudo |
| **Location** | Plugins/SystemExtension.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Command-line allow paths. Allowlists expected cmdline monitors (e.g. sudo/Keeper) to avoid alert fatigue.
#### `SystemExtension.metadata.fileAccess.allowPaths`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string |
| **Default** | system + Keeper paths |
| **Location** | Plugins/SystemExtension.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
File-access allow paths. Reduces macOS FileAccess noise from system frameworks while keeping real apps evaluated.
#### `SystemExtension.metadata.mqttOutages.connectionFailureBehavior`
| Property | Value |
| ---------------------- | ---------------------------- |
| **Type** | string |
| **Default** | allow |
| **Location** | Plugins/SystemExtension.json |
| **Appropriate values** | `allow` or `deny` |
allow/deny when MQTT broker is unavailable (security-critical). macOS fail-open/closed when MQTT is down--defines offline Endpoint Security posture.
#### `SystemExtension.metadata.policy.cache.expireAfter`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 60 |
| **Location** | Plugins/SystemExtension.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Decision cache TTL (seconds). macOS decision cache TTL for ES performance vs freshness.
#### `SystemExtension.metadata.policy.highLoad.fallbackAllowPaths`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string (path) |
| **Default** | system + /Library/Keeper |
| **Location** | Plugins/SystemExtension.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Paths allowed under high-load fallback. Which paths keep working under load fallback--must include system+Keeper or logon breaks.
#### `SystemExtension.metadata.policy.highLoad.inflightThreshold`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 200 |
| **Location** | Plugins/SystemExtension.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
In-flight events before high-load fallback. Tripwire before high-load fallback; protects UI freezes under event storms.
#### `SystemExtension.metadata.policy.maxResponseTimeout`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | number |
| **Default** | 5.0 |
| **Location** | Plugins/SystemExtension.json |
| **Appropriate values** | Non-negative number; tune based on latency and load |
Max wait for policy decision (seconds). Wait budget before timeout behavior; FDA-denied lookups need longer timeouts.
#### `SystemExtension.metadata.policy.onPolicyTimeout`
| Property | Value |
| ---------------------- | ---------------------------- |
| **Type** | string |
| **Default** | allow |
| **Location** | Plugins/SystemExtension.json |
| **Appropriate values** | `allow` or `deny` |
allow/deny when policy evaluation times out (security-critical). Timeout allow/deny for macOS ES events; wrong default creates silent permits or freezes.
#### `SystemExtension.metadata.privilegeElevation.allowPaths`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string |
| **Default** | loginwindow, Keeper, ... |
| **Location** | Plugins/SystemExtension.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Privilege-elevation allow paths. Lets loginwindow/authtrampoline elevate without false policy hits during logon.
#### `SystemExtension.metadata.transaction.enabletracking`
| Property | Value |
| ---------------------- | ---------------------------- |
| **Type** | boolean |
| **Default** | false |
| **Location** | Plugins/SystemExtension.json |
| **Appropriate values** | `true` or `false` |
Enable transaction tracking in System Extension. Optional txn correlation for macOS ES debugging/audit pipelines.
### MFA, Justification, and Execution Grants
#### `Controls:maxJustificationTextLength`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 512 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Max characters in justification control text. Caps justification payload size for UI and cloud sync; prevents abuse and aligns with ticket-field limits.
#### `ExecutionGrant:DefaultDurationMinutes`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 240 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Default execution grant lifetime (minutes). Default JIT grant lifetime for approved elevations; too long widens exposure, too short floods re-approvals.
#### `ExecutionGrant:MaxDurationMinutes`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 10080 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Maximum execution grant lifetime (7 days). Hard ceiling so policies/plugins cannot issue week-plus grants that violate least-privilege standards.
#### `MfaGracePeriod:GracePeriodMinutes`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 5 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Skip MFA re-prompt window after success. Controls re-prompt friction after successful MFA; productivity vs session-hijack risk is a tenant tradeoff.
#### `MfaLockout:LockoutDurationMinutes`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 15 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
MFA lockout duration after max failures. Balances lockout pain vs attacker retry windows; helpdesk and security teams typically set duration to balance lockout friction and attacker retry windows.
#### `MfaLockout:MaxFailedAttempts`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 5 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Failed MFA attempts before lockout. Directly sets brute-force resistance for MFA controls; security policy must tune attempts per compliance posture.
### MQTT Topics and Messaging Topology
Topic names and allowlists that connect the host, plugins, and jobs over the local MQTT broker. Values must stay consistent across components.
#### `*.metadata.mqttRole`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | subscriber/publisher |
| **Location** | Plugins/\*.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Declares plugin MQTT roles. Loader/auth topology metadata; It describes messaging roles used by the loader and authentication path.
#### `MqttJobPublishSettings:PublishMqtt:AllowedTopics`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | array / object |
| **Default** | product wildcards |
| **Location** | appsettings |
| **Appropriate values** | JSON array or object matching the documented schema |
Global allowlist of topics jobs may publish to. Security-critical product fence for job processes. Incorrect edits can open `#` publishes or brick job status. Keep aligned with the product topic contract so jobs and plugins can communicate.
#### `MqttTopics:AuditTopic`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | AuditMessage |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Logical audit topic name. Renaming breaks every publisher/subscriber that hard-expects `AuditMessage`.
#### `MqttTopics:publish`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | array / object |
| **Default** | product topic list |
| **Location** | appsettings |
| **Appropriate values** | JSON array or object matching the documented schema |
Host MQTT client publish allowlist. Product pub/sub contract. Tenant edits desync plugins from the broker ACL and drop audit/policy traffic.
#### `MqttTopics:subscribe`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | array / object |
| **Default** | product topic list |
| **Location** | appsettings |
| **Appropriate values** | JSON array or object matching the documented schema |
Host MQTT client subscribe allowlist. Controls the $key configuration value (default: product topic list). Changing it affects agent behavior according to the setting type (array / object).
### Other Plugins
#### `arguments`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | `""` |
| **Location** | Plugins/\*.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Command-line args passed to plugin exe. Product launch contract; free-form args can disable security flags or break AOT hosts.
#### `KeeperUSession.metadata.taskDelay`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 250 |
| **Location** | Plugins/KeeperUSession.json |
| **Appropriate values** | Positive integer, or the documented range for this setting |
USession MQTT loop delay. Controls the $key configuration value (default: 250). Changing it affects agent behavior according to the setting type (integer).
### Path Protection
#### `{Platform}ProtectedDirectories.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | OS defaults |
| **Location** | PathResolution platform defaults |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Platform default protected directories seeded by PathConfigurationService. Baseline OS protected directories; hardening teams review/extend defaults per platform.
#### `LeastPrivilegeExclusions`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | (policy/storage) |
| **Location** | Policy registry + Settings API |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Accounts excluded from least-privilege enforcement. Break-glass accounts that must keep admin rights; when unchanged, LPE strands IT admins.
#### `PolicyProtectedDirectories.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | (from ProtectedPaths) |
| **Location** | PathResolution / PolicyProtectedDirectories.json |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Protected directories written from ProtectedPaths policies (merged with platform defaults). Materialized output of ProtectedPaths policies; ops need visibility/export of what the agent is enforcing.
#### `ProtectedPaths (policy type)`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string |
| **Default** | (policy-driven) |
| **Location** | Policy / PolicyUpdateService |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Keeper configuration policy type: paths that must not be modified by conflicting FileAccess policies. Policy type that hardens paths against conflicting FileAccess grants--primary admin protection UX.
#### `UserProtectedDirectories.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | (optional overlay) |
| **Location** | PathResolution / UserProtectedDirectories.json |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Admin/local overlay of wildcard FileAccess protected directories under PathResolution storage. Local/admin overlay for protected dirs beyond platform defaults--site-specific sensitive trees.
### Path Variables
#### `Custom path variables (arbitrary name->value)`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string |
| **Default** | (none) |
| **Location** | PathVariables API |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Admin-defined path placeholders via /api/PathVariables (built-ins are read-only). Lets policies/jobs use org path aliases ({CorpApps}) without hardcoding drive letters per site.
### Plugin Manifest Fields
Common fields on every file under `Plugins/*.json`. They describe how the agent loads and starts the plugin process.
#### `autoRestart`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true/false |
| **Location** | Plugins/\*.json |
| **Appropriate values** | `true` or `false` |
Restart on unexpected exit. Controls the $key configuration value (default: true/false). Changing it affects agent behavior according to the setting type (boolean).
#### `autoStart`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true/false |
| **Location** | Plugins/\*.json |
| **Appropriate values** | `true` or `false` |
Whether host launches plugin at startup. Some plugins must stay on-demand (elevation). Flipping autoStart from console breaks elevation or burns sessions.
#### `debugExecutablePath`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string |
| **Default** | repo-relative Debug path |
| **Location** | Plugins/\*.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Visual Studio / debug build path. Intended for development builds. Meaningless (and dangerous) on production endpoints.
#### `executablePath`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string (path) |
| **Default** | `bin/...` |
| **Location** | Plugins/\*.json |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
Release executable path under install root. Path is fixed by installer layout. Tenant edits → plugin fails to start after upgrades.
#### `executionContext`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | Service / User |
| **Location** | Plugins/\*.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Account context for the process. Security boundary (SYSTEM vs user). should be changed only with a coordinated product or deployment change.
#### `id`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | plugin id |
| **Location** | Plugins/\*.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Stable plugin identifier. Must match process/API keys; renaming orphans storage and MQTT. Display name belongs in product packaging, not tenant edit.
#### `modifiedAt`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | ISO timestamp |
| **Location** | Plugins/\*.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Last metadata change stamp. Controls the $key configuration value (default: ISO timestamp). Changing it affects agent behavior according to the setting type (string).
#### `pluginType`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | Executable / Service / … |
| **Location** | Plugins/\*.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
How the loader starts the plugin. Wrong type prevents start or mis-classifies libraries as services.
#### `requiresMonitoring`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true/false |
| **Location** | Plugins/\*.json |
| **Appropriate values** | `true` or `false` |
Include in plugin health monitoring. Coupled to Watchdog/PluginMonitoring design; configured already covers monitoring cadence.
#### `startupPriority`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | numeric |
| **Location** | Plugins/\*.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Lower starts earlier. Ordering is carefully chosen for broker/API dependencies. Tenant reordering causes racey boots.
#### `supportedPlatforms`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | array / object |
| **Default** | OS list |
| **Location** | Plugins/\*.json |
| **Appropriate values** | JSON array or object matching the documented schema |
Platforms this plugin may run on. Filtering is build/installer concern. Console toggles won’t add missing binaries for other OS.
### Redirect Evaluator
#### `RedirectEvaluator.metadata.redirect.enabled`
| Property | Value |
| ---------------------- | ------------------------------ |
| **Type** | boolean |
| **Default** | true |
| **Location** | Plugins/RedirectEvaluator.json |
| **Appropriate values** | `true` or `false` |
Enable launch redirects during privilege elevation. Master switch for launch redirects (e.g. ncpa→NetworkConnections); security feature tenants enable/disable.
#### `RedirectEvaluator.metadata.redirect.rules`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | array / object |
| **Default** | ncpa, Notepad, Terminal, MSI... |
| **Location** | Plugins/RedirectEvaluator.json |
| **Appropriate values** | JSON array or object matching the documented schema |
Redirect rules (sourceExePattern, commandLinePattern, targetExe, ...). Maps elevation requests to safer substitutes--core customization for org-specific tools and installers.
#### `RedirectEvaluator.metadata.redirect.rulesPath`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | (optional) |
| **Location** | Plugins/RedirectEvaluator.json |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Optional external file for redirect rules. Lets large rule sets live in a managed file synced by config management.
### Runtime Files and Localization
#### `Jobs\locale-cache-cleanup.json`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | cleanup job |
| **Location** | Jobs/locale-cache-cleanup.json |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Clears locale caches. Maintenance job graph—see Job workflow section. Controls the $key configuration value (default: cleanup job). Changing it affects agent behavior according to the setting type (file / content).
### Security, Certificates, and Trust
#### `ConfigurationLkg:Enabled`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Last-known-good reconciliation for policy-written config. Turns last-known-good config recovery on/off--critical after bad SettingsUpdate pushes so fleets can self-heal.
#### `Plugins:JobService:AgentInactiveJobAllowlist`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | registration, StartKeeperClient, ... |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Jobs allowed to run when agent is inactive. Limits which jobs run without an interactive session; misuse can launch user UI jobs headlessly--security-sensitive allowlist.
#### `Settings:AllowedNonAdminExecutables`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | array / object |
| **Default** | product UI list |
| **Location** | appsettings |
| **Appropriate values** | JSON array or object matching the documented schema |
Binaries allowed without admin in user context. Controls which Keeper UI helpers may run unelevated; tightening/loosening this is a security policy decision per estate.
#### `Settings:AlternativeSignatures`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | array / object |
| **Default** | \[] |
| **Location** | appsettings |
| **Appropriate values** | JSON array or object matching the documented schema |
Extra trusted code-signing thumbprints for plugins. Partners and internal builds sign plugins with non-Keeper certs; without this list those plugins are rejected at load.
#### `Settings:CertName`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | "" |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Certificate subject/name in store. Subject/name lookup for store-based TLS; required whenever CertStore is used in corporate PKI deployments.
#### `Settings:CertPassword`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | "" |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
TLS certificate password (secret store, not plaintext). Companion secret for file-based TLS certs; should be stored and rotated as a secret, never left as cleartext ops debt.
#### `Settings:CertPath`
| Property | Value |
| ---------------------- | ------------------------------------------------------ |
| **Type** | string |
| **Default** | "" |
| **Location** | appsettings |
| **Appropriate values** | Valid path; may use path variables such as `{approot}` |
TLS certificate file path (mask as secret). Custom TLS for the local API needs enterprise PKI paths--should be managed centrally rather than edited per machine.
#### `Settings:CertStore`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | "" |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Windows certificate store name. Enterprises using Windows cert stores (not files) need this selector to attach the correct store for local HTTPS.
#### `Settings:CriticalSystemDirectories`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | OS critical dirs |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Directories protected from elevation/redirect tampering. Blocks grants that target OS-critical trees; regulated environments require visible, adjustable denylists.
#### `Settings:CriticalSystemFiles`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | OS critical exes |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Files protected from elevation/redirect tampering. Defines OS binaries elevation/redirect must never rewrite; security teams may extend for custom protected tools.
#### `Settings:MaintainKeeperAccount`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | false |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Persist KeeperUserSession across restarts (Windows hybrid AAD + Intune). Hybrid AAD+Intune endpoints fail elevation after reboot unless the KeeperUserSession account is retained--tenant policy must choose this.
### Session Monitoring and Watchdog
#### `SessionEventDispatcher:StartKeeperClientCoalesceSeconds`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 12 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Debounce rapid session events before starting client. Debounces bursty logon events that would otherwise spawn duplicate KeeperClient processes.
#### `SessionMonitoring:Enabled`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Enable user-session polling. Master switch for detecting logons/sessions that start KeeperClient--disabling breaks tray UX and session-aware jobs.
#### `SessionMonitoring:ExcludedUsers`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | SYSTEM, LOCAL SERVICE, ... |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Accounts excluded from session handling. Stops session handling for service accounts; incorrect lists spam SYSTEM sessions or miss real users.
#### `SessionMonitoring:LinuxDesktopProcesses`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | gnome-shell, kwin, ... |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
Linux processes that indicate interactive desktop. Desktop-session heuristics differ by distro/DE; wrong lists leave Linux users without KeeperClient.
#### `SessionMonitoring:MacOSDesktopProcesses`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------- |
| **Type** | string |
| **Default** | Dock, Finder, WindowServer |
| **Location** | appsettings |
| **Appropriate values** | Value consistent with the default format; validate on a pilot endpoint before fleet rollout |
macOS processes that indicate interactive desktop. macOS session detection depends on Dock/Finder/WindowServer signals--customize for atypical environments.
#### `SessionMonitoring:PollingIntervalSeconds`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 5 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
How often active sessions are scanned. CPU vs session-detection latency knob for VDI/dense hosts where 5s polling is too aggressive.
#### `SessionMonitoring:StartKeeperClientOnLogin`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Launch KeeperClient when user logs in. Determines whether users get the agent UI at logon; required for request/approval workflows to be reachable.
#### `SessionMonitoring:StartKeeperClientOnReconnect`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Relaunch KeeperClient on session reconnect. RDP/reconnect scenarios drop the tray client unless this relaunch path is enabled--ops must control it.
#### `Watchdog:AutoRemediate`
| Property | Value |
| ---------------------- | ----------------- |
| **Type** | boolean |
| **Default** | true |
| **Location** | appsettings |
| **Appropriate values** | `true` or `false` |
Automatically restart unhealthy KEPM components. Chooses self-healing vs alert-only when KEPM is unhealthy--availability policy for production fleets.
#### `Watchdog:CheckIntervalSec`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 10 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Watchdog health-check interval. How fast outages are detected; shorter intervals recover faster but add host noise.
#### `Watchdog:StartupDelaySec`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 90 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Grace period after boot before remediation. Avoids false unhealthy restarts during slow boots/AV scans--must match image boot SLAs.
#### `Watchdog:UnhealthyRestartThreshold`
| Property | Value |
| ---------------------- | ---------------------------------------------------------- |
| **Type** | integer |
| **Default** | 3 |
| **Location** | appsettings |
| **Appropriate values** | Positive integer, or the documented range for this setting |
Consecutive failures before restart. Consecutive failure count before restart; prevents flapping on transient API blips.
### Windows Process Injection Lists
#### `allow.dat`
| Property | Value |
| ---------------------- | --------------------------------------------------- |
| **Type** | array / object |
| **Default** | Keeper + Windows allowlist |
| **Location** | Plugins/bin/KeeperUSession/allow\.dat (install) |
| **Appropriate values** | JSON array or object matching the documented schema |
Process allowlist beside KeeperUSession: listed apps bypass policy checks (auto-allow). Supports %BINDIR%, %WINDIR%, basename-only entries. Processes listed here skip policy evaluation (auto-allow). Include only trusted Keeper components and carefully reviewed exceptions. Incorrect entries create silent bypasses.
#### `exclude.dat`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | OS/AV/browser exclusions |
| **Location** | Plugins/bin/KeeperUSession/exclude.dat (install) |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Process/path exclusion list for injector attach: listed processes are not injected. Supports %WINDIR%, %BINDIR%, %PROGDIR%, %PROGDIRX86%, directory trailing \\. Critical for AV/EDR coexistence. Use this list to prevent injection into antivirus, EDR, browsers, and other sensitive processes. Incorrect exclusions can cause instability; missing exclusions can break coexistence with security products.
#### `noautoinject.dat`
| Property | Value |
| ---------------------- | ------------------------------------------------------------------------------------------ |
| **Type** | file / content |
| **Default** | (empty on install) |
| **Location** | Plugins/bin/KeeperUSession/noautoinject.dat (install) |
| **Appropriate values** | Valid content for the documented schema; deploy with the agent or via configuration policy |
Optional list of processes that should not be auto-injected at session start (beside allow\.dat/exclude.dat under KeeperUSession). Fine-grained opt-out of session-start injection for fragile apps without full exclude.dat denylists.
### Where to Configure
| What | Where | Notes |
| ------------------------------------------------------ | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
| Global settings (ports, paths, logging, MFA, sessions) | `appsettings.json` | Restart the agent service for port and path changes |
| Plugin behavioral settings | `Plugins/{PluginName}.json` or `PUT /api/PluginSettings/{id}/{key}` | Restart the plugin after change when it caches settings at startup |
| Inventory scan options | `Jobs/bin/InventoryFull/InventoryFullConfiguration.json` | Applied on the next inventory job run |
| Windows injector lists | `Plugins/bin/KeeperUSession/allow.dat`, `exclude.dat`, `noautoinject.dat` | Reloaded by the injector on its refresh interval |
| Agentic content | `Config/*.json`, `intel/rules/*.json`, app catalog under intel / shared storage | Deployed as agent content; refresh via KeeperApi catalog settings where applicable |
| Path variables | Path Variables API / policies | Built-in variables are read-only; custom variables are admin-defined |
| macOS registration / FDA / system extension | MDM configuration profiles | Required for reliable macOS deployment |
After editing plugin JSON on disk, use `POST /api/PluginSettings/{pluginName}/revert` (or `revert-all`) to reload from file into unified storage, then restart the plugin so it picks up the new values.
***
*Related Documentation:*
* [*Plugins & Settings*](/en/keeperpam/endpoint-privilege-manager/setup/plugins-and-settings.md)
* [*Plugin & Task Settings*](/en/keeperpam/endpoint-privilege-manager/custom-tooling/jobs-and-plugins/custom-plugin-guide/plugins-reference/plugin-and-task-settings.md)
* [*Job & Plugin Settings Keys*](/en/keeperpam/endpoint-privilege-manager/custom-tooling/jobs-and-plugins/job-and-plugin-settings-keys.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/custom-tooling/configurable-settings.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.