Skip to content

Sink Types & Configuration

A Sink Type defines a category of sink agent that runs in your infrastructure. Before you can install any sink, you must first create a Sink Type. It provides the authentication credentials and configuration that agents use to connect to the Hub.


Every sink agent connects to the Hub using credentials from a Sink Type. The Sink Type also determines:

  • Which Libraries (and their code modules) are available to the agent
  • What scopes and permissions the agent has
  • Which configuration parameters are injected at runtime

Think of a Sink Type as the agent’s identity and capability profile. A Python agent uses a Python Sink Type; a PowerShell agent uses a PowerShell Sink Type.


Navigate to the Sink Types tab on the Sinks & Sources screen and click Create. You need the following information:

FieldRequiredDescription
NameYesA descriptive label for this type (e.g. REMOTE:LINUX, LOCAL:PYTHON). Choose a naming convention that distinguishes where and how agents of this type run
SystemNoWhen enabled, this Sink Type is available to all tenants. Only SuperAdmins can create or modify system-wide types
DescriptionNoFree-text notes about the purpose of this agent type
Requires AuthenticationYesDefaults to on. When enabled, agents must present valid credentials to connect
Default ScopesNoComma-separated list of OAuth-style scopes granted to agents (e.g. read,tasks.execute). Defaults to read if left empty
Host-boundNoDefaults to off. When enabled, this type’s sinks run only on the node installed for them — e.g. shell scripts executed from that node’s SCRIPTS_FOLDER. Leave off for library-based types, which can run on any of your tenant’s nodes

When you create a Sink Type, the platform automatically generates a Client ID and Client Secret. The Client Secret is displayed only once — copy and store it securely immediately.

These credentials are what you provide to the sink agent during installation:

CredentialEnvironment VariablePurpose
Client IDCLIENT_IDIdentifies which Sink Type the agent belongs to
Client SecretCLIENT_SECRETAuthenticates the agent to the Hub

If a secret is compromised or lost, open the Sink Type detail panel and click Regenerate Secret. A new secret is generated and the old one is immediately invalidated. All agents using that Sink Type must be updated with the new CLIENT_SECRET.


Config Params are key/value configuration pairs attached to a Sink Type. They are injected into sink agents at runtime and can be used to pass environment-specific settings (file paths, feature flags, timeouts) without hardcoding them.

Param TypeBehaviour
STATICA fixed value baked into the Sink Type definition
DATAA key read from the event payload at runtime
SECRETA secret key resolved from the Secrets store at runtime

Config Params are optional. Use them when you need all agents of a given type to share a configuration value.


ScopeCreatorVisible To
Tenant-scopedAny Admin in the tenantOnly that tenant
System-wideSuperAdmin onlyAll tenants

System-wide Sink Types have the System flag enabled. They are ideal for platform operators who want to provide standard agent types to all tenants. Your Sink Types list always shows the platform’s system types plus the types your tenant created — other tenants’ custom types are never visible to you.

Sink Types vs. Sinks. A Sink Type is a template; a Sink is your tenant’s instance of it (its own identity, status, and configuration). Creating a type does not create an instance — create a Sink for the type to start running workloads.

Platform sink templates are copied the same way as source templates: in the Sinks screen’s Types tab, platform templates show Make my copy. Give the copy a name — the template’s libraries & modules ride along verbatim (edit them afterwards on the type edit screen), and the copy inherits the template’s node coverage. Copies show “based on