Pulse agents & schedules¶

Pulse work is done by domain agents — autonomous investigators that scan your connected infrastructure on a schedule and write findings and recommendations. This page covers the agent catalog, scheduling, per-tenant configuration, and manual runs. For the findings lifecycle and savings model, see Pulse — findings & savings.

Pulse requires a Growth plan or higher.

The agent catalog¶

Agent	Domain	What it investigates	Default schedule
Cost Optimization Agent	FinOps	Cloud spend, waste, right-sizing, commitment savings	daily
Architecture Cost Advisor	FinOps	Reserved capacity coverage, data-transfer costs, storage tiering, networking cost patterns	daily
Compliance & Posture Agent	Security	Configuration audits against CIS, SOC2, PCI-DSS, HIPAA, and organizational policies	daily
Threat Detection Agent	Security	Active threats, suspicious activity, and anomalous behavior in your security telemetry	daily
Vulnerability & Exposure Agent	Security	Exposed services, vulnerable configurations, missing patches, attack surface	daily
Infrastructure Topology Mapper	Topology	Discovers resources and their relationships to build your infrastructure graph	daily

How it works¶

Each run executes one agent for your tenant. The agent queries your integrations read-only, then writes findings, recommendations, and its investigation trail. Every run records its trigger: scheduled, manual, or reinvestigate.
Scheduled runs fire on each agent's effective schedule: your override if you set one, otherwise the agent's default. Supported schedules are hourly, daily, and weekly.
A reconciler backstops the schedule: if a scheduled run was missed, it is dispatched as soon as it is detected overdue, and a new run is never started while one is already running. Runs that exceed 60 minutes are marked failed automatically.
New agents added to the catalog are enabled for your tenant automatically with their default schedule. Disable any you don't want.
Alongside your configured agents, a platform-run Reinvestigation Sweep re-verifies stale findings (no fresh sighting for 14 days) — individually for the highest-impact items, in batches for the tail. Its runs appear in run history as "Reinvestigation Sweep" / "Reinvestigation Sweep (batch)". It isn't tenant-configurable, runs only for tenants with at least one enabled Pulse agent, and never resolves a finding without positive evidence.

Using it¶

Web — the Pulse dashboard lists your agents and recent runs (agent, trigger, status, findings count, duration). Enable/disable agents, change schedules, and trigger runs from there.
API —

Endpoint	Purpose
`GET /api/pulse/agents`	List the agent catalog
`GET /api/pulse/tenant/agents`	Your per-agent settings (enabled + schedule)
`PUT /api/pulse/tenant/agents/{agent_key}`	Enable/disable an agent or override its schedule
`POST /api/pulse/agents/run`	Trigger a run now — body `{"agent_key": "..."}`
`GET /api/pulse/agents/runs/{run_id}/status`	Poll a run: status, findings count, duration, summary
`GET /api/pulse/agent-runs`	Recent run history (most recent 20)
`POST /api/pulse/findings/{finding_id}/reinvestigate`	Re-check a single finding

Manual runs return {"run_id", "status": "running"} immediately; poll the run status endpoint until completed or failed.
Reinvestigation dispatches a targeted run against one finding: the agent checks the current state of the affected resource, updates severity or description, and can mark the issue resolved — resolution requires positive evidence, which is recorded on the finding. You are notified when it completes. See Evidence & audit.
CLI — dxdt pulse findings and dxdt pulse overview read the results; see the CLI reference.

Configuration¶

PUT /api/pulse/tenant/agents/{agent_key} accepts:

Field	Type	Default	Notes
`is_enabled`	boolean	`true`	Disabled agents never run on schedule
`schedule`	string or null	`null`	`hourly`, `daily`, or `weekly`; `null` reverts to the agent's default

Settings are per tenant and per agent. Findings already written are not affected by disabling an agent.

Troubleshooting¶

Symptom	Cause / fix
`402 tier_restricted` on Pulse pages	Your plan does not include Pulse (Growth+).
Manual run returns `tier_blocked`	Same tier gate, enforced at dispatch.
`400 agent_key required`	`POST /api/pulse/agents/run` needs `agent_key` in the body.
Run shows `failed` with a timeout summary	The run exceeded 60 minutes and was cleaned up; trigger it again.
An agent never runs on schedule	Check `GET /api/pulse/tenant/agents` — it may be disabled, or its schedule override may not be one of `hourly`/`daily`/`weekly`.