Technical product overview

LiveIntel Agent

A transparent, customer-controlled execution layer for phishing simulations. Run campaign delivery and identity-aware reporting inside your environment while LiveIntel coordinates anonymous campaign state.

Getting Started Inspect the Data Boundary

This page is intentionally technical. It explains where the Agent runs, which data it handles, what crosses the network boundary, and how customers can review and extend it.

liveintel-agent - deployment spec

RuntimeWindows PowerShell 5.1+ / PowerShell 7

LocationCustomer-controlled host

DeliveryCustomer-provided SMTP

IdentityHeld locally by the Agent

DependenciesNo required external PowerShell modules

LicenseMIT

System context

Cloud coordination. Local execution.

The hosted service manages campaign configuration and anonymous state. The Agent owns recipient identity, SMTP delivery, and de-anonymized reports.

LIVEINTEL CLOUD CUSTOMER ENVIRONMENT ──────────────────────── ────────────────────────────── campaign configuration ─────────────► LiveIntel Agent anonymous tokens ─────────────► anonymous events ◄───────────── token lifecycle updates tracked interactions ─────────────► local event synchronization recipients.csv token-to-recipient map SMTP credentials identifiable local reports

Data boundary

The Agent manages people. The cloud manages anonymous state.

Recipient identity is resolved locally. LiveIntel receives the minimum anonymous campaign data needed to coordinate and measure a simulation.

STAYS IN THE CUSTOMER ENVIRONMENT

Recipient names and email addresses
Customer-supplied group and department fields
The anonymous-token-to-recipient mapping
Customer SMTP credentials and local send results
Identifiable campaign reports
Customer integration code and downstream credentials

SENT TO OR OBSERVED BY LIVEINTEL

Tenant, Agent, campaign, and anonymous token identifiers
Anonymous token lifecycle events
Simulation interaction types and timestamps
Restricted, non-identifying operational metadata
No recipient list, token mapping, or SMTP credentials
No identifiable local report or LMS credential

Local report handoff

Useful outputs without uploading identity.

The Agent joins anonymous events to the local recipient mapping and writes one completed report set per campaign beneath a configurable local directory.

LiveIntel does not automatically email, upload, archive, or import these reports into an LMS or another third-party system. Customers control access, retention, transmission, and downstream processing.

reports/<campaign-id>/

recipient-results.csvIdentity-bearing local results

campaign-summary.csvAggregate campaign metrics

manifest.jsonSchema version, row counts, and SHA-256 hashes

CompletionManifest written last

Automation boundaryCustomer-controlled jobs can wait for manifest.json and validate hashes before consuming the CSV files.

Customer-managed integrationsAuthorized customer scripts can archive results, deliver reports, or initiate an existing LMS workflow.

No connector claimThe local handoff is an integration point; pre-built LMS connectors are not included today.

Local responsibilityThe customer determines permissions, retention, encryption, approved destinations, and deletion.

Designed to be inspected

Open where trust matters.

The Agent is readable PowerShell rather than a compiled executable. Its source code is intentionally open so security teams can inspect what it executes, verify what leaves their environment, scan the exact version they deploy, and validate the privacy boundary.

Before deployment or upgrade, customers are responsible for reviewing, scanning, testing, approving, configuring, and securing the Agent and any customer or third-party modifications under their own security and change-control processes.

MIT license - practical rights

UsePermitted

ModifyPermitted

DistributePermitted

AttributionPreserve copyright and license notice

Public badgeNot required

Modified-code supportOnly when separately agreed

Operational controls

Readable scripts with cautious defaults.

The reference Agent keeps its execution model small enough to inspect and operate directly.

Dry run first

Sending is off by default. Live execution requires an explicit option and confirmation unless the customer changes that safety setting.

Resumable delivery

Local state allows an interrupted run to continue with pending recipients instead of automatically sending successful deliveries twice.

Customer-held secrets

The Agent keeps the API key and SMTP password locally and supports Windows DPAPI protection for the configured Windows user.