Configurable Settings

Configuration Options Reference

Audience: IT administrators and integrators who need a complete reference for Keeper Endpoint Privilege Manager (KEPM) configuration options on the agent.

This page documents configuration settings used by the Keeper EPM agent. Settings may live in appsettings.json next to the agent service, in plugin JSON under Plugins/, in job or inventory configuration files, in content files under Config/ or intel/, in Windows injector .dat lists, or in MDM profiles. At runtime, unified storage can override on-disk plugin settings until reverted.

For each setting this page provides the data type, default value, a detailed description of behavior and operational impact, appropriate values, and the configuration location.

How Settings Are Applied

• Global settings - Values under appsettings.json (and related host sections) apply to the whole agent service. Port and path changes typically require a service restart.
• Plugin settings - Each plugin has a JSON file under Plugins/ (for example Plugins/KeeperPolicy.json). Behavioral options usually appear under metadata. Read or update them with the Plugin Settings API (GET / PUT /api/PluginSettings/{pluginName}/...). After editing a file on disk, use POST /api/PluginSettings/{pluginName}/revert (or revert-all) so unified storage matches the file, then restart the plugin if needed.
• SettingsUpdate policy - A configuration policy can push plugin or appsettings.json changes to endpoints. The Configuration Policy Processor applies them.
• Content and list files - Agentic intel rules, basename lists, inventory scan options, and Windows allow.dat / exclude.dat files are deployed with the agent or updated as content. Treat them as structured configuration, not free-form text.
• MDM (macOS) - Registration code, Full Disk Access, and system-extension allowlisting are delivered with configuration profiles during deployment.

For narrative guidance, see Plugins & Settings and Plugin & Task Settings. For local API details, see the HTTP Reference.

Contents

• Agentic AI and Risk Content (11)
• Boot and Performance (6)
• Client and Agent UI (16)
• Deployment and MDM (3)
• Elevation Chain (RunAs / RunElevated) (6)
• Host Service and Networking (14)
• Inventory Scan (14)
• Jobs and Orchestration (4)
• KeeperApi and Cloud Connectivity (8)
• KeeperPolicy (19)
• Linux Agent (11)
• Logging and Monitoring (20)
• macOS System Extension (10)
• MFA, Justification, and Execution Grants (6)
• MQTT Topics and Messaging Topology (5)
• Other Plugins (2)
• Path Protection (5)
• Path Variables (1)
• Plugin Manifest Fields (11)
• Redirect Evaluator (3)
• Runtime Files and Localization (1)
• Security, Certificates, and Trust (11)
• Session Monitoring and Watchdog (12)
• Windows Process Injection Lists (3)

Total settings in this reference: 201

Agentic AI and Risk Content

Files under Config/ and Plugins/bin/KeeperAgenticSnapshotWriter/intel/ (and mirrored copies beside inventory binaries) drive AI likelihood, vulnerability, and risk-behavior scoring.

AgenticChainIntermediaryBasenames.json

Property	Value
Type	file / content
Default	cmd, powershell, wt, wsl, …
Location	Config/AgenticChainIntermediaryBasenames.json (install)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Shell/terminal basenames allowed to sit between an AI agent and a tool subprocess (MarkAgentic / OriginatingAgent stamps). Allows cmd/pwsh/wt/wsl to carry originating-agent stamps between AI parent and tools--required for accurate chains.

AiLikelihoodCapSettings.json

Property	Value
Type	file / content
Default	maxAiLikelihoodPercent=75
Location	Config/AiLikelihoodCapSettings.json (install root + plugin Config)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Caps AI likelihood for browser/webview-like basenames; also inventoryExclusions path segments for Keeper PEDM binaries. Prevents browsers/WebView2 from being scored as AI agents and excludes Keeper binaries from inventory noise.

AiLikelihoodFloorSettings.json

Property	Value
Type	file / content
Default	minAiLikelihoodPercent=100
Location	Config/AiLikelihoodFloorSettings.json (install root + plugin Config)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Curated native AI-agent executables (basename + PE identity + Authenticode subject). Sets cold-start AI likelihood floor for policy attribution. Curated signed AI apps (Cursor, Claude, etc.) get correct high AI likelihood for agentic policies--must update as products ship.

intel/app-catalog.ndjson(.gz)

Property	Value
Type	file / content
Default	(via KeeperApi refresh)
Location	KeeperApi cveCatalog + AgenticIntel shared folder
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Current vuln/product catalog source for vulnerabilityRiskPercent. Authoritative product/CVE catalog for vuln baselines--must be refreshable and versioned for agentic risk.

intel/normalized-vulnerability.jsonl

Property	Value
Type	file / content
Default	(feed present on install)
Location	Plugins/bin/KeeperAgenticSnapshotWriter/intel/ (install)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Legacy CVE feed still shipped on current Windows install. Prefer app-catalog.ndjson(.gz) going forward. Legacy CVE corpus still on disk; ops need a content-update path until fully migrated to app-catalog.

intel/rules/AI_Detection.json

Property	Value
Type	file / content
Default	staticAnalysis + signatures
Location	Plugins/bin/KeeperAgenticSnapshotWriter/intel/rules/
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Heuristic rules for AI/static-scan scoring (enable/disable rules, patterns, severity). Same ControlPlane rules configured. Tenant/product rules that decide AI likelihood from imports/signatures--directly drives agentic policy outcomes.

intel/rules/Risk_Behavior.json

Property	Value
Type	file / content
Default	identity privilege tiers
Location	Plugins/bin/KeeperAgenticSnapshotWriter/intel/rules/
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Risk-behavior heuristic rules (e.g. local admin / RDP identity tiers) that boost riskBehavior scores. Identity/privilege-tier heuristics feeding riskBehavior scores for policy gates.

intel/rules/Vulnerability.json

Property	Value
Type	file / content
Default	CVE/KEV boost rules
Location	Plugins/bin/KeeperAgenticSnapshotWriter/intel/rules/
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Vulnerability heuristic rules (CVSS thresholds, CISA KEV, component hints) that boost vulnerabilityRiskPercent. CVSS/KEV boost rules that raise vulnerabilityRiskPercent--security teams must tune thresholds.

ShellMediatedParentBasenames.json

Property	Value
Type	file / content
Default	svchost, RuntimeBroker, shells…
Location	Plugins/bin/KeeperPolicy/Config/ShellMediatedParentBasenames.json
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Parent basenames eligible for shell-mediated spawn bridge when OsShellExclusion also matches (KeeperPolicy). Broker/shell parents eligible for shell-mediated spawn bridging; wrong list drops AI lineage across AppX/broker hops.

static-scan-product-haystack.json

Property	Value
Type	file / content
Default	scoreBuckets (embedded)
Location	KeeperAgenticSnapshotWriter/config (repo; may be embedded on install)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

Static-scan product haystack buckets for AI scoring. Often embedded in snapshot writer. Static-scan score buckets for AI detection; updating patterns improves detection without agent rebuilds.

SystemShellBasenames.json

Property	Value
Type	file / content
Default	explorer, cmd, powershell, …
Location	Config/SystemShellBasenames.json (install root + plugin Config)
Appropriate values	Valid content for the documented schema; deploy with the agent or via configuration policy

OS shell/system basenames that must never be classified as AI agents (OsShellExclusion). Ensures shells/OS hosts never classify as AI agents; misclassification breaks agentic attribution.

Boot and Performance

Settings:BootPhase:DeferNonCriticalJobsAfterBootMinutes

Property	Value
Type	integer
Default	3
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Post-boot grace window (minutes). Tunes post-boot quiet period so inventory/updater do not contend with Group Policy/logon scripts.

Settings:BootPhase:DeferNonCriticalJobsAfterLogonMinutes

Property	Value
Type	integer
Default	2
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Post-logon grace window (minutes). Per-user logon grace for multi-session hosts where boot grace alone is insufficient.

Settings:BootPhase:DeferPolicyPathObservedDuringGrace

Property	Value
Type	boolean
Default	true
Location	appsettings
Appropriate values	true or false

Buffer inventory/path triggers during grace. Buffers inventory path storms at logon that would otherwise queue dozens of scans.

Settings:BootPhase:Enabled

Property	Value
Type	boolean
Default	true
Location	appsettings
Appropriate values	true or false

Defer non-critical jobs after boot/logon. Protects login-time UX by deferring heavy jobs; VDI/boot storms require this toggle.

Settings:BootPhase:KeeperUpdaterLogonDeferralSeconds

Property	Value
Type	integer
Default	90
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Updater deferral after logon (seconds). Stops updater UI/IO from colliding with first-login software installs.

Settings:BootPhase:MaxConcurrentExternalProcessesDuringGrace

Property	Value
Type	integer
Default	3
Location	appsettings
Appropriate values	Positive integer, or the documented range for this setting

Max external job processes during grace. Caps job fan-out during grace to protect CPU/disk on thin clients.

Client and Agent UI

elevation-allowed-extensions.json (executable-extensions)

Property	Value
Type	string
Default	windows: .exe/.bat/.cmd/.msi/.ps1
Location	Plugins/bin/KeeperClient & keeperAgent (install)
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Allowed Request Elevation file types per OS. No separate executable-extensions file exists on disk; this JSON (or KEEPER_ELEVATION_EXTENSIONS_CONFIG) is the admin configured. Inventory uses PriorityExtensions / EnableExecutableOnlyScanning separately. Defines which file types users may Request Elevate; wrong list blocks .msi/.ps1 or opens risky types.

keeperAgent.metadata.approvalExpirationHours

Property	Value
Type	integer
Default	72
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Hours until a pending approval expires. Pending approvals must expire or queues grow stale--SLA for approvers.

keeperAgent.metadata.approvedRequestExpirationHours

Property	Value
Type	integer
Default	24
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Hours until an approved grant can no longer launch. How long a granted launch remains usable; short TTL reduces lingering privilege.

keeperAgent.metadata.historyRetentionDays

Property	Value
Type	integer
Default	30
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Local request history retention. Controls the $key configuration value (default: 30). Changing it affects agent behavior according to the setting type (integer).

keeperAgent.metadata.maxExceptionMessageLength

Property	Value
Type	integer
Default	500
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

UI exception truncation. Controls the $key configuration value (default: 500). Changing it affects agent behavior according to the setting type (integer).

keeperAgent.metadata.maxHistoryItems

Property	Value
Type	integer
Default	20
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Max history items shown in UI. Bounds history rendering cost on busy approvers' machines.

keeperAgent.metadata.maxPayloadSizeBytes

Property	Value
Type	integer
Default	1048576
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Max MQTT payload. Protocol ceiling; raising without coordinated clients causes silent drops.

keeperAgent.metadata.maxRequestItems

Property	Value
Type	integer
Default	20
Location	Plugins/keeperAgent.json
Appropriate values	Positive integer, or the documented range for this setting

Max pending requests shown in UI. UI list cap prevents huge pending queues from freezing the dialog.

keeperAgent.metadata.showInTray

Property	Value
Type	boolean
Default	false
Location	Plugins/keeperAgent.json
Appropriate values	true or false

Show keeperAgent tray icon. Separate tray presence for keeperAgent vs KeeperClient--avoid dual icons or missing UX.

KeeperAgenticSnapshotWriter.metadata.hostProcess

Property	Value
Type	string
Default	KeeperPrivilegeManager
Location	Plugins/KeeperAgenticSnapshotWriter.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Expected host process name. Security/identity expectation for the writer; must stay product-fixed.

KeeperAgenticSnapshotWriter.metadata.taskDelay

Property	Value
Type	integer
Default	250
Location	Plugins/KeeperAgenticSnapshotWriter.json
Appropriate values	Positive integer, or the documented range for this setting

Writer loop delay. Controls the $key configuration value (default: 250). Changing it affects agent behavior according to the setting type (integer).

KeeperClient.metadata.LanguageOverride

Property	Value
Type	string
Default	DEFAULT
Location	Plugins/KeeperClient.json
Appropriate values	DEFAULT or a culture code such as en_US, fr_FR

UI language override (e.g. en_US, fr_FR). Forces UI locale independent of OS language for multinational estates.

KeeperClient.metadata.menu.autoRefresh

Property	Value
Type	boolean
Default	true
Location	Plugins/KeeperClient.json
Appropriate values	true or false

Auto-refresh tray menu on a timer. Disabling stops timer churn on locked-down thin clients.

KeeperClient.metadata.menu.items

Property	Value
Type	array / object
Default	product menu
Location	Plugins/KeeperClient.json
Appropriate values	JSON array or object matching the documented schema

Tray menu jobs, dialogs, and visibility filters. Customizes which request/approval jobs appear in the tray--core UX branding per org.

KeeperClient.metadata.menu.refreshIntervalMinutes

Property	Value
Type	integer
Default	5
Location	Plugins/KeeperClient.json
Appropriate values	Positive integer, or the documented range for this setting

Tray menu refresh interval. How fresh tray actions stay vs API load--tune for VDI density.

KeeperClient.metadata.showInTray

Property	Value
Type	boolean
Default	true
Location	Plugins/KeeperClient.json
Appropriate values	true or false

Show KeeperClient system tray icon. Visibility of the user agent; some kiosks hide tray icons while interactive desktops require them.

Deployment and MDM

macOS deployment settings delivered with MDM configuration profiles. See also the macOS deployment guides on docs.keeper.io.

Full Disk Access (SystemPolicyAllFiles)

Property	Value
Type	string
Default	KEPM paths
Location	MDM mobileconfig
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

FDA grants for KEPM launcher/daemon/notify/trash. FDA is mandatory for reliable process/file visibility on macOS; deploy UX must configured the required TCC profile.

KEEPERREGCODE

Property	Value
Type	string
Default	(MDM-supplied)
Location	MDM mobileconfig
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

macOS managed preference for agent registration code. Device join secret for macOS MDM enrollment--must be pushed via Admin/MDM, not left unset.

System Extension allowlist (Team ID 234QNB7GCA)

Property	Value
Type	string
Default	com.keeper...monitor
Location	MDM mobileconfig
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Allow Endpoint Security system extension via MDM. Without MDM allowlisting, macOS blocks the Endpoint Security extension and monitoring never starts.

Elevation Chain (RunAs / RunElevated)

KeeperRunAs.metadata.credentialHandling

Property	Value
Type	string
Default	ephemeral-accounts
Location	Plugins/KeeperRunAs.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Credential strategy label. Descriptive product contract, not a selectable account model for tenants.

KeeperRunAs.metadata.elevationStage

Property	Value
Type	string
Default	first
Location	Plugins/KeeperRunAs.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Marks first stage of two-stage elevation. Hard-wired stage identity. Changing it does not re-architect elevation; it only confuses diagnostics.

KeeperRunAs.metadata.launches

Property	Value
Type	string
Default	KeeperRunElevated
Location	Plugins/KeeperRunAs.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Downstream elevated executable name. ; wrong target breaks all Windows elevations.

KeeperRunElevated.metadata.apiEndpoints

Property	Value
Type	string
Default	elevation API paths
Location	Plugins/KeeperRunElevated.json
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Documents local elevation API routes. Reference metadata; routes are compiled into the product.

KeeperRunElevated.metadata.elevationProxy

Property	Value
Type	boolean
Default	true
Location	Plugins/KeeperRunElevated.json
Appropriate values	true or false

Marks elevation proxy role. Controls the $key configuration value (default: true). Changing it affects agent behavior according to the setting type (boolean).

KeeperRunElevated.metadata.requiresEphemeralCredentials

Property	Value
Type	boolean
Default	true
Location	Plugins/KeeperRunElevated.json
Appropriate values	true or false

Requires ephemeral admin creds. Product security invariant, not a toggle (disabling would be unsupported).

Host Service and Networking

These options live primarily in appsettings.json next to the agent service executable and apply to the whole service.

AllowedHosts

Property	Value
Type	string
Default	*
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

ASP.NET Core AllowedHosts header filter. Host-filter bootstrap for Kestrel. Changing it without understanding reverse-proxy/header behavior breaks the local API; Incorrect Host header filtering can make the local management API unreachable.

JobStore:StorePath

Property	Value
Type	string (path)
Default	"" (data dir)
Location	appsettings
Appropriate values	Valid path; may use path variables such as {approot}

Override path for persisted job store. Persisted job state can outgrow the default data dir; deployments may need an override for large fleets/storage policies.

Messaging:MalformedJsonRepair:EscapeMap

Property	Value
Type	string
Default	Unicode control escapes
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Map of control characters to JSON escapes for MQTT payload repair. This map is used by the MQTT JSON repair path. Incorrect escape mappings can corrupt event payloads during repair.

Messaging:MalformedJsonRepair:UnmappedControlCharacterFormat

Property	Value
Type	string
Default	\u{X4}
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Format string for unmapped control chars during JSON repair. Controls the $key configuration value (default: \u{X4}). Changing it affects agent behavior according to the setting type (string).

MqttBrokerSettings:IpAddress

Property	Value
Type	string
Default	127.0.0.1
Location	appsettings
Appropriate values	127.0.0.1 or localhost (must remain loopback for security)

Embedded MQTT broker bind address (must stay localhost). Must remain loopback for isolation; surfacing it lets admins audit/bind policy and reject non-localhost drift.

MqttBrokerSettings:Port

Property	Value
Type	integer
Default	8675
Location	appsettings
Appropriate values	1024-65535; must be free on the endpoint

Embedded MQTT broker port. Broker port collisions break all plugins; admins need to reassign 8675 without reinstalling the agent.

Settings:KestrelHttpPort

Property	Value
Type	integer
Default	6988
Location	appsettings
Appropriate values	1024-65535; must be free on the endpoint

Local HTTP port for the agent management API (loopback). Plugins, jobs, and local tools call this endpoint. Change it when the default port conflicts with other software on the endpoint. A service restart is required after changing the port.

Settings:KestrelHttpsPort

Property	Value
Type	integer
Default	6989
Location	appsettings
Appropriate values	1024-65535; must be free on the endpoint

Local HTTPS port for the agent management API (loopback). Prefer HTTPS for sensitive local operations. Plugins and jobs use this port to call the agent. Change it when 6989 is unavailable or blocked. A service restart is required after changing the port.

Settings:PluginPath

Property	Value
Type	string
Default	Plugins
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Plugin manifest directory. Non-default plugin layouts (side-by-side builds, golden images) require an admin-visible path override.

Settings:RepositoryPath

Property	Value
Type	string
Default	KeeperStorage
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Encrypted local repository root. Storage relocation is needed for custom data volumes, disk quotas, or separating encrypted state from Program Files.

Settings:ScriptsPath

Property	Value
Type	string (path)
Default	Jobs/Scripts
Location	appsettings
Appropriate values	Valid path; may use path variables such as {approot}

Job script assets directory ({ScriptsPath}). Job scripts are referenced as {ScriptsPath}; ops teams relocate them for least-privilege ACLs or content sync.

Settings:ServiceName

Property	Value
Type	string
Default	KeeperPrivilegeManager
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Windows service / process display name. Some enterprises require a branded or environment-specific Windows service name for SCM inventories and change control.

Settings:SharedRepositoryPath

Property	Value
Type	string
Default	SharedRepository
Location	appsettings
Appropriate values	Value consistent with the default format; validate on a pilot endpoint before fleet rollout

Shared cross-plugin storage root. Cross-plugin shared state (e.g. AgenticIntel) may need a tenant-chosen volume for backup and capacity planning.

Settings:system.logging.level

Property	Value
Type	string
Default	Warning
Location	appsettings
Appropriate values	Critical, Error, Warning, Information, Debug, Trace

Main service log level shorthand. Primary troubleshooting lever; support escalations need Debug across endpoints without RDP to each endpoint.

Inventory Scan

InventoryFull.EnableExecutableOnlyScanning

Property	Value
Type	boolean
Default	true
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	true or false

Limit scan to executable/package types. Focuses inventory on runnable content for agentic/vuln value vs whole-disk crawl cost.

InventoryFull.EnableHashCaching

Property	Value
Type	boolean
Default	true
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	true or false

Cache file hashes between runs. Speeds incremental-ish full runs; disable when hash correctness must be forced.

InventoryFull.ExcludeDevelopmentDirectories

Property	Value
Type	boolean
Default	false
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	true or false

Exclude development tool directories. Dev workstations generate huge trees; excluding them keeps fleet scans tractable.

InventoryFull.ExcludePaths

Property	Value
Type	array / object
Default	cross-platform list
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	JSON array or object matching the documented schema

Paths excluded from full inventory scan. Skipping WinSxS/node_modules/etc. is required to finish scans and avoid false inventory bloat.

InventoryFull.ExcludeUserSpecificDirectories

Property	Value
Type	boolean
Default	false
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	true or false

Exclude per-user directories from scan. Privacy/perf option to skip user profiles on shared kiosks or when inventory is machine-scoped.

InventoryFull.ExcludeVirtualizationDirectories

Property	Value
Type	boolean
Default	true
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	true or false

Exclude VM/container directories. Containers/VM images explode scan time; default exclude is a capacity control.

InventoryFull.HashCacheValidityDays

Property	Value
Type	integer
Default	7
Location	Jobs/InventoryFullConfiguration.json
Appropriate values	Positive integer, or the documented range for this setting

Hash cache validity window. Staleness window for cached hashes vs rescan cost. Controls the $key configuration value (default: 7). Changing it affects agent behavior according to the setting type (integer).

InventoryFull.MaxConcurrentFiles

Property	Value
Type