Why is everything unknown_agent?

Short answer

Your network doesn't have reverse DNS for the source IPs, mDNS isn't reaching the collector, and the agent processes aren't setting AGENTFW_AGENT / x-agentfw-agent. Without one of these, the collector falls back to the default and writes unknown_agent on every row.

The good news: the Agents page still clusters one card per source IP even when the name is missing, and offers suggested names from whatever signals it does see.

Fastest fix for Python agents — run them under the kilasec_agent package from the agents bundle; every outbound request gets tagged, with zero code changes:

PYTHONPATH=/opt/kilasec-agents/pyagent KILASEC_AGENT=my-bot python3 agent.py

See In-agent identity for the full setup (including verified identity tokens).

Fix it in three steps

1 — confirm reverse DNS

On the collector host:

dig -x 10.0.3.42 +short

If that returns nothing, your DHCP server isn't writing PTR records. Either fix that on the DHCP side (most routers have a "Register DNS" toggle), or install the DHCP lease feeder so kilasec can read the lease file directly.

2 — confirm mDNS works (Mac/Linux networks)

avahi-browse -arpt _workstation._tcp 2>/dev/null | head

If you get hits, but the collector still doesn't see them, the collector container probably needs --network host (multicast doesn't cross Docker's default bridge).

3 — name what's left manually

The Agents page shows "Unnamed" clusters at the top. Each one has a suggested-names list — clicking adopts the strongest available signal as a manual override. For sources the network really doesn't know about (containers, appliances), type a name and Save.

Why not just use a hostname for the default

The collector knows the source IP on every request. So host-10.0.3.42 would be a more useful default than unknown_agent.

That's exactly what the Agents page shows when no other signal is available — one card per IP, never one big bucket called "unknown". The "unknown_agent" string in the audit row is a raw fact (the agent itself didn't identify); the display in the UI is what you should be looking at.

→ Full background: Concepts: Identity model.