Dynamic Agent Groups: Stop Sorting Hosts by Hand

April 24, 2026 · InfraScout Team

Until today, every new server in InfraScout meant a small chore: open the agent list, find the host, and click it into the right groups so the right policies and assessments would apply. It was fine for a handful of agents and tedious for a fleet. As of this release, groups can keep themselves in sync. You describe what belongs in a group — Windows Servers in EMEA, anything whose hostname starts with db-, macOS laptops on version 14 or later — and InfraScout updates the membership for you as agents connect, change, or fall off.

Rule-based groups, in plain terms

A dynamic group is a group whose membership is decided by a rule instead of by a manual list. The rule is built from the same fields you already see in the agent inventory — operating system, version, architecture, hostname, display name, and the capabilities each agent reports — combined with operators that read the way you'd say them out loud: equals, is one of, contains, matches, and has.

You can require every condition to match, or any of them. That covers the two patterns most fleets actually need: a tight definition for a focused group ("all of these things are true"), and a broader catch-all for a category ("any of these is enough").

Membership is recomputed automatically. When a new agent connects for the first time, it lands in every dynamic group whose rule it satisfies. When something about an agent changes — a rename, an OS upgrade, a new capability — the groups it belongs to are updated on the next check-in. You don't reload anything; the dashboard reflects the change as soon as it happens.

Sparkles A wizard, with the common groups one click away

Creating a group is now a short, type-first wizard. You pick Static if you want to hand-select agents, or Dynamic if you want a rule. From there the wizard walks you through the metadata and either an agent picker or a rule builder, with a live preview that tells you how many agents currently match before you save.

To save you the work of building the obvious groups from scratch, every tenant ships with a small set of system-defined groups already populated:

• All Hosts — every connected agent, regardless of platform
• Windows Servers and Windows Clients — the split most fleets want for policy targeting
• Linux Hosts — every Linux agent
• macOS Hosts — every macOS agent

These groups are managed by InfraScout and stay locked, so they can't be edited or deleted by accident. They're meant as the foundation: attach a baseline assessment policy to Linux Hosts, and every Linux agent — present and future — picks it up automatically.

Preview before you save

The rule builder has a built-in preview that shows the count and a sample of matching agents in your visibility scope. Use it to sanity-check a rule before you commit — especially for broad rules like contains prod or a regex on hostnames.

Workflow Policies inherit through the group

The point of grouping has always been to attach policies once and let them apply broadly. Dynamic groups don't change that contract — they make it more useful. The assessment policies and inventory policies you attach to a group still flow to every member, and now "every member" includes hosts that haven't been provisioned yet. A new Windows server joining the fleet picks up its assessment cadence and inventory schedule the moment it lands in a group whose rule matches it.

The same applies to the update policies currently in preview: when they ship, they'll inherit through dynamic groups out of the box.

Cleaner reviews on bigger teams

A handful of fixes in this release also make group changes feel right on tenants with several reviewers. Edits to membership flow through review without getting stuck on a single approver, and the create/edit modal disables Save until the rule actually validates — so you can't accidentally ship a half-finished rule that quietly matches nothing. On the list view, each card now shows whether a group is System, Static, or Dynamic at a glance, and dynamic groups display the live member count next to a Rule indicator so you can tell at a glance that the evaluator is keeping up.

Try it

Open the Agent Groups view in the dashboard and click New Group. Pick Dynamic, give it a name, and try a rule against your own fleet — for example, hostname contains db to gather your database hosts, or os_family equals linux combined with version matches a regex for the releases you still need to retire.

If you've been maintaining static groups by hand, this is a good moment to look at which of them are really rules in disguise — "all our domain controllers", "every host in the build farm", "everything tagged staging". Those are the ones that benefit most from being converted.

Tell us what's missing

If there's a fact about your agents you'd like to group on and it's not exposed yet, tell us. Reach us at info@infrascout.cloud.