Dynamic Agent Groups: Stop Sorting Hosts by Hand

April 24, 2026 · InfraScout Team

Until today, every new server in InfraScout meant a small chore: open the agent list, find the host, and click it into the right groups so the right policies and assessments would apply. It was fine for a handful of agents and tedious for a fleet. As of this release, groups can keep themselves in sync. You describe what belongs in a group — Windows Servers in EMEA, anything whose hostname starts with db-, macOS laptops on version 14 or later — and InfraScout updates the membership for you as agents connect, change, or fall off.

Rule-based groups, in plain terms

A dynamic group is a group whose membership is decided by a rule instead of by a manual list. The rule is built from the same fields you already see in the agent inventory — operating system, version, architecture, hostname, display name, and the capabilities each agent reports — combined with operators that read the way you'd say them out loud: equals, is one of, contains, matches, and has.

You can require every condition to match, or any of them. That covers the two patterns most fleets actually need: a tight definition for a focused group ("all of these things are true"), and a broader catch-all for a category ("any of these is enough").

Membership is recomputed automatically. When a new agent connects for the first time, it lands in every dynamic group whose rule it satisfies. When something about an agent changes — a rename, an OS upgrade, a new capability — the groups it belongs to are updated on the next check-in. You don't reload anything; the dashboard reflects the change as soon as it happens.

A wizard, with the common groups one click away

Creating a group is now a short, type-first wizard. You pick Static if you want to hand-select agents, or Dynamic if you want a rule. From there the wizard walks you through the metadata and either an agent picker or a rule builder, with a live preview that tells you how many agents currently match before you save.

To save you the work of building the obvious groups from scratch, every tenant ships with a small set of system-defined groups already populated:

• All Hosts — every connected agent, regardless of platform
• Windows Servers and Windows Clients — the split most fleets want for policy targeting
• Linux Hosts — every Linux agent
• macOS Hosts — every macOS agent

These groups are managed by InfraScout and stay locked, so they can't be edited or deleted by accident. They're meant as the foundation: attach a baseline assessment policy to Linux Hosts, and every Linux agent — present and future — picks it up automatically.

Preview before you save

The rule builder has a built-in preview that shows the count and a sample of matching agents in your visibility scope. Use it to sanity-check a rule before you commit — especially for broad rules like contains prod or a regex on hostnames.

Policies inherit through the group

The point of grouping has always been to attach policies once and let them apply broadly. Dynamic groups don't change that contract — they make it more useful. The assessment policies and inventory policies you attach to a group still flow to every member, and now "every member" includes hosts that haven't been provisioned yet. A new Windows server joining the fleet picks up its assessment cadence and inventory schedule the moment it lands in a group whose rule matches it.

The same applies to the update policies currently in preview: when they ship, they'll inherit through dynamic groups out of the box.

Cleaner reviews on bigger teams

A handful of fixes in this release also make group changes feel right on tenants with several reviewers. Edits to membership flow through review without getting stuck on a single approver, and the create/edit modal disables Save until the rule actually validates — so you can't accidentally ship a half-finished rule that quietly matches nothing. On the list view, each card now shows whether a group is System, Static, or Dynamic at a glance, and dynamic groups display the live member count next to a Rule indicator so you can tell at a glance that the evaluator is keeping up.

Try it

Open the Agent Groups view in the dashboard and click New Group. Pick Dynamic, give it a name, and try a rule against your own fleet — for example, hostname contains db to gather your database hosts, or os_family equals linux combined with version matches a regex for the releases you still need to retire.

If you've been maintaining static groups by hand, this is a good moment to look at which of them are really rules in disguise — "all our domain controllers", "every host in the build farm", "everything tagged staging". Those are the ones that benefit most from being converted.

Tell us what's missing

If there's a fact about your agents you'd like to group on and it's not exposed yet, tell us. Reach us at info@infrascout.cloud.