To my mind agentM already summarized pretty well :

• Data gathering
• Data processing
• Result feeding

I would just add some features which could make this agent really versatile :

• A kind of scheduler to manage execution of the agents (make hem sleep, wait for another info...)
• Add a 'state' to the agent (beccause your log reader agent shouldn't read logs the same way when everything is normal as when there's an ongoing intrusion...) for managing behaviour AND/OR priority.
• The code of the Agent should be easily AND securely upgradable (to dynamically/remotely add new features)
  
  
  "Only Bad Coders Badly Code In Perl" (OBC2IP)
  

  Comment on Re: RFC on a system for automated agents