Install the Agent

One agent, one install command, for SIEM and EDR/XDR. You don't choose a "flavour" — the agent registers with the platform and then does exactly what your subscription entitles: log collection (SIEM), endpoint telemetry and response (EDR/XDR) or all of it. The platform pushes the right configuration down; if your subscription changes, the agent adjusts automatically without a reinstall.

A new host appears in the platform within about 30 seconds of a successful install.

The console is live at siem.sec1.ai — sign in with your platform credentials (see Setup & Access) to manage agents, sources and incidents.

Your enrollment token is sent to you separately. Never paste it into a shared document or commit it to source control. In the commands below, replace <YOUR-TOKEN> with the token you were issued and <YOUR-PLATFORM-URL> with your Sec1 platform base URL. The token also binds the host to your team, so its telemetry lands in the right tenant.

Prerequisites

Check these before installing on any host.

Supported platforms

OS	Architectures	Notes
Windows	x64	Windows 10 / 11 and Windows Server 2016+. PowerShell 5.1+ (built in).
Linux	amd64, arm64	systemd-based distros (Ubuntu, Debian, RHEL/CentOS, Amazon Linux, SUSE).
macOS	amd64 (Intel), arm64 (Apple Silicon)	Telemetry + software inventory; device enforcement is visibility-only on macOS.

Privileges

• Administrator (Windows) / root (Linux & macOS) is recommended. The agent installs system-wide and runs at boot as a service, and host-level enforcement (isolate, USB block, live-response scripts) requires it.

• Without elevation the agent installs per-user — it runs only while that user is logged in and cannot perform enforcement actions.

Network / allowlist

The agent only makes outbound connections — it opens no inbound ports on the host (unless you enable a log receiver, below) and the platform opens no inbound ports for agents. Allow the host to reach these destinations:

Destination	Port	Purpose	Direction
api.sec1.io (the platform gateway)	443	Enroll, heartbeat, config + command poll, telemetry ingest	Outbound
storage.googleapis.com	443	Download the agent binary — install time only	Outbound
siem.sec1.ai	443	Console / UI (from an analyst's browser)	Outbound
auth.sec1.io	443	Login / SSO (Keycloak) — from an analyst's browser	Outbound
Agent log receivers, e.g. :9099 HTTP / :9100 TCP / :5514 syslog	as set	Only if existing shippers push to the agent	Inbound (internal net only)

Notes:

• The last row is the only inbound case — open those ports only on the internal network between your shippers and the agent, and only if you enable a receiver. See Data collection.

• api.sec1.io and storage.googleapis.com are the minimum for an agent to run. siem.sec1.ai and auth.sec1.io are reached by analysts' browsers, not the agent.

• Behind a proxy? The agent honours HTTPS_PROXY / HTTP_PROXY / NO_PROXY. For a proxy-only network pass SEC1_PROXY=http://user:pass@proxy:port (and SEC1_CA_FILE=<corp-root-ca.pem> if the proxy does TLS interception) at install.

Enrollment token

• You receive an enrollment token from Sec1, delivered separately from these instructions. Have it ready — every install command needs it. It binds the host to your team, and the platform uses your subscription to decide what the agent does. Keep it private (treat it like a password).

Resource footprint

• Single static binary (~8–12 MB), no runtime or dependencies to pre-install. Typical usage is low single-digit % CPU and tens of MB RAM. It buffers to a local disk spool if the platform is briefly unreachable, so plan for a few hundred MB of free disk for outage resilience.

---

Install

Give the agent two things — your platform URL and your enrollment token. That's it. Everything else (which logs to collect, which collectors to run) is managed centrally from the platform and pushed to the agent.

This is the single-host install: one command per machine. To roll out across a fleet, drop the same command into your management tool — see Single host vs bulk / fleet.

Windows (run in an Admin PowerShell)

$env:SEC1_PLATFORM_URL = "<YOUR-PLATFORM-URL>"
$env:SEC1_TOKEN        = "<YOUR-TOKEN>"
# Optional, for proxy-only networks:
# $env:SEC1_PROXY      = "http://user:pass@proxy:8080"
# $env:SEC1_CA_FILE    = "C:\path\corp-root-ca.pem"
iwr -useb https://storage.googleapis.com/digitalassets-sec1/agent/v0.1.0/install.ps1 | iex

Linux / macOS

curl -sSL https://storage.googleapis.com/digitalassets-sec1/agent/v0.1.0/install.sh \
  | sudo SEC1_PLATFORM_URL=<YOUR-PLATFORM-URL> \
         SEC1_TOKEN=<YOUR-TOKEN> bash

The host appears in the platform within ~30 seconds. SIEM, EDR and XDR capabilities turn on according to your subscription intersected with the per-host toggle — no separate installer, no reinstall if your plan changes. See Data collection for how one agent serves all three.

Choosing capabilities at install (optional). By default the agent enables everything your subscription allows. To hint the initial choice on a host, pass SEC1_CAPABILITIES=siem,edr (a comma list of siem, edr, xdr). This only seeds the per-host toggle — you can change it later in the console, and the effective capability is always your subscription and the toggle.

Configuring what's collected. Log sources (files, syslog, Windows Event Log channels, HTTP/TCP receivers for existing pipelines like Logstash/Beats) and endpoint collectors are configured in the platform UI (the agent's Agent Inputs editor) and pushed to the agent — you don't set them at install time. See Data collection.

---

Single host vs bulk / fleet

Single host is the command above — set SEC1_PLATFORM_URL and SEC1_TOKEN, run the one-liner.

Bulk / fleet is the same command, run by whatever tool you already use to manage machines. The installer is a single non-interactive command, it is idempotent (re-running upgrades in place) and the enrollment token binds every host to the right team — so there is nothing fleet-specific to build. Set the same SEC1_* variables and run the one-liner remotely.

Microsoft Intune / SCCM (Windows): package the PowerShell command above as a Win32 app or a configuration/PowerShell script. Set the SEC1_* env vars at the top of the script.

Group Policy (Windows): add the PowerShell command as a computer Startup script (runs as SYSTEM, so it installs system-wide).

Ansible (Linux/macOS):

- hosts: all
  become: true
  tasks:
    - name: Install Sec1 agent
      ansible.builtin.shell: |
        curl -sSL https://storage.googleapis.com/digitalassets-sec1/agent/v0.1.0/install.sh | bash
      environment:
        SEC1_PLATFORM_URL: "{{ sec1_platform }}"
        SEC1_TOKEN: "{{ sec1_token }}"        # from Ansible Vault, not plaintext
      args: { creates: /usr/local/bin/sec1-edr-agent }

Any RMM / SSH-for-loop works the same way — the command is idempotent and re-running it upgrades in place.

Keep the enrollment token in your tool's secret store (Intune secret, Ansible Vault, etc.) — never in a plaintext script committed to source control.

---

Verify the install

Self-check (doctor)

The agent ships a built-in diagnostic. Run the agent binary with -doctor to validate connectivity, configuration and permissions:

sec1-agent -doctor -config <path-to-config>

It reports whether the agent can reach the platform, whether the token is accepted and whether it has the access it needs to collect.

Agent logs

• Windows: C:\Program Files\Sec1Agent\agent.log (or %LOCALAPPDATA%\Sec1Agent\ for a per-user install)

• Linux: journalctl -u sec1-agent

In the platform

The same host surfaces wherever its subscription applies:

• Endpoint telemetry (EDR/XDR): XDR → Endpoints

• Log sources (SIEM): SIEM → Sources

If a host does not appear within a minute, re-run the -doctor check and review the agent log for connection or token errors.