Skip to content

Install First Agent

SaaS Deploy a SentriKat agent to start collecting software inventory.

Time: ~5 minutes

What Does an Agent Do?

A SentriKat agent runs on your endpoint (server, workstation, or VM), scans installed software, and reports back to SentriKat. Your inventory is then matched against the exploited-vulnerability catalogue and other vulnerability sources.

Agents are lightweight, a script plus a scheduled task (Windows) or a systemd service + timer (Linux/macOS). No persistent daemon, no MSI, no package to babysit.

Two Ways to Install

SentriKat's deploy page (Agents → Agent Keys) offers exactly two methods, both give every machine its own key:

Method Key handling Use when
① Deploy on a machine (recommended) a unique per-host key is already baked into the download: nothing to copy or paste one or a few machines, by hand
② Mass / automated deploy you create a revocable install token; each machine exchanges it once for its own per-host key fleets via Ansible, Intune, GPO, PDQ

No API key needed for method ①

If you downloaded the agent from Deploy on a machine, just run the install command below. The credentials are already inside the file. You only handle a secret yourself with method ② (the install token).

Requirements: Windows 10/11 or Server 2016+, PowerShell 5.1+

  1. In SentriKat: Agents → Agent Keys → Deploy on a machine → Windows: this downloads sentrikat-agent-windows.ps1 with the per-host key baked in.
  2. From an elevated PowerShell in the download folder: 
    powershell -ExecutionPolicy Bypass -File .\sentrikat-agent-windows.ps1 -Install
  3. (Optional) one-off scan right away: 
    powershell -ExecutionPolicy Bypass -File .\sentrikat-agent-windows.ps1 -RunOnce

Registers the "SentriKat Agent" Scheduled Task (every 4 hours by default). Details: Windows Agent.

Requirements: any systemd-based distro (Ubuntu 20.04+, Debian 11+, RHEL 8+, …)

  1. In SentriKat: Agents → Agent Keys → Deploy on a machine → Linux: downloads sentrikat-agent-linux.sh with the per-host key baked in. Copy it to the target machine.
  2. Install: 
    sudo bash ./sentrikat-agent-linux.sh --install
  3. (Optional) one-off scan: 
    sudo bash ./sentrikat-agent-linux.sh --run-once

Registers a systemd service + timer (every 4 hours by default).

Requirements: macOS 12 (Monterey) or later

  1. In SentriKat: Agents → Agent Keys → Deploy on a machine → macOS: downloads sentrikat-agent-macos.sh with the per-host key baked in. Copy it to the target machine.
  2. Install: 
    sudo bash ./sentrikat-agent-macos.sh --install

Method ②: Mass / Automated Deploy (install token)

  1. Agents → Agent Keys → Mass / automated deploy → Create Install Token: copy the token and the ready-made command (shown once)
  2. Push the agent script + that command with your tooling. It looks like: 
    powershell -ExecutionPolicy Bypass -File sentrikat-agent-windows.ps1 -Install `
  -ServerUrl "https://app.sentrikat.com" -EnrollToken "<token>"

    sudo bash ./sentrikat-agent-linux.sh --install \
  --server-url "https://app.sentrikat.com" --enroll-token "<token>"
  3. Each machine exchanges the token once for its own per-host key; revoke the token anytime without touching enrolled machines.

Recipes per tool: SCCM / Intune / GPO, PDQ Deploy.

Verify the Agent

After the first scan completes (1–2 minutes):

  1. Agent Activity shows the machine with a fresh "last seen"
  2. Inventory → Endpoints lists the host; its software appears under Products
  3. The dashboard starts matching your inventory against the exploited-vulnerability catalogue

First scan takes a moment

The first scan may take 1–2 minutes depending on installed software. Subsequent scans are faster because only changes are reported.

Advanced: shared org keys

Direct -ApiKey / --api-key installs with a shared organization key (created under Agents → Agent Keys) still work, for scripted setups and the REST API. Prefer methods ① / ② above: per-host keys mean one compromised machine never exposes a shared secret.