Skip to content

Install First Agent

SaaS Deploy a SentriKat agent to start collecting software inventory.

Time: ~5 minutes

What Does an Agent Do?

A SentriKat agent runs on your endpoint (server, workstation, or VM), scans installed software, and reports back to SentriKat. Your inventory is then matched against the CISA KEV catalog and other vulnerability sources.

Agents are lightweight — a script plus a scheduled task (Windows) or a systemd service + timer (Linux/macOS). No persistent daemon, no MSI, no package to babysit.

Two Ways to Install

SentriKat's deploy page (Integrations → Agent Deploy) offers exactly two methods — both give every machine its own key:

Method Key handling Use when
① Deploy on a machine (recommended) a unique per-host key is already baked into the download — nothing to copy or paste one or a few machines, by hand
② Mass / automated deploy you create a revocable install token; each machine exchanges it once for its own per-host key fleets via Ansible, Intune, GPO, PDQ

No API key needed for method ①

If you downloaded the agent from Deploy on a machine, just run the install command below — the credentials are already inside the file. You only handle a secret yourself with method ② (the install token).

Requirements: Windows 10/11 or Server 2016+, PowerShell 5.1+

  1. In SentriKat: Integrations → Agent Deploy → Deploy on a machine → Windows — this downloads sentrikat-agent-windows.ps1 with the per-host key baked in.
  2. From an elevated PowerShell in the download folder: 
    powershell -ExecutionPolicy Bypass -File .\sentrikat-agent-windows.ps1 -Install
  3. (Optional) one-off scan right away: 
    powershell -ExecutionPolicy Bypass -File .\sentrikat-agent-windows.ps1 -RunOnce

Registers the "SentriKat Agent" Scheduled Task (every 4 hours by default). Details: Windows Agent.

Requirements: any systemd-based distro (Ubuntu 20.04+, Debian 11+, RHEL 8+, …)

  1. In SentriKat: Integrations → Agent Deploy → Deploy on a machine → Linux — downloads sentrikat-agent-linux.sh with the per-host key baked in. Copy it to the target machine.
  2. Install: 
    sudo bash ./sentrikat-agent-linux.sh --install
  3. (Optional) one-off scan: 
    sudo bash ./sentrikat-agent-linux.sh --run-once

Registers a systemd service + timer (every 4 hours by default).

Requirements: macOS 12 (Monterey) or later

  1. In SentriKat: Integrations → Agent Deploy → Deploy on a machine → macOS — downloads sentrikat-agent-macos.sh with the per-host key baked in. Copy it to the target machine.
  2. Install: 
    sudo bash ./sentrikat-agent-macos.sh --install

Method ② — Mass / Automated Deploy (install token)

  1. Integrations → Agent Deploy → Mass / automated deploy → Create Install Token — copy the token and the ready-made command (shown once)
  2. Push the agent script + that command with your tooling. It looks like: 
    powershell -ExecutionPolicy Bypass -File sentrikat-agent-windows.ps1 -Install `
  -ServerUrl "https://app.sentrikat.com" -EnrollToken "<token>"

    sudo bash ./sentrikat-agent-linux.sh --install \
  --server-url "https://app.sentrikat.com" --enroll-token "<token>"
  3. Each machine exchanges the token once for its own per-host key; revoke the token anytime without touching enrolled machines.

Recipes per tool: SCCM / Intune / GPO, PDQ Deploy.

Verify the Agent

After the first scan completes (1–2 minutes):

  1. Agent Activity shows the machine with a fresh "last seen"
  2. Inventory → Endpoints lists the host; its software appears under Products
  3. The dashboard starts matching your inventory against the KEV catalog

First scan takes a moment

The first scan may take 1–2 minutes depending on installed software. Subsequent scans are faster because only changes are reported.

Advanced: shared org keys

Direct -ApiKey / --api-key installs with a shared organization key (created under Integrations → Agent Keys) still work — for scripted setups and the REST API. Prefer methods ① / ② above: per-host keys mean one compromised machine never exposes a shared secret.