Contents x
    Endpoint Agent Installation
    • 07 Jul 2025
    • 2 Minutes to read
    • Print
    • Dark
      Light
    Contents

    Endpoint Agent Installation

    • Updated on 07 Jul 2025
    • 2 Minutes to read
    • Print
    • Dark
      Light
    Article summary

    The Endpoint Agent is signed, and the same for everyone. The endpoint agent's customization, which indicates the owner, is done at installation based on the installation key used. The Installation Key specifies where the Sensor should connect to enroll, as well as the encryption key used to start the enrollment process.

    Enterprise-wide deployment

    Looking to deploy many endpoint agents at once? Check out Enterprise Sensor Deployment.

    Installing the endpoint agent does not require a reboot.

    Installing the Endpoint Agent

    The sensors are designed to be simple to use and re-package for any deployment methodology you use in your Organization.

    The sensor requires administrative privileges to install. On Windows this means an Administrator or System account, on macOS and Linux it means the root account.

    Before installing, you will need the installation key you want to use.

    For OS-specific installation instructions, choose your OS in the nav bar on the left.

    Required Permissions

     Windows

    • Administrative privileges - Must run as LocalSystem service

    • SeDebugPrivilege - Debug programs privilege

    • SeBackupPrivilege - Back up files and directories privilege

    • SeRestorePrivilege - Restore files and directories privilege

     Linux

    • Root privileges (UID 0) - Required for system monitoring

    • RLIMIT_MEMLOCK set to RLIM_INFINITY - For eBPF program loading

    • Mount capabilities - For filesystem mounting

    • CAP_BPF or CAP_SYS_ADMIN - For eBPF kernel module operation

    • CAP_NET_ADMIN - For network monitoring

     macOS

    • Root privileges (UID 0) - Required for system monitoring

    • Kernel extension entitlements - Including com.apple.security.cs.debugger

    • Apple KPI dependencies - bsd, libkern, dsep, mach kernel programming interfaces

     Cross-Platform Requirements

    • File system read/write access to system directories

    • Process monitoring capabilities

    • Network monitoring and outbound HTTPS access

    • Registry access (Windows) for system configuration

    Note: The sensors require these elevated privileges for legitimate security monitoring including process detection, file system monitoring, network analysis, and kernel-level telemetry collection.

    Downloading the Agents

    To download the single installers relevant for your deployment, access the /download/[platform]/[architecture] control plane.
    The platform component is one of win, linux or osx while the architecture component is either 32 or 64.

    For example:

    Was this article helpful?
    Related articles
    What's Next