Install an agent on a private network

An agent checks services from the network where you install it. It only makes outbound connections: you do not need to open an inbound port or expose private services on the Internet.

An agent checks services from the network where you install it. It only makes outbound connections: you do not need to open an inbound port or expose private services on the Internet.

Prepare installation

In Agents, add one with a name identifying its location. Set the destinations or networks it may check and use commands generated by your console. The enrollment token lasts 15 minutes and is single use. Do not publish it or include it in screenshots.

Choose how to run it

On Linux, use service installation so it starts with the machine. On Windows, follow the PowerShell command as administrator; it runs as a scheduled task. Docker is another option, retaining the agent’s data volume. Review Node requirements and permissions shown with the command before running it.

Verify it works

Open the agent page: inspect connection, last activity, version and capabilities. First create a monitor for a known service within the allowed destinations. Creating more monitors does not restore a missing capability; check machine permissions or tools.

Keys and removal

The private key stays on the agent; protect its files. A new key from the console requires completing replacement enrollment. Deleting the agent revokes access: its monitors lose that data source. Revoking its access is different from uninstalling software from the machine.