How do you install the SuperClue SOC agent on Linux?

• Ubuntu 18.04+, Debian 10+, RHEL 7+, CentOS 7+, Amazon Linux 2, Fedora 35+, SUSE, Alpine or Arch. Hosts without systemd use cron.
• curl, to fetch the installer. Python 3.7 or later is installed automatically if it is missing or older: from the system packages, or a pinned, SHA-256 checked standalone Python in /opt/superclue/runtime (CentOS 7 ships 3.6).
• Running the install command again upgrades the agent in place and keeps its state and offline queue.
• Root or sudo access on the server.
• Outbound HTTPS (port 443) to SuperClue. The agent does not listen on any inbound port.
• Credits: 25 to create the agent, 15 for each machine that registers to it, and 0.01 for each heartbeat (every 60 seconds by default).

1. 1

   Create the agent

   Sign in to SuperClue, open SOC Monitor and choose Deploy Agent. Give the agent a name. Creating an agent costs 25 credits.

2. 2

   Generate an install command

   Open the agent, go to the Deploy & Docs tab and pick Linux under One-command install. Choose how long the command stays valid (1 hour to 7 days) and how many hosts may use it (1 to 1,000), then select Generate install command.

3. 3

   Run the command on the server

   Paste the command into a shell on each server. It needs sudo. The installer downloads the agent, verifies its Ed25519 signature and SHA-256 hash, and starts it as a systemd service.

   curl -fsSL -H "Authorization: Bearer YOUR_INSTALL_TOKEN" https://superclue.io/api/soc/install/linux | sudo bash

4. 4

   Revoke the install token

   When your hosts are installed, select Revoke now. The token works like a password until it expires or runs out of uses, and it stays in the host shell history.

On the server, check the service and follow its log:

systemctl status superclue-agent
journalctl -u superclue-agent -f

In SuperClue, the machine appears under the agent in SOC Monitor once the first heartbeat arrives.

• /opt/superclue: the agent and its uninstaller, readable by root only.
• /etc/superclue: the agent ID and secret, in files only root can read.
• superclue-agent.service: a systemd unit that restarts the agent if it stops or is killed, including after an out-of-memory kill.
• superclue-agent-watchdog.timer: checks the agent every 2 minutes and restarts it if nothing reached SuperClue for 10 minutes. Without systemd, cron does the same every minute.

The install token starts with sci_. It travels in the Authorization header, not the URL, so it stays out of web server logs. By default it is valid for 24 hours and 25 installs.

Linux has full coverage: processes, network connections, DNS queries (partial, root only), log analysis, file integrity monitoring, package inventory with vulnerability matching, 20 CIS Level 1 checks, rootkit checks and active response. See the capability matrix for the details.

The uninstaller needs an uninstall token that SuperClue signs for this agent. Tokens expire (24 hours by default) and every use is recorded. Signed in as an owner, admin or analyst, open the agent in SOC Monitor, go to the Deploy & Docs tab and select Issue uninstall token under Uninstall token. You can also request one through the API:

curl -X POST https://superclue.io/api/soc/agents/YOUR_AGENT_ID/uninstall-token \
  -H "Authorization: Bearer YOUR_LOGIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ttl_hours": 24}'

If you cannot call the API, ask support at agent@superclue.io to issue the token. Then run, with administrator rights:

sudo /opt/superclue/uninstall.sh YOUR_UNINSTALL_TOKEN

• The uninstaller checks the token signature, reports the removal to SuperClue, then stops the agent and deletes its files and credentials.
• If the host cannot reach SuperClue, the uninstaller stops and tells you. Re-run it with --offline (Linux, macOS) or -Offline (Windows) to uninstall on the signature check alone.