How do you install the SuperClue SOC agent on macOS?

• macOS 12 or later.
• Python 3.7 or later is installed automatically if it is missing or older: the Command Line Tools python3 is used when present, otherwise a pinned, SHA-256 checked standalone Python in /usr/local/superclue/runtime.
• The agent restarts itself if it stops, and a watchdog checks it every 2 minutes. Running the install command again upgrades it in place.
• An account with sudo rights.
• Outbound HTTPS (port 443) to SuperClue.
• Credits: 25 to create the agent, 15 for each machine that registers to it, and 0.01 for each heartbeat (every 60 seconds by default).

1. 1

   Create the agent

   Sign in to SuperClue, open SOC Monitor and choose Deploy Agent. Give the agent a name. Creating an agent costs 25 credits.

2. 2

   Generate an install command

   Open the agent, go to the Deploy & Docs tab and pick macOS under One-command install. Choose how long the command stays valid (1 hour to 7 days) and how many hosts may use it (1 to 1,000), then select Generate install command.

3. 3

   Run the command on the Mac

   Paste the command into Terminal. It needs sudo. The installer verifies the agent signature and registers it as the launchd daemon io.superclue.agent.

   curl -fsSL -H "Authorization: Bearer YOUR_INSTALL_TOKEN" https://superclue.io/api/soc/install/macos | sudo bash

4. 4

   Grant Full Disk Access to the agent interpreter

   In System Settings, open Privacy & Security, then Full Disk Access, and add the interpreter the installer prints as Agent interpreter. Without it, file integrity monitoring and the unified log cannot read protected locations.

5. 5

   Revoke the install token

   When your hosts are installed, select Revoke now. The token works like a password until it expires or runs out of uses, and it stays in the host shell history.

Check that the daemon is loaded and follow its log:

sudo launchctl list | grep io.superclue.agent
sudo tail -f /var/log/superclue-agent.log

In SuperClue, the Mac appears under the agent in SOC Monitor after its first heartbeat.

Compare with Linux and Windows in the SOC agent capability matrix.

The agent and its uninstaller live in /usr/local/superclue, and its credentials in /etc/superclue. Both are readable by root only. The log is /var/log/superclue-agent.log.

The install token starts with sci_. It travels in the Authorization header, not the URL, so it stays out of web server logs. By default it is valid for 24 hours and 25 installs.

The uninstaller needs an uninstall token that SuperClue signs for this agent. Tokens expire (24 hours by default) and every use is recorded. Signed in as an owner, admin or analyst, open the agent in SOC Monitor, go to the Deploy & Docs tab and select Issue uninstall token under Uninstall token. You can also request one through the API:

curl -X POST https://superclue.io/api/soc/agents/YOUR_AGENT_ID/uninstall-token \
  -H "Authorization: Bearer YOUR_LOGIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ttl_hours": 24}'

If you cannot call the API, ask support at agent@superclue.io to issue the token. Then run, with administrator rights:

sudo /usr/local/superclue/uninstall.sh YOUR_UNINSTALL_TOKEN

• The uninstaller checks the token signature, reports the removal to SuperClue, then stops the agent and deletes its files and credentials.
• If the host cannot reach SuperClue, the uninstaller stops and tells you. Re-run it with --offline (Linux, macOS) or -Offline (Windows) to uninstall on the signature check alone.