How do you install the SuperClue SOC agent on Windows?

• Windows 10, Windows 11 or Windows Server 2016 and later.
• A local administrator account.
• Outbound HTTPS (port 443) to SuperClue. The agent does not listen on any inbound port.
• No Python is needed: the installer downloads embedded Python 3.12.2 from python.org and checks its SHA-256 hash, so allow python.org as well. A system-wide Python is never used, because the agent runs as SYSTEM.
• The agent restarts itself if it stops, and the SuperClueAgentWatchdog task checks it every 5 minutes. Running the install command again upgrades it in place and keeps its state and offline queue.
• Credits: 25 to create the agent, 15 for each machine that registers to it, and 0.01 for each heartbeat (every 60 seconds by default).

1. 1

   Create the agent

   Sign in to SuperClue, open SOC Monitor and choose Deploy Agent. Give the agent a name. Creating an agent costs 25 credits.

2. 2

   Generate an install command

   Open the agent, go to the Deploy & Docs tab and pick Windows under One-command install. Choose how long the command stays valid (1 hour to 7 days) and how many hosts may use it (1 to 1,000), then select Generate install command.

3. 3

   Open an elevated console

   On the Windows host, open PowerShell or Command Prompt with Run as administrator. The installer stops if it does not have administrator rights.

4. 4

   Paste the install command

   Paste the command as one line. It fetches the installer over HTTPS, sets up the agent in C:\SuperClue and starts it as a SYSTEM scheduled task named SuperClueAgent.

   powershell -NoProfile -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; & ([scriptblock]::Create((Invoke-RestMethod -UseBasicParsing -Headers @{Authorization='Bearer YOUR_INSTALL_TOKEN'} 'https://superclue.io/api/soc/install/windows')))"

5. 5

   Revoke the install token

   When your hosts are installed, select Revoke now. The token works like a password until it expires or runs out of uses, and it stays in the host shell history.

In PowerShell, check the task and read the end of the agent log:

Get-ScheduledTask -TaskName SuperClueAgent
Get-Content C:\SuperClue\agent.log -Tail 20

If you installed with the file-based installer and supplied NSSM, the agent runs as a Windows service instead: use sc query SuperClueAgent. In SuperClue, the machine appears under the agent in SOC Monitor after its first heartbeat (every 60 seconds by default).

Compare platforms in the SOC agent capability matrix.

C:\SuperClue holds the agent, its log, its secret and its uninstaller, and only SYSTEM and Administrators can read it. The installer also adds a firewall rule for outbound HTTPS.

The install token starts with sci_. It travels in the Authorization header, not the URL, so it stays out of web server logs. By default it is valid for 24 hours and 25 installs.

The uninstaller needs an uninstall token that SuperClue signs for this agent. Tokens expire (24 hours by default) and every use is recorded. Signed in as an owner, admin or analyst, open the agent in SOC Monitor, go to the Deploy & Docs tab and select Issue uninstall token under Uninstall token. You can also request one through the API:

curl -X POST https://superclue.io/api/soc/agents/YOUR_AGENT_ID/uninstall-token \
  -H "Authorization: Bearer YOUR_LOGIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ttl_hours": 24}'

If you cannot call the API, ask support at agent@superclue.io to issue the token. Then run, with administrator rights:

powershell -ExecutionPolicy Bypass -File C:\SuperClue\uninstall.ps1 -Token YOUR_UNINSTALL_TOKEN

• The uninstaller checks the token signature, reports the removal to SuperClue, then stops the agent and deletes its files and credentials.
• If the host cannot reach SuperClue, the uninstaller stops and tells you. Re-run it with --offline (Linux, macOS) or -Offline (Windows) to uninstall on the signature check alone.