Which SuperClue agent do you need?
SuperClue has two agents. The SOC agent monitors Linux, Windows and macOS hosts for security events. The Fleet agent is a Windows-only endpoint agent for data loss prevention and device control.
Which operating systems does the SOC agent support?
Linux and Windows have full coverage. macOS is partial: processes, network connections, logs, file integrity and package inventory work, but there are no CIS configuration checks, rootkit checks, DNS capture or active response. A Docker container and a Kubernetes DaemonSet are also available.
What does the SOC agent collect?
Processes, network connections, logs for 58 built-in detection rules, file integrity changes and installed packages for vulnerability matching. It also runs CIS Level 1 configuration checks (20 on Linux, 14 on Windows). On Linux and Windows it can carry out active-response actions such as blocking an IP or isolating a host.
How often does the SOC agent report?
Every 60 seconds by default. Each heartbeat costs 0.01 credits. The agent connects out to SuperClue over HTTPS on port 443.
How do I install the SOC agent?
Create an agent in SOC Monitor, generate an install command on its Deploy & Docs tab, and paste it on the host. Linux and macOS use one curl command, Windows one PowerShell command. The command carries a short-lived install token that you can revoke.
How are agent updates protected?
Updates are signed on all three operating systems. The agent checks the Ed25519 signature and the SHA-256 hash of each update before it installs it.
Can someone remove the SOC agent from a host?
Removal needs an expiring uninstall token issued by SuperClue for that agent, and each use is recorded. The uninstall script refuses to run without a valid token.
What is the Fleet agent?
A Windows-only endpoint agent that runs as the SuperClueFleetSvc service under the LOCAL SYSTEM account. It watches 14 data loss prevention channels, including USB drives, the clipboard, printing, cloud-sync folders, webmail and messenger file transfers. It also takes remote commands such as blocking an app, disabling USB storage, or locking or wiping a device.
How is the Fleet agent deployed?
The SuperClue platform team enrols your Windows endpoints. You receive an installer, or a deployment package for Group Policy, Intune or SCCM, and run it with administrator rights.
Pick your platform and install the agent.
Install the agents