What does the SuperClue SOC agent monitor?
The SOC agent runs on your Linux, Windows and macOS hosts and sends telemetry to SuperClue. There it is checked against 58 MITRE ATT&CK-mapped detection rules, file integrity baselines, CIS configuration checks and known vulnerabilities. Linux has the fullest coverage, Windows is close behind, and macOS is partial. The table below shows exactly where.
What works on each operating system?
| Capability | Linux | Windows | macOS |
|---|---|---|---|
| Processes | Yes | Yes (event 4688 or Sysmon, if auditing is on) | Partial (ps snapshot) |
| Network connections | Yes | Yes | Yes |
| DNS queries | Partial (needs root, capped) | Partial (DNS Client log) | No |
| Log analysis (HIDS) | Yes | Yes | Partial (unified log) |
| File integrity monitoring | Yes (hashing and inotify) | Yes | Partial (polled) |
| Package inventory and vulnerability matching | Yes (dpkg, rpm) | Yes (programs and KBs) | Partial (pkgutil, apps, Homebrew) |
| CIS Level 1 configuration checks (SCA) | Yes, 20 checks | Yes, 14 checks | No |
| Rootkit checks | Yes (user-mode heuristics) | Partial | No |
| Active response | Yes | Yes | No |
| Signed self-update | Yes | Yes | Yes |
What does the agent detect?
- Host intrusion detection: 58 built-in rules, each mapped to MITRE ATT&CK, covering Windows event logs, authentication, processes, file changes, web server logs, system logs, network and auditd. You can add your own rules per tenant.
- File integrity monitoring: default watch lists of 20 paths on Linux, 6 on Windows and 8 on macOS.
- Configuration assessment: a subset of CIS Level 1 checks, 20 on Linux and 14 on Windows.
- Rootkit checks: 22 known rootkit signatures plus hidden process, kernel module, /proc and binary integrity checks.
- Vulnerability matching: your installed packages are looked up in the OSV.dev database.
How do I respond to what it finds?
- Active response (Linux and Windows): block or unblock an IP at the firewall, kill a process, disable or enable an account, isolate or release a host, restart a service or run your own script. Six default policies can trigger these automatically.
- Threat hunting: search raw telemetry (processes, connections, DNS, logs, executions, USB) by time and machine. Raw telemetry is kept for 30 days.
- Correlation: an alert is raised when the same activity hits 2 or more machines within an hour. You can load your own indicators (SHA-256 hashes, IPs and domains).
- Incidents: critical events open an incident automatically, with response and resolution deadlines set by priority (P1 to P4). Missed deadlines are escalated to your team.
SOC logs are kept for one year (365 days) by default, above the 180-day CERT-In minimum. Alerts and incidents can be forwarded to your SIEM through the integrations.
How do I install it?
On Linux the agent installs with one command. Windows and macOS have their own install steps, and you can also deploy with Docker or as a Kubernetes DaemonSet. Agent binaries and update manifests are signed with Ed25519, and the agent checks the signature before it updates itself.
Deploying an agent costs 25 credits and each new machine costs 15 credits to register. Step-by-step instructions are in the install guide.
Install the agent on your first host.
Read the install guide