Getting started
Requirements and network
Supported systems
The console shows the same status per platform under Agents → Add agent:
| Platform | Status | Notes |
|---|---|---|
| Linux x86_64 with systemd | available | One installation line per host. Static binary, so it does not depend on the libraries of the distribution. |
| Windows 10/11, Server 2016 and later (x64) | available | One PowerShell line per host. Also Server Core. |
| Linux on ARM64, or Linux without systemd (OpenRC, SysV, upstart) | planned | Not available through the installation line. |
| macOS | planned | |
| FreeBSD, OpenBSD | planned | |
| Docker and Podman images | beta | Scanned by the agent of the host they run on; install the Linux or Windows agent there. |
| Network devices (pfSense, OPNsense, FortiGate, MikroTik, UniFi, Arista, Synology, QNAP) | beta | Agentless: read with a read-only account by a connector, an agent in the same network whose local policy allows that role. |
| Kubernetes, cloud accounts | planned |
"Available" means the installation path works and is proven on real hosts. "Beta" means it works and was tested in a lab or against simulators. "Planned" means it is not usable yet.
Vulnerability coverage per Linux distribution
The agent runs on any x86_64 Linux with systemd, but findings for distribution packages need the distribution's own security data (see Vulnerability matching). SEK Systems reads that data for:
- Covered: Debian (also extended LTS), Ubuntu, Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, Oracle Linux, SUSE, Fedora, Alpine, Arch Linux.
- Not covered yet: Amazon Linux, Gentoo, and other distributions without one of these sources.
On a distribution that is not covered, the inventory, exposure and hardening checks work, but distribution packages produce no CVE findings; the Coverage figure of the host shows this. Language packages (npm, PyPI, Maven, Go, Cargo, RubyGems, NuGet, Packagist) and software outside the package manager are matched on every distribution.
Rights on the host
- Linux: run the installer as root (
sudo). The agent runs as root, because installing updates and reading the full inventory need it. What it may change is limited by the local policy. - Windows: run PowerShell as Administrator. The services run as LocalSystem.
Resources
The agent is a single static program. It collects the inventory every 5 minutes (installation line on Linux) or every 15 minutes (Windows and packages) and sends only what changed. Version checks of software that is not managed by a package manager run only for programs that listen on the network, with a fixed list of version flags.
Outbound connections
The agent only connects out. It opens no listening port on the host and needs no inbound firewall rule.
| Destination | Port | Used for | Required |
|---|---|---|---|
console.sek.systems |
TCP 443 (HTTPS) | Installer download, enrollment, agent updates (/repo/), and the agent connection |
yes |
console.sek.network |
TCP 443 (HTTPS/WSS) | The agent connection (secure WebSocket) | yes, for agents that received it as endpoint |
ip4.sek.systems, ip6.sek.systems |
TCP 443 (HTTPS) | Finding the public (WAN) address of the host, once an hour | no; switch off with [egress] discover = false in the local policy |
| Your own domain, if you set one up | TCP 443 | The agent connection through your own name (Settings → Domains) | only if configured |
Allow these names on your firewall or web filter by name, not by IP address: addresses can change.
The agent receives its list of endpoints at enrollment and tries them in order. It reconnects by itself after a network interruption, with a growing delay between 1 second and 15 minutes.
TLS inspection and proxies
- The agent checks the server certificate against the public web roots that are built into the agent, not against the certificate store of the host. TLS inspection (a middlebox that replaces certificates) therefore breaks the connection. Exclude the names above from inspection.
- Even if a middlebox could read the TLS traffic, the messages are encrypted and authenticated a second time between the agent and SEK Systems. See Security model.
- HTTP proxies are not supported for the agent connection: it connects directly. Allow direct outbound HTTPS to the names above.
Antivirus and EDR
The agent is a signed (Windows) or checksum-verified program that installs packages and restarts services, which some security products watch closely. If your antivirus or EDR blocks or quarantines it, allow these:
| System | Programs | Folders |
|---|---|---|
| Linux | /usr/local/bin/sec-agent, /usr/local/bin/sec-supervisor, /opt/sec-agent/slot-a/sec-agent, /opt/sec-agent/slot-b/sec-agent |
/opt/sec-agent, /var/lib/sec-agent, /etc/sec |
| Windows | C:\Program Files\SEC\sec-supervisor.exe, C:\Program Files\SEC\slot-a\sec-agent.exe, C:\Program Files\SEC\slot-b\sec-agent.exe |
C:\Program Files\SEC, C:\ProgramData\SEC |
Allow the two slot paths: after an update the agent runs from the other slot. The child processes the agent starts are the system's own tools (for example apt, dnf, systemctl, msiexec, Windows Update), and only during approved jobs.
Time
The agent refuses jobs whose validity window does not match the host clock (clock_skew). Keep the host time
synchronised (NTP, or the Windows time service).
Before you install
- The host has outbound HTTPS to the names above.
- You have an owner or admin account (only they can create installation lines).
- Decide the profile:
observe(report only) orpatch(default: updates and service restarts within the policy). See Local policy.