Skip to content

Introduction

Sicura Agent is an auxiliary tool used with the Sicura Console to provide compliance scans and enforce compliance on a node.

System Requirements

Sicura Agent has full scanning and enforcement support for various versions of Windows as well as numerous Linux distributions.

Windows

  • Scanners included: CIS-CAT Assessor Pro v4, SCC (DISA SCAP Compliance Checker)
  • Enforcement supported: yes, via Puppet/OpenVox agent (8.0 or later); Puppet Bolt (3.1 or later) can be selected as the enforcement tool instead, but installing Bolt alone is not sufficient
  • Versions supported:
    • Windows Server: 2016, 2019, 2022, 2025
    • Windows 11
    • Windows 10 (DISA benchmarks only; Windows 10 is EOL)

Linux

  • Scanners included: OpenSCAP, CIS-CAT Assessor Pro v4
  • Enforcement supported: yes, via Puppet or OpenVox agent (8.0 or later)
  • Versions supported (x86_64 and aarch64):
    • RHEL: 8.2+, 9, 10
    • Alma Linux: 8, 9, 10
    • Rocky Linux: 8, 9, 10
    • Oracle Linux: 8, 9, 10

Note: Available benchmark content varies by platform and provider — CIS benchmarks ship for all of the platforms above, while DISA STIG benchmarks cover a subset (RHEL and Oracle Linux on the Linux side).

The Agent uses minimal system resources until the time of scanning/enforcement. Expect the normal load usually used by whatever ability type is being run.

We recommend running the Agent on a system with:

  • 1 GB of free disk space
  • 2 GB RAM minimum, 6 GB recommended
  • quad-core CPU

Getting Started

The only step required to get up and running is to connect the Sicura Agent to your Sicura Console instance.

This is done by ensuring a DNS entry is made matching sicura-console-collector to the valid IP or hostname of your Console instance. If this cannot be done due to restrictive policy or you'd like to override the default, the IP or hostname can be entered to the collector .

Furthermore, ensure the collector-port and collector-https configuration options are set properly to match the Console configuration.

Once initial configuration is complete, the Agent can be started with sicura-agent or systemctl start sicura-agent commands (On all Windows machines, the Sicura Agent service is started by default).