Skip to content

Installation

Installing

Installing the Sicura Agent is easy on both Windows and Linux systems.

Begin by having an instance of Sicura Console up and running.

Once you've logged into your Console, navigate to the Infrastructure -> Management page and click the Agent Downloads link at the top of the page.

Here you will see a set of instructions on how to get started with the Agent.

On the Agent Downloads page, download the installer for your operating system:

  • Windows — the .msi installer
  • Linux — the .rpm package

The installation packages can also be downloaded directly, without logging into the Console, by replacing <console-url> and <port> with your Console's address:

  • Windows — https://<console-url>:<port>/client/windows/latest (downloads the .msi installer)
  • Linux — https://<console-url>:<port>/client/el/latest (downloads the .rpm package)
  • Linux package repository — https://<console-url>:<port>/client/repo (downloads the sicura-agent.repo repository definition; see Linux below)

Linux

The Sicura Agent requires the following packages:

  • openscap-scanner — available in the @updates repository
  • puppet-agent (8.0 or later) or openvox-agent (8.0 or later) — available in the Puppet and OpenVox repositories
  • iproute — available in the base OS repositories

Note: EL7 is supported only by Agent versions prior to 2026.7.0. If you are running an older Console release, see the documentation for that release.

The Puppet repository can be installed by running:

  • EL8 — yum install https://yum.puppet.com/puppet8-release-el-8.noarch.rpm
  • EL9 — yum install https://yum.puppet.com/puppet8-release-el-9.noarch.rpm

Alternatively, the OpenVox repository can be installed by running:

  • EL8 — yum install https://yum.voxpupuli.org/openvox8-release-el-8.noarch.rpm
  • EL9 — yum install https://yum.voxpupuli.org/openvox8-release-el-9.noarch.rpm

Once the prerequisites are installed, install the Agent. The recommended method is the Agent package repository served by your Console — it selects the correct OS and architecture automatically and lets the Agent be updated with standard tooling (yum update or your patch automation):

curl -o /etc/yum.repos.d/sicura-agent.repo https://<console-url>:<port>/client/repo
yum install sicura-agent

Alternatively, install a directly downloaded package with yum install ./sicura-agent-<version>.rpm. A package installed this way does not receive updates until the next one is downloaded and installed manually.

Windows

Double click the .msi file. This will run you through an interactive installation. Follow the simple on-screen instructions for quick installation. You will be provided links to install prerequisites during the install wizard.

Note: The installer must be run as an administrator, and requires that Puppet Bolt (3.1 or later) or a Puppet/OpenVox agent (8.0 or later) is already installed.

For unattended installation, the .msi can also be run with msiexec, which accepts configuration properties on the command line:

msiexec /i sicura-agent-<version>.msi /qn COLLECTOR=console.example.com COLLECTOR_HTTPS=true
  • COLLECTOR — hostname or IP address of the Console collector the Agent should connect to
  • COLLECTOR_HTTPS — whether the Agent connects to the collector over HTTPS (default true)
  • INSTALLDIR — installation directory (default C:\Program Files\Sicura\Agent)
  • SERVICE_ACCOUNT — Windows account the sicura-agent service runs as (default .\LocalSystem)
  • SERVICE_PASSWORD — password for the service account, when one is required

COLLECTOR and COLLECTOR_HTTPS are written into sicura-agent.yaml during the first installation only; an existing config file is never overwritten. The chosen install directory and service settings are remembered in the Windows registry and reused on upgrade.

Important Things to Know

Once installed, it is important to know about certain files and directories that the Agent uses on your system.

File Locations

Linux

  • Binary: sicura-agent, installed to /usr/bin by default
  • Config file: /etc/sicura/sicura-agent.yaml

Windows

  • Binary: SicuraAgent.exe, installed to C:\Program Files\Sicura\Agent by default
  • Config file: C:\ProgramData\Sicura\Agent\sicura-agent.yaml

State Directory

This directory contains all of the current working state information used by the Agent to perform tasks. The Platform independent directory structure is: 

  state
      |_ benchmarks
          |_ scap
              |_ cis
              |_ stig
      |_ reports
      |_ state.json

You can find your Sicura_AUTHOR_Content***.xml files saved into the benchmarks/scap directories. The reports directory is the default location for all scan reports.

state.json contains the working login token for any collectors that an Agent has registered. It also contains a working list of all Sicura Compliance Engine reports that have been sent to the Console. A SHA256 sum of each file is saved to state.json each time the compliance report updates.

The state directory can be found at:

  • Linux — /var/db/sicura/agent/state
  • Windows — C:\ProgramData\Sicura\agent\state