Endpoint agents
The Orbital endpoint agent is a small program you install on your computers: laptops, desktops and servers. It runs as a service and reports to your Orbital console: What the computer is: its name, operating system, hardware and network addresses. What's installed: software, and on Windows and macOS the installed updates. Orbital checks that inventory against its vulnerability database on the server, so you see vulnerabilities on computers that network scans can't reach, such as laptops away from the office. Nothing is scanned on the computer itself. All traffic is outbound HTTPS from the agent to your console. Agents update themselves, and roll back if an update fails. [!NOTE] The install commands check the installer before running it: they download the script, compare its SHA-256 checksum with the one in the command, and run it only if they match. Otherwise they stop with Checksum mismatch: this is not the OrbitalCyber installer. Nothing was run. Copy the commands from Endpoints each time: the checksum changes with each release. Supported systems System Versions CPUs Installers Windows Windows 10, 11 and Windows Server x64, ARM Install command (PowerShell), MSI, agent download macOS — Apple silicon, Intel Install command, PKG, agent download Linux Any distribution with systemd x64, ARM Install command, agent download On Linux, installed software is read from the dpkg or RPM package database. Updates on Linux are just newer package versions, so there is no separate Updates list. [!NOTE] The Windows MSI is 64-bit (x64). Windows on ARM runs it under emulation. To get the native ARM agent, use the PowerShell install command instead. Before you start You need to be an org owner or admin, or have the sensor manager role, to create enrollment tokens. In a personal account you can always create them. Every computer needs outbound HTTPS to your console's address (the address you use to sign in). You need administrator rights (Windows) or root (macOS and Linux) on each computer. Step 1: Create an enrollment token In the console, open Endpoints and click Deploy agents. Enter a Name that says where you'll use the token, for example "Intune – laptops". Set Valid for (days). You can choose 1 to 365 days, and the default is 30. Set an Install limit, or leave it at 0 for no limit. Click Create token. [!WARNING] Copy the token now. It's shown only once. The console then shows the install commands for each method, with your token and server address already filled in. One token can enroll as many computers as you like until it expires, reaches its install limit, or you revoke it. Revoking a token stops new installs only. Computers already enrolled with it keep working. The Enrollment tokens list shows each token's status (active, used up or expired) and how many installs it has done. Step 2: Install the agent In the commands below, replace https://orbital.saas.sageisg.com and <token> with your own values. Or copy the commands from the console, where they're already filled in. Windows: PowerShell Run this in PowerShell as Administrator: The script downloads the right agent for the computer's CPU, checks its SHA-256 checksum, and installs it. Windows: MSI installer Download the MSI from Endpoints → Install the agent → Windows installer (MSI). The installer has no screens for entering the server and token, so always pass them as the SERVER and TOKEN properties. From an elevated command prompt: /qn installs silently. Leave it out to see the progress window. The token is kept out of the Windows Installer log. If enrollment fails (for example, the token has expired), the MSI rolls back and nothing is left installed. The agent appears in Apps as Orbital Cyber endpoint agent. macOS: PKG installer Download the PKG from Endpoints → Install the agent → macOS package (PKG). It works on both Apple silicon and Intel Macs. The package reads the server and token from a small config file, /Library/Application Support/OrbitalCyber/endpoint-install.conf, with…
OrbitalCyber documentation