Deploying Agents — Overview
An agent is a small background service you install on a device. Once running, it registers with your Guardian hub and starts reporting — no manual configuration beyond the install step.
Every install method needs an enrollment token, which ties the new agent to your tenant. Get one from Deploy Agent in the dashboard sidebar, or from Settings → Add Device.
Choose a method
Section titled “Choose a method”| You want to… | Use |
|---|---|
| Install on your own Windows PC | Windows — graphical installer |
| Roll out to Windows with Intune, SCCM or Group Policy | Windows — silent MSI or setup program |
| Install on your own Linux or macOS machine | Linux / macOS — one-line terminal command, or a .deb / .rpm / .pkg package |
| Discover a Kubernetes cluster’s nodes and pods | Kubernetes — one in-cluster collector via kubectl apply |
| Send install instructions to someone else | Enrollment Links — a link that needs no dashboard login |
| Install on many machines at once | Mass Deployment — scripted rollout via RMM, SSH fan-out, or Ansible |
What happens after install
Section titled “What happens after install”- The agent registers with your hub using the enrollment token.
- It appears in Agents within about 30 seconds.
- It starts reporting hardware, processes, uptime, drive health, and (if enabled) network discovery data on its normal schedule.
- It watches itself. If someone ends the agent or its service, or it uses more memory than it should, Guardian tells you. See Agent health and stopped agents.
Enrollment tokens expire 30 days after creation by default (configurable up to 365) and can be revoked early. The actual download link generated from a token is short-lived — signed and valid for 15 minutes — so copy-pasted install commands should be run soon after you generate them. Neither expiry affects agents that already enrolled.