Onboarding a host

Each monitored host runs the SheerSight agent, which connects outbound to the console. There are no inbound ports to open and no firewall changes to make.

What you'll need

• Access to the SheerSight console.
• A host you can run the agent on (a VM or server you administer).
• Any source credentials you want the host to collect from — these are encrypted in your browser before they ever leave it.

Steps

1. Add the host in the console and get its enrollment details.
2. Install the agent on the host.

   # illustrative — use the exact command the console gives you
   sheersight-agent enroll --token <enrollment-token>
   

3. Provide any source credentials through the console. They are encrypted client-side and delivered to the agent as ciphertext; the agent decrypts them locally.
4. Verify the host appears in the fleet and is reporting (see below).

Verify it's working

• The host shows as online in the console's fleet view.
• Detections/telemetry begin appearing for that host within a few minutes.

No inbound access

Because the agent dials out, the host needs no public IP, no port-forwarding, and no inbound firewall rule. It works behind NAT.

Troubleshooting

• Host not showing online: confirm the agent process is running and the host has outbound internet access.
• No detections: re-check the source credentials you provided in the console.