v0.1.0
Install Ferro Sentry
A single command installs the agent, configures your security token, and registers it as a system service. Up and running in under 60 seconds.
Quick install
1
Run the install script
The script detects your architecture, downloads the correct binary from GitHub Releases, and sets up a systemd service.
Terminal
curl -fsSL https://install.ferrosentry.dev | sudo bash2
Enter your auth token when prompted
Get your token from the SecuryBlack dashboard. You can also pass it via environment variable to skip the prompt.
Token setup
Enter your Ferro Sentry token: fs_live_xxxxxxxxxxxxYour token authenticates the agent against the local Nexus Agent / SecuryBlack API. Keep it secret — treat it like a password. Rotate it from the dashboard if compromised.
3
The agent starts automatically as a systemd service
Verify
# Check the service status
systemctl status ferrosentry
# Verify active auditing logs
journalctl -u ferrosentry -fExpected output
● ferrosentry.service - Ferro Sentry EDR & Auditing Agent
Loaded: loaded (/etc/systemd/system/ferrosentry.service; enabled)
Active: active (running) since Mon 2026-04-28 12:00:00 UTC
Main PID: 4317 (ferro-sentry)
Apr 28 12:00:01 myserver ferro-sentry[4317]: INFO ferro_sentry: active defense sensors running, connected to Nexus Agent gRPCManaging the service
The agent runs in the background with automatic restart on failure.
systemd
# Start
systemctl start ferrosentry
# Stop
systemctl stop ferrosentry
# Restart
systemctl restart ferrosentry
# Enable on boot (already done by installer)
systemctl enable ferrosentry
# Live logs
journalctl -u ferrosentry -fConfiguration
Ferro Sentry reads configuration from environment variables or a TOML config file. Environment variables always take priority.
| Variable | Default | Description |
|---|---|---|
| FERROSENTRY_TOKEN | — | Auth token (required) |
| FERROSENTRY_ENDPOINT | 127.0.0.1:4317 | gRPC Nexus Agent endpoint |
| FERROSENTRY_AUDIT_INTERVAL | 300 | Posture scan interval in seconds |
| FERROSENTRY_LOG_LEVEL | info | Log verbosity (trace, debug, info, warn, error) |
| FERROSENTRY_RULES_DIR | /etc/ferrosentry/rules | Custom YAML rules directory |
config.toml (optional)
# /etc/ferrosentry/config.toml (Linux)
token = "fs_live_xxxxxxxxxxxx"
endpoint = "127.0.0.1:4317"
audit_interval = 300
log_level = "info"Supported platforms
| OS | Architecture | Status | Binary |
|---|---|---|---|
| Linux (Ubuntu, Debian) | x86_64 (amd64) | Stable | ferro-sentry-linux-x86_64 |
| Linux (Ubuntu, Debian) | ARM64 (aarch64) | Stable | ferro-sentry-linux-arm64 |
| Windows | x86_64 | Stable | ferro-sentry-windows-x86_64.exe |
| Windows | ARM64 | Beta | ferro-sentry-windows-arm64.exe |
| macOS | x86_64 | Coming soon | — |
| macOS | ARM64 (Apple Silicon) | Coming soon | — |
Uninstall
bash
systemctl stop ferrosentry && systemctl disable ferrosentry
rm -f /usr/local/bin/ferro-sentry
rm -f /etc/systemd/system/ferrosentry.service
rm -rf /etc/ferrosentry /var/lib/ferrosentry
systemctl daemon-reload