Aegis V2 Installation

Aegis V2 is the current endpoint agent. Aegis V1 is deprecated. Use V2 for new deployments. V1 installers (Windows, MSI, DEB, RPM, OVA) do not install V2.

Open Endpoints, then Set Up Endpoint (empty table) or Add Endpoint (when rows exist). The dialog title is Set up Aegis V2 endpoint. It is a three-step wizard: Requirements → Install → Enroll. Enrollment controls require manage_endpoints.

Requirements

Step 1 of 3 lists what the host must provide:

• Linux amd64 host — A 64-bit Linux host you already have. The host is not in Guard until you approve it in this dialog. Debian 12 and Ubuntu 22.04/24.04 can auto-install Docker Engine and nftables. Other distributions must have both installed beforehand.
• sudo access — The installer must run with sudo on that Linux host.
• Docker Engine — The installer attempts to install Docker Engine when it is missing, unless your organization manages host packages.
• Guard HTTPS egress — Allow outbound HTTPS from the host. No inbound ports. Guard lists the environment domains here.
• Cloudflare outbound TCP/UDP 7844 — Required so the host can reach Guard after install. Review Cloudflare firewall requirements.

Optional: My organization manages host packages — appends --no-install-dependencies to the install command.

Windows, macOS, Docker Desktop, rootless Docker, and arm64 are not supported.

Click Next.

Install

Step 2 of 3 offers two methods. Clicking a method mints a short-lived tenant kit (pinned agent, launcher, checksums, enrollment config). Do not paste signed URLs into tickets or chat. Generate a fresh kit if it expires (Guard remints when the signed URL is expired or within 60 seconds of expiry).

Install with curl — Run the command Guard shows on the Linux host (curl the kit, extract, then sudo ./aegis-agent_linux_amd64 install --config ./aegis-agent-install.json). Copy keeps && between lines.

Download and transfer — Download the kit in the browser, copy it to the Linux host, then extract and run the same install command there.

If minting the kit fails, Retry sits in the error callout. Method cards stay visible.

Leave the installer running when it shows the short enrollment code.

Click Next.

Enroll

Step 3 of 3: enter the eight-character enrollment code. Inspect tenant, endpoint identity, expiry, and reported host details with the person on the host. Hostname, OS, architecture, and version are reported by the installer, not independently verified.

Approval installs identity; it does not prove connectivity. The endpoint stays Not connected until the daemon heartbeats. The installer then starts aegis-agent.service, waits up to 90 seconds for an acknowledged heartbeat, and only then enables the service at boot. Heartbeat failure stops the service and fails install.

If Guard shows Approval not confirmed, check the host before starting another enrollment — approval may have succeeded.

Rerunning the installer on the same account does not require a second approval. It rejects an account mismatch or expired identity.

After install

The endpoint appears on Endpoints. Empty state: No Aegis Endpoints Found. Drawer tabs: Overview, Health; Control is Praetorian-only. Revoke is Praetorian-only.