Skip to main content

Install the agent

The agent is distributed from the Lumen download CDN — no credentials, no GitHub, works from any network. Every fresh install starts in monitor mode: every detector runs, every match is recorded, nothing is redacted or blocked until you promote a rule.

The one-liner​

curl -fsSL https://dl.lumen.wazuh.com/install.sh | sudo sh

The installer resolves the latest release, downloads the archive for your OS and architecture, verifies it against SHA256SUMS, installs the binary and a starter config, and registers the OS service. Re-running it is an upgrade; your edited config files are never overwritten.

Add --token=<enrollment token> (-Token on Windows) when enrolling into a tenant — the console's enroll wizard prints the full command with the token filled in.

note

Useful flags: --version vX.Y.Z, --no-service, --prefix DIR (rootless sandbox install), --base-url URL (mirrors and air-gapped sites), --uninstall.

Native packages​

.deb, .rpm and a universal macOS .pkg ship with each release:

apt install ./lumen-agent_*.deb

Config files are marked as conffiles, so local edits survive upgrades.

From source, for a demo laptop​

  1. Clone and build (Go ≥ 1.26 — the result is a single static binary):

    git clone https://github.com/wazuh/labs-lumen && cd labs-lumen/agent
    make build

  2. Check it runs:

    ./bin/lumen-agent version
    ./bin/lumen-agent inspect --text "Ignore all previous instructions"

That is enough for every demo. No service, no root, no cloud.

Install layout​

PathContents
/usr/bin/lumen-agent (deb/rpm), /usr/local/bin/lumen-agent (script, pkg)the binary
/etc/lumen/agent.yamlagent config
/etc/lumen/policy.yamlpolicy, shipped in monitor mode
/etc/lumen/disabledthe off-switch marker, absent unless lumen-agent disable wrote it
/var/lib/lumen/spool and findings
/var/log/lumen/launchd stdout/stderr on macOS

On Windows: C:\Program Files\Lumen\lumen-agent.exe and C:\ProgramData\Lumen\ for config and state.

Many machines, or an air-gapped site​

Mirror the CDN layout once on any internal HTTP server and point the installer at it:

aws s3 sync s3://lumen-agent-dl/v0.5.0/ /srv/lumen/v0.5.0/       # once
sh install.sh --base-url https://mirror.internal/lumen --version v0.5.0
Artifacts are not signed yet

SHA256SUMS is the integrity story today and the installers enforce it. Gatekeeper blocks a double-clicked macOS .pkg (install from the command line or via MDM); SmartScreen warns on Windows.

Next steps​