Install the ThreatClaw agent
Deploy the endpoint agent in minutes on Linux and Windows
The ThreatClaw agent is a small osquery-based collector. It pushes an inventory and endpoint telemetry (running processes, network connections, listening ports, logged-in users, installed software, OS details) to your instance every 5 minutes.
Typical footprint is about 100 MB RAM and under 2% CPU, hard-capped by a watchdog. No inbound ports are opened on the endpoint, the agent only makes outbound HTTPS calls to ThreatClaw.
Replace THREATCLAW_HOST everywhere with the address of your instance (e.g.
192.168.1.10 or threatclaw.yourcompany.local). If your dashboard listens on
a custom port, append it (e.g. THREATCLAW_HOST:8445).
1. Generate an agent token
In the dashboard, open Settings → Sources → Agent and generate a token. The same token can be reused for every host in a deployment.
2. Install on Linux (Debian, Ubuntu, RHEL, CentOS)
curl -fsSL https://get.threatclaw.io/agent | sudo bash -s -- \
--url https://THREATCLAW_HOST \
--token YOUR_AGENT_TOKENThe script installs the agent as a systemd service and starts collection automatically.
3. Install on Windows
Open PowerShell as Administrator and use the Windows installer linked from the dashboard under Settings → Sources → Agent, with the same host and token as for Linux.
4. Verify telemetry is flowing
Within a few minutes the host appears under Assets in the dashboard. You can also probe instance health:
curl https://THREATCLAW_HOST/api/tc/healthThe response should be HTTP 200.
5. Rolling it out at scale
To push the agent to dozens or hundreds of hosts, run the same one-liner through your existing deployment tooling (Ansible, GPO, your config manager). The same token stays valid.
Once the agent is in place, also wire one or two network sources (firewall, servers) over syslog or an existing Wazuh to get both endpoint and perimeter visibility from day one.