Documentation

Deploy an EthicalStrike sensor

The sensor is a small agent that runs inside your network, performs authorised testing, and reports to the portal. It runs on Linux, Raspberry Pi, Windows, in Docker, and on Proxmox. Pick your platform below. Every method ends the same way: the sensor enrols with a one-time token and appears under Sensors in the portal.

What you need

A host that stays on: a spare PC, a Raspberry Pi, a virtual machine, or a container.
An outbound internet connection to the portal. No inbound ports or port-forwarding are required.

The installer sets up everything the sensor needs — you do not have to install anything else by hand.

1. Get an enrolment token

In the portal, go to Sensors, choose the client, and select Generate enrolment token. The token is single-use: the sensor swaps it for its own credentials on first run. Keep it handy for the steps below.

Debian & Ubuntu

The package installs the sensor and everything it needs, then runs as a background service.

# install the sensor
sudo apt-get install -y ./ethicalstrike-sensor_0.1.0_all.deb

# add your portal URL and enrolment token
sudo nano /etc/ethicalstrike-sensor/sensor.conf
#   "portal_url": "https://api.ethicalstrike.com",
#   "enrolment_token": "<your-token>",
#   "name": "Head Office"

# start the sensor and enable it at boot
sudo systemctl enable --now ethicalstrike-sensor

Raspberry Pi

Option A — your own Raspberry Pi OS

On Raspberry Pi OS, use the same steps as Debian above. A Raspberry Pi 4 (2 GB or more) or Pi 5 is recommended.

Option B — dedicated EthicalStrike image

Flash the pre-built EthicalStrike Pi image to an SD card with Raspberry Pi Imager, enter your portal URL and token in the first-boot settings, and power on. The Pi enrols automatically.

Windows

Minimum: Windows 10/11 or Windows Server 2019 or newer. The sensor is a single installer that sets up a background service. From an elevated PowerShell:

powershell -ExecutionPolicy Bypass -File install.ps1 `
  -Portal https://api.ethicalstrike.com `
  -Token  <your-token> `
  -Name   "Store 123"

The service starts at boot and restarts automatically if interrupted.

Windows-only sites (via WSL)

If a location has only Windows PCs — common in small retail — you can run the sensor inside the Windows Subsystem for Linux. From an elevated PowerShell:

wsl --install -d Debian
# reboot if prompted, open the Debian terminal, then follow the Debian steps:
sudo apt-get install -y ./ethicalstrike-sensor_0.1.0_all.deb
sudo nano /etc/ethicalstrike-sensor/sensor.conf   # portal_url + enrolment_token
sudo service ethicalstrike-sensor start

For always-on operation, enable systemd in WSL and start the Debian distribution at login, or use the native Windows installer above.

Docker

Run the sensor as a container with host networking so it can reach the network it assesses. The image is fully self-contained.

AS_ENROL_TOKEN=<your-token> \
  docker compose -f sensor/packaging/docker/docker-compose.yml up -d --build

# or a plain run:
docker run -d --name ethicalstrike-sensor --network host \
  --cap-add NET_RAW --cap-add NET_ADMIN \
  -e AS_PORTAL_URL=https://api.ethicalstrike.com \
  -e AS_ENROL_TOKEN=<your-token> \
  -e AS_SENSOR_NAME="docker-sensor" \
  -v es-sensor-conf:/etc/ethicalstrike-sensor \
  ethicalstrike-sensor:local

The named volume keeps the credential issued at enrolment across restarts.

Proxmox VE

As a virtual machine

Create a small Debian virtual machine (1 vCPU, 1 GB RAM, 8 GB disk is plenty), give it access to the networks you want to test, then follow the Debian steps.

As a container (LXC)

Create a Debian LXC container with access to raw sockets (run it privileged, or add the required network capabilities), then use the Debian steps or run the Docker image inside it.

RHEL, CentOS, Rocky & AlmaLinux

EthicalStrike also supports the RHEL 9 family. The simplest route is the Docker/Podman container method above. A dedicated installer for these distributions is available on request — contact us.

Connectivity & firewalls

The sensor only makes outbound connections to the portal over HTTPS (port 443). It never needs any inbound access or port-forwarding. If the network reaches the internet directly, nothing extra is required.

Behind a web proxy

If this network reaches the internet only through a proxy, tell the sensor to use it. On Linux or Windows, add your proxy to the sensor configuration:

"proxy_url": "http://proxy.example.local:8080"

A proxy that needs sign-in uses the form http://user:password@proxy.example.local:8080. With Docker, pass it as -e AS_PROXY_URL=http://proxy.example.local:8080.

Firewall allow-list

If outbound traffic is restricted, ask your system administrator to allow the sensor host to reach the following over HTTPS (443):

api.ethicalstrike.com
scan.ethicalstrike.com

Verify

On Linux: the service shows as active and running.
In the portal: the sensor appears under Sensors with a recent check-in.
Create an engagement for the client, choose the sensor, set the in-scope ranges and an authorisation reference, and run it.

Need a hand? Contact us at hello@ethicalstrike.com.au or +61 2 5100 6444.