What this is for
Connect endpoint is the button at the top right of Endpoint AI Risk › Fleet (it also opens from the empty fleet, from Inventory and from the Skills Marketplace). It walks through the three things a machine needs before it reports: the agent installed, an endpoint key, and one enroll command. Fleet administrators use it; the same steps work for one laptop by hand or for a thousand through an MDM.The three steps
1
Install gw-cli
The dialog offers a download for every platform, with the machine you are browsing from preselected. Pick the package, not the archive, for anything that is not an evaluation:
Installing the package is the whole install. It starts the agent for every signed-in user right away and at every sign-in after that, in the Observe posture. See macOS, Windows and Linux.
2
Issue an endpoint key
Type a Machine label (for example
dana-mbp) and click Generate key. The key begins with sk-ep-, enrolls one machine, and is shown once: copy it before you close the dialog. Issue one key per machine so you can tell them apart in Fleet.3
Enroll the machine
The dialog fills your key into the command. Run it on the machine as the signed-in user:
--verify sends a first report straight away. The machine appears in Fleet within a minute. Details, including what to run on a managed install and how to script it, are on Activate.Which install do I want?
The archives carry the same binary and a per-user
install.sh or install.ps1. They are fine for
trying the agent, and the Agent overview covers
them. Use the packages for anything you will manage.
Downloads and checksums
Every release is published athttps://api.guardway.ai/v1/downloads/gw-cli/<version>/<file>, and the
newest at .../gw-cli/latest/<file>. A SHA256SUMS file sits next to the packages in each folder;
the Linux packages also ship a .sha256 each. Verify before you push a package to a fleet:
The download buttons in the console appear once downloads are switched on for your organization.
Until then the dialog shows the archive command, and the URLs above still work.
Before a fleet rollout
- Allow the hosts on Network Requirements on each machine. The agent ignores proxy settings and trusts only public certificate authorities.
- On macOS, push a Full Disk Access profile with the package; without it the agent cannot read
~/Desktop,~/Documentsand~/Downloads. See macOS. - Decide the install mode. Every package installs Observe by default, which never changes how a developer’s tools behave. The managed install adds the root-level service that Enforce, Live guard Block and skill custody need. Activate explains how to choose it per OS.
- Create an Endpoint AI Policy for the machines before they arrive, or they take the policy bound to All endpoints.