Deploy Your First Collector

Overview

A collector is the outbound-only agent that performs discovery, SNMP polling, configuration backup, log collection and local vulnerability checks for a site. It never accepts inbound connections: every exchange with AssurIQ is a collector-initiated mutual TLS (mTLS) session over 443.

This guide takes you from choosing a form factor to confirming the first heartbeat. Budget 15-20 minutes for a single collector.

Choose a form factor

Pick the form factor that matches the target host. All form factors report identical evidence; the difference is only how the process is packaged and supervised.

Create an enrollment token

From the site's Collectors panel, generate a token scoped to that site. Tokens are single-use by default, expire after 24 hours, and can be revoked before use.

1. 1
   Open the site

   Navigate to the site record and select Collectors.
2. 2
   Generate token

   Click New Collector and choose the target OS or Docker. AssurIQ generates an ENROLL_TOKEN value and a ready-to-run install command.
3. 3
   Copy the command

   Copy the full install command; it embeds the token and the correct ingest region.

Install on Windows

Run PowerShell as Administrator on the target host.

$ENROLL_TOKEN = "aiq_enr_9f2c...redacted"
Invoke-WebRequest -Uri "https://dl.assuriq.io/collector/windows/AssurIQCollector.msi" -OutFile "$env:TEMP\AssurIQCollector.msi"
msiexec /i "$env:TEMP\AssurIQCollector.msi" /qn ENROLL_TOKEN=$ENROLL_TOKEN

The installer registers the AssurIQCollector Windows service, stores the enrollment certificate under the machine's protected credential store, and starts the service automatically.

Install on Linux

Supported on Ubuntu 20.04+, Debian 11+ and RHEL 8+. Run as root or with sudo.

export AIQ_ENROLL_TOKEN="aiq_enr_9f2c...redacted"
curl -fsSL https://dl.assuriq.io/collector/linux/install.sh | sh

The script installs the assuriq-collector systemd unit, enables it at boot, and enrolls immediately using the token in the environment.

systemctl status assuriq-collector

Install with Docker

Use host networking so the collector can see local broadcast, ARP and multicast discovery traffic. Without host networking, discovery accuracy is degraded.

docker run -d \
  --name assuriq-collector \
  --network host \
  --restart unless-stopped \
  -e AIQ_ENROLL_TOKEN="aiq_enr_9f2c...redacted" \
  -v assuriq-collector-data:/var/lib/assuriq \
  assuriq/collector:latest

Outbound endpoints

Collectors are outbound-only. Allow the following destinations on any egress firewall or proxy before installing.

Verify the first heartbeat

After enrollment, the collector sends its first heartbeat within 60 seconds. In the site's Collectors panel, the status dot changes from Enrolling to Healthy and a last-seen timestamp appears.

1. Open the site record and select Collectors.
2. Confirm the new collector shows a Healthy status and a recent last-seen time.
3. Confirm the collector's reported version matches the current release channel.

What happens next

Once healthy, the collector begins its first discovery cycle automatically: ARP and ICMP sweeps, SNMP polling of any pre-configured credential profiles, and LLDP/CDP neighbor collection. Results typically appear in Asset Inventory within 15-30 minutes.

• Initial Discovery
  What the first discovery cycle finds, how assets are reconciled and what to classify by hand.
• Network Discovery
  ARP, ICMP, SNMP, LLDP/CDP and DHCP seeding; scopes and schedules.
• Enrollment Tokens
  Create, scope, expire and revoke enrollment tokens.

Troubleshooting

If the collector does not report Healthy within a few minutes, check the service status locally, then confirm outbound connectivity to ingest.assuriq.io on 443.

• AIQ-COL-001Collector offline
  The collector has not sent a heartbeat within the expected interval. Discovery, scans and evidence collection for its sites are paused.
• AIQ-COL-002Collector version unsupported
  The collector is more than two releases behind and some evidence types will not be collected.

• Troubleshoot Offline Collector
  Symptom-first guide for AIQ-COL-001 with exact checks in order.
• mTLS and Connectivity
  Outbound-only mutual TLS, endpoints to allow-list, certificate rotation.