Installing the Universal Sensor

The Universal Sensor is installed using a single command per operating system. The command is generated for your tenant by the SenseOn platform and includes your installer key. Once executed, the installer downloads and installs the latest published version of the Universal Sensor automatically.

Where to find your install command: Log in to SenseOn and navigate to Settings > Universal Sensor. The page displays a ready-to-copy command for each supported operating system, pre-populated with your tenant's installer key.

What the Install Command Does

The command performs the following steps on the endpoint:

Downloads the install script (install.sh or install.ps1) from your tenant's SenseOn domain.
Validates that the SENSEON_INSTALLER_KEY environment variable is present.
Determines the correct package for the host's operating system and architecture.
Downloads and installs the latest published version of the Universal Sensor.
Starts the SenseOn Seed Service and registers the host in Digital Estate > Devices.

Re-running the install command on Windows. On a host where the SenseOn bootstrapper is already installed, re-running the install command does not currently re-register the agent, and can fail rather than completing as a no-op. To reinstall a Windows host, uninstall SenseOn first (see 'Uninstalling SenseOn'), then run the install command again.

Version management: The install command always installs the latest published Universal Sensor version. To pin or change which version a device runs after installation, use Settings > Device Configuration.

Ubuntu / Debian

Requires: Ubuntu 18.04 or later, or Debian-based distribution with apt.

Copy the command from Settings > Universal Sensor and run it on the target host. The command has the following structure:

curl -fsSL https://<your-tenant>.senseon.io/install.sh \
  | sudo SENSEON_INSTALLER_KEY="<your-installer-key>" bash

The platform displays a SHA-256 checksum next to the command. If your security policy requires checksum verification before executing remote scripts, download the script first, verify the checksum, then run it:

curl -fsSL https://<your-tenant>.senseon.io/install.sh -o install.sh
sha256sum install.sh   # compare against the value shown in Settings > Universal Sensor
sudo SENSEON_INSTALLER_KEY="<your-installer-key>" bash install.sh

Red Hat / CentOS

Requires: CentOS 7 or later, RHEL 7 or later, or another RPM-based distribution.

The command is identical to the Ubuntu / Debian command. install.sh detects the package manager and uses rpm automatically:

curl -fsSL https://<your-tenant>.senseon.io/install.sh \
  | sudo SENSEON_INSTALLER_KEY="<your-installer-key>" bash

The platform displays a SHA-256 checksum next to the command. If your security policy requires checksum verification before executing remote scripts, download the script first, verify the checksum, then run it:

curl -fsSL https://<your-tenant>.senseon.io/install.sh -o install.sh
sha256sum install.sh   # compare against the value shown in Settings > Universal Sensor
sudo SENSEON_INSTALLER_KEY="<your-installer-key>" bash install.sh

macOS

Requires: macOS Catalina (10.15) or later. Apple Silicon (M1 or later) is supported.

curl -fsSL https://<your-tenant>.senseon.io/install.sh \
  | sudo SENSEON_INSTALLER_KEY="<your-installer-key>" bash

The platform displays a SHA-256 checksum next to the command. If your security policy requires checksum verification before executing remote scripts, download the script first, verify the checksum, then run it:

curl -fsSL https://<your-tenant>.senseon.io/install.sh -o install.sh
shasum -a 256 install.sh   # compare against the value shown in Settings > Universal Sensor
sudo SENSEON_INSTALLER_KEY="<your-installer-key>" bash install.sh

After installation, grant the SenseOn agent Full Disk Access:

Open System Settings > Privacy & Security.
Scroll to Full Disk Access and select it.
Enable the toggle for senseon-see.app and enter your password.
Restart the agent: sudo seectl stop && sudo seectl start.

Windows

Requires: Windows 8.1 or later, Windows Server 2012 R2 or later.

Run in an elevated PowerShell terminal. Open Start, search for PowerShell, right-click it and select Run as administrator. The install script requires administrator privileges and will fail if run in a standard session.

Run the command:

$env:SENSEON_INSTALLER_KEY="<your-installer-key>"; `
  iwr -useb https://<your-tenant>.senseon.io/install.ps1 | iex

The platform displays a SHA-256 checksum next to the command. If your security policy requires checksum verification before executing remote scripts, download the script first, verify the checksum, then run it:

# Step 1: Download the script
Invoke-WebRequest -UseBasicParsing -Uri "https://<your-tenant>.senseon.io/install.ps1" -OutFile install.ps1
# Step 2: Verify the checksum (compare against the value shown in Settings > Universal Sensor)
Get-FileHash install.ps1 -Algorithm SHA256
# Step 3: Run the script
$env:SENSEON_INSTALLER_KEY="<your-installer-key>"
powershell.exe -ExecutionPolicy Bypass -File install.ps1

For a remote / unattended install via your software management tool, wrap the command in a script and have your MDM execute the script with administrator privileges. See the Automated Deployment guides for tool-specific instructions. If you run Active Directory without an endpoint management tool, see Deployment with Group Policy (GPO).

If the install fails, see Troubleshooting: Running the Install Script in Verbose Mode for steps to capture diagnostic output.

Installing Through or Around a Proxy

By default the install script and the bootstrapper's first contact with the platform follow the host's system or environment proxy settings. On hosts where that is not what you want, the install script accepts two optional, mutually exclusive options:

Linux / macOS (`install.sh`)	Windows (`install.ps1`)	Effect
`--proxy host:port`	`-Proxy host:port`	Route the script's own install requests, and the bootstrapper's first fetch, through the named HTTP CONNECT proxy.
`--direct`	`-Direct`	Force a direct connection, ignoring any system or environment proxy. Use this on on-premises hosts whose configured proxy cannot reach the appliance.

--proxy and --direct cannot be used together. Pass one or the other. Supplying both causes the script to exit with an error before it makes any network request.

To pass an option, download the script and run it with the option appended, as in the checksum-verification examples above:

Linux / macOSWindows

# Force a direct connection, ignoring any system proxy
curl -fsSL https://<your-tenant>.senseon.io/install.sh -o install.sh
sudo SENSEON_INSTALLER_KEY="<your-installer-key>" bash install.sh --direct

# Or route install traffic through a specific proxy
sudo SENSEON_INSTALLER_KEY="<your-installer-key>" bash install.sh --proxy proxy.corp.local:3128

You can also append the option to the piped command with bash -s --:

curl -fsSL https://<your-tenant>.senseon.io/install.sh \
  | sudo SENSEON_INSTALLER_KEY="<your-installer-key>" bash -s -- --direct

Run these steps in an elevated PowerShell terminal (see Windows above).

Invoke-WebRequest -UseBasicParsing -Uri "https://<your-tenant>.senseon.io/install.ps1" -OutFile install.ps1
$env:SENSEON_INSTALLER_KEY = "<your-installer-key>"

# Force a direct connection, ignoring any system (WinINET) proxy
powershell.exe -ExecutionPolicy Bypass -File install.ps1 -Direct

# Or route install traffic through a specific proxy
powershell.exe -ExecutionPolicy Bypass -File install.ps1 -Proxy proxy.corp.local:3128

Note: These options control the proxy used during installation and for the bootstrapper's first contact with the platform. They are separate from the persistent proxy the running sensor uses for its ongoing connection, which is configured through a proxy.json file. To change or remove the proxy a host uses after it is installed, edit or delete that file as described in Proxy Configuration.

Verifying the Install

After running the install command:

Log in to SenseOn.
Go to Digital Estate > Devices.
Confirm the host appears in the list with its expected hostname and a recent Last Seen timestamp.

For diagnostics if the host does not appear, see Troubleshooting.