DOCUMENTATION

Installing the SahmEDR agent

One package, one enrollment command. Five minutes on a typical Linux server. Read the two warnings below before you enroll a production host — they are short and they matter.

1. Requirements

Operating system	Debian 11+ or Ubuntu 20.04+, x86-64. Other systemd distributions generally work but are not tested.
Kernel	Any supported kernel. 5.8 or newer enables kernel-level process capture where the eBPF probe is included in your build; older kernels fall back automatically.
Init	systemd. The agent runs as a service unit.
Privilege	root. Observing process execution, network activity and file changes across all users is not possible unprivileged.
Disk	~200 MB for the local event database, plus a bounded 16 MB buffer used only while the platform is unreachable.
Network	Outbound HTTPS to your control plane. No inbound ports are opened. The agent never listens.

Dependencies

All are in the standard Debian and Ubuntu repositories, and apt installs them with the package:

python3 python3-psutil python3-requests libsqlite3-0 python3-cryptography # recommended: required to verify updates

Install python3-cryptography. Without it the agent cannot verify update signatures, and it will therefore refuse every update. That is the intended failure — but it means you stop receiving fixes.

2. Install

⚠ Verify the checksum before installing. You are about to run this as root on a machine you care about. If sha256sum -c prints anything other than OK, stop. Do not install it, and contact support.

# 1. download curl -fLO https://sahmstudy.online/dl/sahmedr_1.0.0_amd64.deb # 2. verify it is the artifact we published echo "1449583d811f8a8c3470ccc51d437a796b3e673d5a99a39aa4f1fcc64e5564b0 sahmedr_1.0.0_amd64.deb" | sha256sum -c # 3. install sudo apt install ./sahmedr_1.0.0_amd64.deb

3. Enroll the host

Generate an enrollment token in the console under Settings → Token, then:

sudo sahmedr enroll enr_xxxxxxxxxxxxxxxxxxxx sudo systemctl start sahmedr

Enrollment happens once. The agent stores a permanent identity at /etc/sahmedr/agent-id and its credential at /var/lib/sahmedr/identity.json (mode 0600), and reuses them across restarts and reboots. It will refuse to enroll a host that is already enrolled, because doing so would consume a second agent seat and orphan the first credential.

One token can enroll many hosts, up to your plan's agent limit. The limit is enforced by the server: on a three-agent plan the fourth enrollment is refused with a clear error, not billed.

Running without an account

Installing without enrolling is fully supported. The agent monitors, detects and responds locally, and simply reports nowhere. Nothing leaves the machine.

4. Verify it is working

# service state and enrollment systemctl status sahmedr sudo sahmedr status # live logs journalctl -u sahmedr -f

Within about a minute of starting, the host should appear under Agents with its hostname, OS, kernel and agent version, marked Online. If it stays offline, see troubleshooting.

5. What the agent collects

We would rather you know this before you install than discover it later. The agent collects security telemetry — which unavoidably includes some personal data — and nothing else:

Processes	Executions with command line, parent, user and binary hash
Network	Connection metadata: addresses, ports, protocol, owning process. Not packet contents.
DNS	Queried names and responses
Authentication	SSH and sudo successes and failures with source address
Privilege	UID transitions and capability changes
Persistence	Changes to cron, systemd units, `ld.so.preload`, shell rc files, authorized_keys
Files	Metadata and hashes in monitored paths. File contents are never uploaded.
Packages	Installed versions, for CVE matching

Command lines and file paths can incidentally contain secrets if your own tooling puts them there — a password passed as a command-line argument, for example. That is worth knowing whether or not you run an EDR.

Telemetry is retained for your plan's retention period and then deleted automatically. You can export or erase everything from the console at any time. See the Privacy Policy and DPA.

6. Response actions — read this

⚠ Endpoint isolation will cut this machine off the network. That includes your SSH session and our connection to it. On a remote server with no out-of-band console, you may need physical or provider-level access to undo it. Test isolation on a host you can afford to lose first.

Response is divided by how much damage an action can do:

Collection	Process, network, DNS, authentication and file information; hashing. Read-only, available to analysts.
Disruptive	Terminate a process, disable a persistence mechanism, block a destination, isolate the endpoint. Administrator and above, and disruptive requests route through an approval queue.

Two guarantees worth stating plainly:

There is no arbitrary command execution. The console cannot make your endpoint run a shell command. Only a fixed allowlist of named actions exists, and the agent refuses anything else.
Every command is signed and expires. The agent verifies an HMAC over the command before acting, so a stolen copy of our database cannot forge one, and an expired command is refused even with a valid signature.

To evaluate without any enforcement, run in dry-run mode: decisions are recorded and shown in the console, but nothing is enforced.

echo 'SAHMEDR_RESPONSE_MODE=dry_run' | sudo tee -a /etc/sahmedr/sahmedr.env sudo systemctl restart sahmedr

7. Troubleshooting

Symptom	Cause and fix
Host does not appear in Agents	Not enrolled, or outbound HTTPS is blocked. Check `sudo sahmedr status` and `journalctl -u sahmedr -n 50`.
`agent_limit_reached`	Your plan's agent limit is reached. Revoke an unused agent or upgrade; the limit is enforced server-side and cannot be bypassed.
`already enrolled`	Expected on a re-enrollment attempt. To move the host to another organization, remove `/var/lib/sahmedr/identity.json` first.
Shows Offline but the service is running	Heartbeats are not arriving. Telemetry buffers locally and replays on reconnect, so nothing is lost meanwhile.
Updates are refused	Install `python3-cryptography`, and check that `/etc/sahmedr/update-key.pub` exists. An agent that cannot verify an update will not install one.
Telemetry backend shows fallback	The eBPF probe is unavailable, so process capture polls `/proc`. Detection and response are unaffected; very short-lived processes may be missed.

8. Uninstall

# stop reporting, keep local data sudo systemctl stop sahmedr && sudo systemctl disable sahmedr # remove the package, keeping configuration and local evidence sudo apt remove sahmedr # remove everything, including the local event database sudo apt purge sahmedr && sudo rm -rf /var/lib/sahmedr

Removing the package does not delete data already sent to the platform. Revoke the agent in Agents to free its seat, and use erasure in the console to destroy the data itself.

Something here wrong or unclear? Tell us — an installation guide that does not match reality is a security problem, not a documentation one.