On-Prem Agent

The NeuroStrike on-prem agent lets you assess hosts and equipment that are not reachable from the internet. Where the AI reasoning happens depends on how you deploy it:

• Relay-connected — the agent is a thin command runner. The AI reasoning happens in the NeuroStrike platform (self-hosted in Norway/EEA); the agent runs the commands it is given, within the scope you set, and sends the results back.
• Air-gapped — reasoning runs on a model you host inside your own network (for example via Ollama or a vLLM / OpenAI-compatible endpoint), so nothing needs to leave the site.

In both modes the agent keeps a local store on the host — the tamper-evident audit chain and the findings of its assessments — which you control and can destroy with purge. It ships no model weights.

Every command and flag is in the CLI reference, and every setting — on Linux and Windows alike — is in the Configuration reference.

Choose your pathCopy Anchor Link

Air-gapped deploymentCopy Anchor Link

Air-gapped deployments run with no network egress. Instead of connecting to a relay, they use a licence bound to the host — so they need a one-time offline activation.

sudo install -m 0755 neurostrike-agent /usr/local/bin/
sudo mkdir -p /var/lib/neurostrike

neurostrike-agent fingerprint

sudo install -m 600 license.jwt /var/lib/neurostrike/license.jwt

neurostrike-agent init \
  --engagement "ACME Q1 assessment" \
  --allow 10.20.1.0/24 \
  --ceiling low_impact_active \
  --retention-days 30 \
  --eea-only

neurostrike-agent assess --roe .neurostrike/engagement.yaml --target 10.20.1.10
neurostrike-agent report --out assessment.html

Local reasoning model (optional)Copy Anchor Link

The AI-driven assessment runs against a local reasoning model — nothing leaves the site. Without one, the agent runs the fixed deterministic baseline checks and the report says so.

Windows installer. Tick Local AI model (Ollama) on the setup wizard's Select tools page. After the install commits, the agent downloads and silently installs Ollama, pulls the default model, and points itself at it — a multi-GB background download, so it keeps running after the wizard closes. Track it with neurostrike-agent llm status. If the host is air-gapped or the download fails, the agent stays in baseline-checks mode and prints how to finish by hand; nothing about the install is left broken.

Any host (or to enable it later). Run the one-shot setup, which does the same thing:

# Installs Ollama (Windows), pulls the default model, and configures the agent:
neurostrike-agent llm install            # add --model <tag> to choose another model

# Verify it is reachable:
neurostrike-agent llm status

To wire an existing model yourself instead, point the agent at it in the console Settings page, or in agent.conf (Windows: C:\ProgramData\NeuroStrike\secrets\agent.conf; Linux: beside the state DB):

OLLAMA_URL=http://127.0.0.1:11434
LOCAL_LLM_MODEL=qwen2.5:7b

Relay-connected agents use the cloud models over the relay and need none of this.

Air-gapped CVE updatesCopy Anchor Link

The agent matches installed software against a local vulnerability database. On an air-gapped host you keep it current by carrying a signed bundle in — no connection needed.

1. On any internet-connected PC, sign in to the NeuroStrike console and open Agents → Offline CVE updates. Download the CVE database — the complete database, with the affected version ranges for each product — and for Linux hosts the distribution advisories for the release the agent host runs (these let the agent recognise back-ported fixes, so patched packages are not reported as vulnerable).
2. Copy the files to the agent host and place them in the agent's drop folder, intel-inbox inside the agent's state directory. neurostrike-agent intel status prints the exact path (typically C:\ProgramData\NeuroStrike\intel-inbox on Windows and /var/lib/neurostrike/intel-inbox on Linux).
3. The agent loads them within a few minutes, and before every Strike. To load them immediately:

neurostrike-agent intel inbox
neurostrike-agent intel status

Every file ends up in intel-inbox/processed/ or intel-inbox/rejected/; a rejected file has a .reason.txt beside it saying why. The agent verifies NeuroStrike's signature with a key built into the agent itself, and refuses a bundle that was altered, one that is older than the data already loaded, or an unsigned file. A bundle tells the agent nothing about your estate, and nothing travels back.

A bundle can be loaded for 30 days after it was downloaded; after that the agent refuses it and asks for a fresh one. That bounds how long an old file can be presented as current. Plan to carry a new bundle in at least monthly — weekly is better, since new CVEs are published every day. The console will not issue a bundle from vulnerability data that has stopped updating, so a file you download is never more than a week behind.

Importing an air-gapped StrikeCopy Anchor Link

To see an air-gapped Strike in the NeuroStrike console — next to your other Strikes, with the same finding workflow and reports — export it on the agent host and upload the file.

neurostrike-agent strike list
neurostrike-agent strike export latest --out strike.json
neurostrike-agent strike verify strike.json

The agent console has the same export as Export for NeuroStrike console on each host's page.

The file is plain JSON, so your security team can review exactly what leaves the estate before it does. Carry it out under your usual process, then in the console open Strikes → Import on-prem Strike and upload it. The Strike is matched to an existing target by host name, or you can pick the target.

• Integrity. The export carries a SHA-256 of the findings; a damaged or edited file is refused. This proves the file arrived intact, not who wrote it. That proof is the agent's tamper-evident audit chain: the imported Strike records its head hash, and neurostrike-agent audit verify --expect-head <hash> on the agent host confirms the findings against the record made when they were produced. Each export is itself recorded in that chain.
• Each Strike imports once. Uploading the same file again opens the existing Strike.
• No quota. Imported Strikes ran — and were metered by your licence — on your own host, so they do not count toward your monthly Strike quota.

Relay-connected deploymentCopy Anchor Link

docker login registry.neurostrike.com

services:
  neurostrike-agent:
    image: registry.neurostrike.com/agent:latest
    environment:
      - AGENT_TOKEN=${AGENT_TOKEN}
      - RELAY_URL=wss://agents.neurostrike.com
    cap_add: [NET_RAW]
    cap_drop: [ALL]
    read_only: true
    network_mode: host
    restart: unless-stopped

Known-vulnerable software, before the AI startsCopy Anchor Link

Every Strike that runs through an agent starts with a deterministic step. Before any AI model is involved, the agent:

1. lists the software installed on its own host,
2. sweeps the Strike's targets for the versions their services announce, and
3. logs in to the hosts you have given it an account for and lists their installed software.

It matches all of it against its local CVE database, using affected-version ranges and, on Linux, your distribution's own security advisories, so already-patched packages are not reported. Confident matches are filed as findings straight away; uncertain ones are handed to the AI to verify. The Strike page shows what this step found and which hosts it could not reach.

Authenticated inventoryCopy Anchor Link

Step 3 needs a login. Accounts are added on the agent host and stored there, encrypted. NeuroStrike never receives the password or key — the dashboard only shows each login's label, method, account name and the hosts it covers.

Create a dedicated, read-only account for this:

• Linux: a normal user with no sudo rights. Package lists are readable without privileges.
• Windows: a member of the local Remote Management Users group (WinRM).

Then, on the agent host:

# Docker
docker compose exec -it neurostrike-agent agent creds add --label linux-servers   --method ssh --account svc-neurostrike --scope 10.0.0.0/24
docker compose exec neurostrike-agent agent creds test --label linux-servers --target <host>

# Windows
neurostrike-agent.exe creds add --label windows-servers --method winrm --account svc-neurostrike --scope 10.0.1.0/24

The agent prompts for the password; for an SSH key, pass --key-file. A login is only used for the hosts in its scope, only for read-only software inventory, and never for commands chosen by the AI. Each use is recorded in the agent's audit log. SSH host keys are pinned on first use; a changed key stops the login until you confirm it. See the deployment guide for every option.

Windows ServerCopy Anchor Link

You can assess a Windows Server without placing a standalone binary on it — choose the model that fits your security policy.

Option 1 — Assess over the network (no install)Copy Anchor Link

Run the agent on a Linux host (a small VM, a separate box, or a container) and point it at the Windows target. It performs network and service-level assessment — including SMB — over the wire, so nothing is installed on the Windows server and no change-control on that host is required. (This does not collect on-host state such as local services or scheduled tasks — for that, see Option 3.)

Option 2 — Run as a signed containerCopy Anchor Link

Run the agent as a container rather than a loose executable. The agent image is cryptographically signed with Sigstore cosign and can be scanned by your registry before it runs — which many teams are more comfortable with than a standalone .exe. The published image is Linux, so run it on a Linux host (or a Linux VM beside the Windows server) and assess the server over the network, as in Option 1.

Option 3 — Native executable (on-host assessment)Copy Anchor Link

For a full assumed-breach assessment of the Windows host itself — services and scheduled tasks, local administrator groups, listening sockets, and Windows-specific weaknesses such as unquoted service paths — install the agent on the host. Each release has two signed installers:

Both install the same agent as a Windows service. Windows 10 / Server 2016 or later is recommended.

Download them from the NeuroStrike dashboard: open Agents and use the Windows agent installer card. Downloading needs an organisation owner or admin on a plan that includes on-prem agents; the card also shows each file's SHA-256 checksum. The installer is the same for every customer and holds no credentials — an installed agent joins your organisation only when an admin approves it (step 3).

(Get-FileHash .\NeuroStrikeAgent.msi -Algorithm SHA256).Hash   # compare with the checksum on the Agents page
Get-AuthenticodeSignature .\NeuroStrikeAgent.msi | Format-List Status, SignerCertificate

msiexec /i NeuroStrikeAgent.msi /qn PROFILE=standard
msiexec /i NeuroStrikeAgent.msi /qn PROFILE=ot REQUIREAPPROVAL=true
msiexec /i NeuroStrikeAgent.msi /qn PROFILE=airgapped EXCLUDE="10.20.9.0/24;backup.corp.local"

neurostrike-agent.exe activate

To uninstall, use Settings → Apps, run setup again and choose Uninstall, or msiexec /x NeuroStrikeAgent.msi /qn. Your Strike records and audit log stay in C:\ProgramData\NeuroStrike unless you tick also delete Strike records in setup or add REMOVEDATA=1. Use one installer per host: upgrade with the same file type you installed with.

For IT and security teamsCopy Anchor Link

What you need to approve, allowlist and monitor the agent on Windows.

Publisher and allowlistingCopy Anchor Link

Every executable and installer is signed by NeuroStrike AS through Microsoft's Artifact Signing service, and every signature is timestamped. The signing certificate is renewed daily, so allowlist by publisher, not by certificate thumbprint — a thumbprint rule breaks with the next release.

• AppLocker: a publisher rule for publisher O=NeuroStrike AS, any product and file name.
• App Control for Business (WDAC): a publisher-level signer rule for NeuroStrike AS.
• nuclei.exe (the optional template scanner) is open-source software from ProjectDiscovery, re-signed by NeuroStrike AS in the installer, so the same publisher rule covers it.
• Hash-based allowlists: use the SHA-256 checksums published with each release.

Each release also includes a CycloneDX SBOM listing every component compiled into the agent.

What the installer changesCopy Anchor Link

Network accessCopy Anchor Link

The bundled scanners never check for or install updates of themselves. A new version arrives only as a new signed installer.

nmap is not bundled. It depends on the Npcap driver, whose licence forbids silent redistribution, so the installer ships only nuclei.exe (web checks). Host and port discovery with nmap needs it installed separately: install Npcap and Nmap (winget install Insecure.Nmap) and either leave nmap.exe on PATH or drop it in C:\Program Files\NeuroStrike\bin\tools\. nuclei-based web scanning works without it.

The agent also connects to the hosts you put in scope, and only those. Scope and exclusions are enforced both by the agent and, for relay-connected agents, by NeuroStrike's servers.

Before you deployCopy Anchor Link

• Tell your SOC/EDR team in advance: the agent does what an attacker would do against the hosts in scope (port scans, vulnerability checks), so expect alerts from those hosts while a Strike runs.
• Install on a dedicated host or VM where possible, not on a production server you are testing.

What data leaves your networkCopy Anchor Link