Quick Start

5 minutes from zero to your first detection

Step 1: Create your account

Step 2: Install the agent

The FTAgent runs on any Linux server with Python 3.8+. Full mode uses Scapy for packet capture (requires root). Use --limited if root is not available.

# Install the agent (all dependencies included)
pip install ftagent --break-system-packages

# Full mode (root required — PCAP, protocol analysis, IOC matching)
sudo ftagent --setup

# Limited mode (no root — PPS/BPS monitoring only)
ftagent --setup --limited

Note: On Ubuntu 23.04+, Debian 12+, and other newer distros, the --break-system-packages flag is required for global pip installs. Alternatively, use a virtualenv.

The setup wizard will ask for your Flowtriq API key (found in your workspace under Settings → Nodes) and auto-detect your network interface.

Step 3: Verify it's running

# Check agent status
sudo systemctl status ftagent

# Or run in debug mode
sudo ftagent --debug

You should see the agent send its first heartbeat and load IOC patterns from the remote config. After 5 minutes your node's baseline will be established.

Step 4: Configure alerts

Go to your workspace Console → Alert Channels and add at least one alert channel. Discord and Slack webhooks take about 30 seconds to configure.

Tip: Add a Discord channel first. It's the fastest to set up and you can test the connection with one click.

Step 5: Test detection

Use the --test flag to trigger a synthetic attack event:

sudo ftagent --test

This fires a simulated threshold crossing, opens a test incident, and sends alerts to all configured channels.