FireTail Endpoint Agent

Updated: May 13, 2026

Logging Employee Logs AI Logging Integrations AI Integrations Workforce

The FireTail Endpoint Agent, available for MacOS, Windows and Linux, helps organizations monitor usage of AI platforms. It works by detecting and logging interactions with AI providers, and monitoring software installed or running on the device. All captured information is sent to the FireTail platform, where it can be viewed and analyzed.

Learn more about what data the endpoint agent captures for Employee Logs, Devices and Applications.

You will need to generate a project token for the FireTail Endpoint Agent to use. Find out how to generate a FireTail Project token.

macOS Download for MacOS Windows Download for Windows

Currently supported AI Providers

  • ChatGPT
  • Claude
  • Gemini
  • ...and more!

View the full list of AI Providers and their supported capabilities.

Installation on MacOS

The FireTail Endpoint Agent is available for MacOS as a .pkg. The .pkg can be distributed to users and installed by following an installation wizard, or deployed at scale using your company's MDM software.

Once the FireTail Endpoint Agent is installed, you will need to configure it. This can be done via defaults, which can be managed by most MDM software or configured via CLI.

Installation via wizard

The FireTail Endpoint Agent can be installed on MacOS using an installation wizard.

The wizard will require the user to authenticate twice:

  1. First, with permission to install new software.
  2. Second, with permission to make changes oto the System Certificate Trust Settings - this is required to install the FireTail Endpoint Agent's SSL certificate into the Trust Store.

Upon successful installation the user should be presented with the following dialogue:

Once the FireTail Endpoint Agent is installed, you can configure it.

Installation via CLI

The FireTail Endpoint Agent can also be installed on MacOS via CLI. Download the .pkg and use installer:

sudo installer -pkg ./FireTail\ Endpoint\ Agent.pkg -target /

For more details on how to customise the installation using installer, run man installer.

To check the status of the FireTail Endpoint Agent, use launchctl:

launchctl print system/com.firetail.agent | grep state

Once the FireTail Endpoint Agent is installed, you can configure it.

Configuration

On MacOS, the FireTail Endpoint Agent is configured via defaults for the root user under the domain com.firetail.agent, which you should also be able to manage via your company's MDM software. Find a full list of keys available under the com.firetail.agent domain below.

Defaults Key Type Required? Example Description
project_token String ✅ FTA-01-XXX... The project token to use when fetching data from the FireTail API
region String ✅ eu-west-1 The region of the FireTail SaaS to use
proxy_port Integer ❌ 8080 The port the FireTail agent will use to proxy traffic in proxy mode
api_port Integer ❌ 8081 The port the FireTail agent's API on to manage bypasses etc.
debug Boolean ❌ true Enables debug logging

You can also configure the FireTail Endpoint Agent via CLI using defaults. For example, to set the project token and region:

sudo defaults write com.firetail.agent project_token "$FIRETAIL_PROJECT_TOKEN"
sudo defaults write com.firetail.agent region "$FIRETAIL_REGION"

Installation on Windows

The FireTail Endpoint Agent is available for Windows as a .msi, which can be distributed to users and installed by following an installation wizard, or deployed at scale using your company's MDM software.

Installation via wizard

The FireTail Endpoint Agent can be installed on Windows using an installation wizard. Click "Next".

Accept the terms in the license agreement and click "Next".

Input the Project Token into the installation wizard and select the correct platform and region for the FireTail platform you use.

You can also customise:

  • The port of the FireTail Endpoint Agent's proxy server,
  • The port of the FireTail Endpoint Agent's API,
  • Whether the installation wizard should install the FireTail Endpoint Agent's root CA certificate, and
  • Whether the installation wizard should overwrite any existing certificates from previous installations of the FireTail Endpoint Agent.

Once you have inputted your desired configuration, click "Next".

Click "Install" to begin the installation process.

Once the installation process is complete, the following information should appear.

Click "Finish" to close the installation wizard.

Installation via CLI

The FireTail Endpoint Agent can be installed on Windows via CLI. Download the .msi and then use msiexec:

msiexec /i FireTailAgent.msi TOKEN=YOUR_TOKEN REGION=eu-west-1 PROXY_PORT=8081 API_PORT=8085 INSTALL_CERT=1 OVERWRITE_CERTS=1 /L*v install.log

For more information about how to customise the installation using msiexec can be found here.

Installation on Linux

The FireTail Endpoint Agent is available for Linux as a .tar.gz containing an installation script which must be run as root.

sudo ./install.sh

You may need to add the FireTail Endpoint Agent's SSL certificate to the trust store of your browser. It should be found at /etc/firetail/ca-cert.pem.

Need help?

Contact FireTail support