Install on Windows

The AlertKick agent runs on Windows Server and Windows 10 and 11 as a signed Windows service. Metrics and inventory match the Linux agent; security telemetry comes from the Windows Event Log and Sysmon instead of eBPF, matched against Sigma rules.

Install

1. Servers, then Add Server. Give it a name and choose the escalation policy its alerts should route to.
2. Copy the install command. When AlertKick generates it for a Windows package, the host is switched to the Default Windows Profile automatically.
3. Open PowerShell as Administrator on the server and paste the command. The link inside it is valid for 24 hours.

The script:

• downloads the agent package (a zip) and verifies its SHA-256 against the package manifest;
• extracts it to %ProgramFiles%\AlertKick and writes the configuration to %ProgramData%\AlertKick\alertkick-agent.conf, restricting that folder to SYSTEM and Administrators;
• registers the AlertKick Agent service (AlertKickAgent) to start automatically, with restart-on-failure;
• enables the audit policy the security rules rely on - process creation (event 4688 with command lines) and logon/logoff - and PowerShell script-block logging (event 4104);
• downloads Sysmon from Microsoft, verifies its Authenticode signature, and installs it with AlertKick’s detection-tuned configuration.

Pass -SkipSysmon to the script, or set "DisableSysmon": true in the configuration file, to leave Sysmon out. The agent then relies on the built-in Security, System, Application, and PowerShell channels.

The binary is Authenticode-signed by AlertKick Ltd, so SmartScreen and application-control policies can verify it. Logs are written to %ProgramData%\AlertKick\logs.

Verify

Within a minute the host under Servers moves from nocheckin to online. If it does not, check that the service is running (Get-Service AlertKickAgent) and that the server can reach the endpoint named in its configuration on TCP port 8585 outbound. There are no inbound ports.

What it collects

Check	Interval	Notes
CPU, memory	30s
Disk usage	60s	Per volume
Processes, services	30s / 60s	Windows services with started, stopped, and failed events
Ports	60s	Listening ports with opened and closed events
Packages	5 min	Installed programs from the registry
HTTP, DNS	30s	Checks run from the host

Load average and Docker are not collected on Windows. The Default Windows Profile covers memory, CPU, disk usage, and port monitoring; see Server monitoring for profiles and per-host checks.

Security telemetry

The agent subscribes to the Security, System, Application, PowerShell, and Sysmon event channels. Each record is matched against a bundled Sigma rule set covering process creation, remote thread creation, DNS queries, driver and image loads, network connections, named pipes, and the built-in Security and System events. A match becomes a security event with the Sigma rule title as its name and MITRE ATT&CK tags, flowing into the same security event stream, AI triage, and alerting as Linux detections. Once Sysmon is reporting process creation (event 1), the duplicate Security 4688 records are suppressed.

Features that depend on eBPF - SSH lockdown, learning mode, and the kernel-level probes - are hidden for Windows hosts.

Update and remove

Updates are pushed from the dashboard like any other host: the agent downloads the new package, verifies it, swaps the executable, and restarts its service. Re-running the install command on a host that already has the agent stops and removes the existing service first, so it doubles as a repair. To remove the agent, stop and delete the AlertKickAgent service, then delete %ProgramFiles%\AlertKick and %ProgramData%\AlertKick.

Next steps

• Server monitoring
• Security events
• Escalation policies