### Extract and Prepare Installer Files

Source: https://docs.keyfactor.com/agilesec/latest/multi-node-linux-install-prerequisites.md

Commands to extract the installation archive and set the installation directory.

```bash
unzip <installer_package>.zip
export installer_dir = <installer-directory-location>
cd $installer_dir
```

--------------------------------

### Start services after rollback

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Start services on each node sequentially, starting with backend-1.

```bash
cd <v3.4-installation-dir>
./scripts/manage.sh start
./scripts/manage.sh status
```

--------------------------------

### Run Installation Script

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-3-multi-region-stretch-cluster-with-coordinator-node.md

Execute the installation script on each node following the required sequential order.

```bash
cd $installer_dir
./install_analytics.sh install -u <user> -p <installation-dir> --non-interactive
```

--------------------------------

### Start and verify services

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-agilesec-linux-upgrade-guide-3-6.md

Start services and check their status on each node in the required sequence.

```bash
cd $AGILESEC_INSTALL_DIR
./scripts/manage.sh start
./scripts/manage.sh status
```

--------------------------------

### Install rsync

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Install rsync using dnf if it is not present.

```bash
sudo dnf install -y rsync
```

--------------------------------

### Set Installation Script Permissions

Source: https://docs.keyfactor.com/agilesec/latest/multi-node-linux-install-prerequisites.md

Command to make the installation script executable.

```bash
cd $installer_dir
chmod +x install_analytics.sh
```

--------------------------------

### AgileSec Installation Command Syntax

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-3-multi-region-stretch-cluster-with-coordinator-node.md

Standard syntax for the installation script with optional sub-commands.

```bash
./install_analytics.sh install [OPTIONS]
```

--------------------------------

### Start services using manage.sh

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-managing-services.md

Commands to start all services or specific subsets with optional debug output.

```bash
./manage.sh start
```

```bash
./manage.sh start -d opensearch
```

```bash
./manage.sh start opensearch opensearch-dashboards
```

--------------------------------

### Execute common service status commands

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-troubleshooting-guide.md

Examples of using manage.sh to check status, start, stop, restart, and reload services.

```bash
# Check all services status
./scripts/manage.sh status

# Check specific service status
./scripts/manage.sh status opensearch
./scripts/manage.sh status mongodb kafka

# Start all services
./scripts/manage.sh start

# Start specific service with debug output
./scripts/manage.sh start -d opensearch

# Stop specific services
./scripts/manage.sh stop haproxy td-agent

# Restart a service
./scripts/manage.sh restart scheduler

# Reload HAProxy configuration
./scripts/manage.sh reload haproxy
```

--------------------------------

### Install Frontend Node Software

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-2-adding-a-new-frontend-to-an-existing-cluster.md

Commands to unarchive certificates and execute the tuning and installation scripts on the new frontend node.

```Bash
cd $installer_dir/certificates/
tar zxvf kf-agilesec.internal-certs.tgz
cd ../

sudo ./scripts/tune.sh -u <user>
./install_analytics.sh install -u <user> -p <installation-dir>
```

--------------------------------

### Perform Non-Interactive Multi-Node Installation

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-multi-node-installation-guide.md

Execute these commands sequentially on each node to configure, tune, and install the application.

```bash
# === On backend-1 ===
    cd $installer_dir

    # Generate env configs for all nodes
    ./generate_envs/generate_envs.sh -t multi-node --non-interactive

    # Install certificates using Certificates Management Guide
    # Example: installer-generated certificates
    cd certificates/
    ./generate_certs.sh --non-interactive
    cd ..
    # If BYOC, follow BYOC guides to replace installer-generated certificates

    # System tuning and install
    sudo ./scripts/tune.sh -u <user>
    ./install_analytics.sh install -u <user> -p <installation-dir> --non-interactive

    # === On backend-2 ===
    cd $installer_dir/certificates/
    cp env.backend-2 ../.env
    cd ..
    sudo ./scripts/tune.sh -u <user>
    ./install_analytics.sh install -u <user> -p <installation-dir> --non-interactive

    # === On frontend-1 ===
    cd $installer_dir/certificates/
    cp env.frontend-1 ../.env
    cd ..
    sudo ./scripts/tune.sh -u <user>
    ./install_analytics.sh install -u <user> -p <installation-dir> --non-interactive
```

--------------------------------

### Extract Installation Archive

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-single-node-installation-guide.md

Extract the installer package and navigate to the installation directory.

```bash
unzip -d $installer_dir <installer_package>.zip
cd $installer_dir
```

--------------------------------

### Install S3 Repository Plugin

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-disaster-recovery-and-backup-process-guide.md

Install the repository-s3 plugin and restart OpenSearch on all nodes.

```bash
cd $installation_path/services/opensearch/bin
./opensearch-plugin install repository-s3
# Restart OpenSearch service on all nodes
cd $installation_path
./scripts/manage.sh restart opensearch
```

--------------------------------

### Verify and Install Rsync

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Ensure rsync is available on all nodes; install it if missing.

```bash
rsync --version
```

```bash
sudo dnf install -y rsync
```

--------------------------------

### Stop Services and Backup Installation

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Stop all services and create a backup of the installation directory for rollback purposes.

```bash
cd <v3.4-installation-dir>
./scripts/manage.sh stop
```

```bash
du -hs <v3.4-installation-dir>
cp -r <v3.4-installation-dir> <v3.4-installation-dir>.bak
```

--------------------------------

### Upgrade precheck output example

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Sample output showing successful pre-requisite checks.

```text
Syncing certificates from installed system to installer...
Certificates synced from <v3.4-installation-dir>/certificates
Running pre-requisite checks...
Mode: upgrade

Running upgrade pre-checks...

==================================
Pre-requisite Checks Summary
==================================
Checks Passed:   13
Warnings:        1
Checks Failed:   0
```

--------------------------------

### Install and verify rsync on RHEL

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-agilesec-linux-upgrade-guide-3-6.md

Commands to install the rsync utility required for the upgrade process and verify its installation.

```bash
# Install rsync on RHEL
sudo dnf check-update
sudo dnf install -y rsync
# Verify installation
rsync --version
```

--------------------------------

### Run AgileSec Installation Interactively

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-3-multi-region-stretch-cluster-with-coordinator-node.md

Perform an interactive installation that prompts for an admin password.

```bash
./install_analytics.sh install -u <user> -p $agilesec_install_dir
```

--------------------------------

### Start Services on Nodes

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Starts services on backend and frontend nodes while excluding specific components. Must be performed in the order: backend-1, backend-2, then frontend-1.

```bash
cd <v3.4-installation-dir>
./scripts/manage.sh start --exclude ingestion,analytics-manager,scheduler,api,webui
./scripts/manage.sh status
```

--------------------------------

### Install Scan Node Services

Source: https://docs.keyfactor.com/agilesec/latest/add-a-new-scan-node.md

Extract certificates, configure the environment, and execute the tuning and installation scripts with the scan role flag.

```bash
cd $installer_dir/certificates/
tar zxvf kf-agilesec.internal-certs.tgz

cp env.backend-1 ../.env

cd ../
sudo ./scripts/tune.sh -u ec2-user -r scan
./install_analytics.sh install -u ec2-user -p $agilesec_install_dir -r scan
```

--------------------------------

### Execute support bundle script

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-troubleshooting-guide.md

Commands to set permissions, define the installation path, and execute the collection script.

```bash
# Important: 
#   - Replace </path/to/installation> with actual path

chmod 700 collect-logs.sh
export installation_path=</path/to/installation>
./collect-logs.sh
```

--------------------------------

### Check Environment Files

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-single-node-installation-guide.md

Verify the presence of the .env settings file in the installer directory.

```bash
ls -a
```

--------------------------------

### Remote Scan Configuration Examples

Source: https://docs.keyfactor.com/agilesec/latest/qualys-sensor-user-guide.md

YAML configuration examples for remote scan execution.

```yaml
scan_config:
  plugins:
    - qualys
    - export
  config:
    qualys:
      name: qualys
      plugin_config:
        url: "<https://qualysguard.qg3.apps.qualys.com/>"
        username: "${env:QUALYS_USER}"
        password: "${env:QUALYS_PASS}"
```

```yaml
scan_config:
  plugins:
    - qualys
    - export
  config:
    qualys:
      name: qualys
      plugin_config:
        url: "<https://qualysguard.qg3.apps.qualys.com/>"
        username: "${env:QUALYS_USER}"
        password: "${env:QUALYS_PASS}"
        report_title: "crypto-scan"
```

--------------------------------

### Configure SM Keystore Aliases in .env

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-certificates-management-guide.md

Example of the default installer-generated alias configuration within the .env file.

```text
sm_service_cmk_alias='561280514aa561b399df58dfadeab7e7'
sm_service_keypair_alias='192851d9a7ead8e074dec80255727998'
```

--------------------------------

### Configure Node Hostnames and Profiles

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-multi-node-installation-guide.md

Examples of configuration settings for node hostnames and profiles in the cluster configuration.

```text
backend1_node_hostname="backend-1"
backend2_node_hostname="backend-2"
frontend1_node_hostname="frontend-1"
frontend2_node_hostname="frontend-2"
coordinator1_node_hostname="coordinator-1"
```

```text
backend1_node_profile="PRIMARY_FULL_BACKEND"
backend2_node_profile="FULL_BACKEND"
frontend1_node_profile="PRIMARY_FRONTEND"
frontend2_node_profile="ADDITIONAL_FRONTEND"
```

--------------------------------

### Generate environment configuration

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Unzip the installer and generate the new environment configuration file.

```bash
unzip -d <v3.5.0-installer-dir> <v3.5.0-installer-dir>.zip
cd <v3.5.0-installer-dir>
./generate_envs/generate_envs.sh -t single-node --old-config <v3.4-installer-dir>/generate_envs/single_node_config.conf
```

```java
...
[SUCCESS] Merged 69 values from old config, 8 skipped (whitelist), 17 new defaults kept
...
```

--------------------------------

### Install Unzip Utility

Source: https://docs.keyfactor.com/agilesec/latest/multi-node-linux-install-prerequisites.md

Command to install the unzip utility on RHEL systems.

```bash
sudo dnf install unzip
```

--------------------------------

### Troubleshoot Kafka Performance

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-troubleshooting-guide.md

Scripts to verify installation paths, configure SSL, and monitor consumer lag.

```bash
# Important: 
#   - Replace </path/to/installation> with actual path
#   - Replace "kf-agilesec.internal" with your actual domain name
#   - Replace "<kafka-broker-hostname>" with your actual node domain name
export installation_path=</path/to/installation>
export analytics_internal_domain="kf-agilesec.internal" # default: kf-agilesec.internal. Change it to match your actual domain
export kafka_bootstrap_host=<kafka-broker-hostname> # Example: backend-1.kf-agilesec.internal

export JAVA_HOME="$installation_path/bin/java"
test -d "$installation_path/tmp" || {
  echo "$installation_path/tmp does not exist. Verify the installation path."
  exit 1
}

umask 077
work_dir="$(mktemp -d "$installation_path/tmp/kafka-health.XXXXXX")"
trap 'rm -rf "$work_dir"' EXIT

ssl_properties="$work_dir/ssl.properties"

cat > "$ssl_properties" <<EOF
security.protocol=SSL
ssl.truststore.type=PEM
ssl.truststore.location=$installation_path/certificates/ca/agilesec-rootca-cert.pem
ssl.keystore.type=PEM
ssl.keystore.location=$installation_path/certificates/$analytics_internal_domain/shared-client-combo-cert-key.pem
ssl.endpoint.identification.algorithm=https
EOF

# Check consumer lag
"$installation_path/services/kafka/bin/kafka-consumer-groups.sh" \
  --bootstrap-server "$kafka_bootstrap_host:9092" \
  --command-config "$ssl_properties" \
  --describe --all-groups

# Check log segment sizes
du -sh $installation_path/data/kafka/*
```

--------------------------------

### Start individual service

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Start a specific service by name if it is not running.

```Bash
./scripts/manage.sh start <service-name>
```

--------------------------------

### Verify rsync installation

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Check if rsync is installed on the system.

```bash
rsync --version
```

--------------------------------

### Deploy Environment Files

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-3-multi-region-stretch-cluster-with-coordinator-node.md

Commands to extract certificates and copy the node-specific environment file to the installer directory.

```bash
cd $installer_dir/certificates/
tar zxvf kf-agilesec.internal-certs.tgz
cp <env-file> ../.env
cd ..
```

```bash
cp env.backend-2 ../.env
```

```bash
cp env.backend-3 ../.env
```

```bash
cp env.backend-4 ../.env
```

```bash
cp env.coordinator-1 ../.env
```

```bash
cp env.frontend-2 ../.env
```

```bash
cp env.frontend-3 ../.env
```

--------------------------------

### GCP KMS Scan Configuration Examples

Source: https://docs.keyfactor.com/agilesec/latest/gcp-kms-connector-user-guide.md

YAML configuration examples for scanning all regions versus specific regions in a GCP project.

```yaml
scan_config:
  plugins:
    - gcpkms_import
    - trigger_discover
    - export
  config:
    gcpkms_import:
      name: gcpkms
      plugin_config:
        auth_json: "${file:/path/to/auth.json}"
        project: "${file:/path/to/auth.json:project_id}"
```

```yaml
scan_config:
  plugins:
    - gcpkms_import
    - trigger_discover
    - export
  config:
    gcpkms_import:
      name: gcpkms
      plugin_config:
        auth_json: "${file:/path/to/auth.json}"
        project: "${file:/path/to/auth.json:project_id}"
        regions: ["global"]
```

--------------------------------

### Run install_analytics.sh Commands

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-2-adding-a-new-frontend-to-an-existing-cluster.md

Various methods for executing the installation script, including standard, interactive, and non-interactive modes.

```Bash
./install_analytics.sh install [OPTIONS]
```

```Bash
./install_analytics.sh install -u <user> -p $agilesec_install_dir
```

```Bash
cd $installer_dir
./install_analytics.sh install -u <user> -p $agilesec_install_dir --non-interactive
```

--------------------------------

### Enable systemd service management

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-managing-services.md

Use the startup script to enable systemd integration after the initial installation.

```bash
sudo $agilesec_install_dir/scripts/startup.sh systemd enable
```

--------------------------------

### Verify Installation Health

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Check the status of services on each node to ensure the current installation is healthy.

```bash
# Run on each node:
./scripts/manage.sh status
```

--------------------------------

### Run AgileSec Installation Non-interactively

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-3-multi-region-stretch-cluster-with-coordinator-node.md

Perform a non-interactive installation using a .pass file for authentication.

```bash
cd $installer_dir
./install_analytics.sh install -u <user> -p $agilesec_install_dir --non-interactive
```

--------------------------------

### Stop all services

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-agilesec-linux-upgrade-guide-3-6.md

Navigate to the installation directory and stop all services on each node.

```bash
cd $AGILESEC_INSTALL_DIR
./scripts/manage.sh stop
```

--------------------------------

### Start HAProxy with Sudo

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Required when HAProxy is configured to use a privileged port.

```bash
sudo ./scripts/manage.sh start haproxy
```

--------------------------------

### Component upgrade plan output

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Example output listing component version changes during the upgrade plan.

```text
Installer Version: unknown → 3.5.0
  ✓ analytics_manager: unknown → 3.5.0
  ✓ cbom: unknown → 3.5.0
  ✓ indexing: unknown → 3.5.0
  ✓ ingestion: unknown → 3.5.0
  ✓ kafka: unknown → 3.9.1
  ✓ mongodb: unknown → 7.0.30
  ✓ opensearch_dashboards: unknown → 2.19.5
  ✓ opensearch: unknown → 2.19.5
  ✓ platform_initialization: unknown → 3.5.0
  ✓ scheduler: unknown → 3.5.0
  ✓ sm: unknown → 3.5.0
  ✓ webapi: unknown → 3.5.0
  ✓ webui: unknown → 3.5.0
  ✓ nodejs: unknown → 22.21.1
  ✓ openjdk: unknown → 17.0.14+7
  ✗ fluentd: unknown → removed (no longer in node profile)
```

--------------------------------

### End-to-End Non-Interactive Single-Node Install

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-single-node-installation-guide.md

Automated sequence of commands to configure, tune, and install the AgileSec platform in a single-node environment.

```bash
cd $installer_dir

# Generate env config
./generate_envs/generate_envs.sh -t single-node --non-interactive

# Generate certificates
cd certificates/
./generate_certs.sh --non-interactive
cd ..

# Prepare .pass file
cp .pass.example .pass
# Edit .pass and set admin_password
chmod 600 .pass

# Run system tuning
sudo ./scripts/tune.sh -u <user>

# Install
./install_analytics.sh install -u <user> -p $agilesec_install_dir --non-interactive
```

--------------------------------

### Start services excluding specific components

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Start all services except for the specified list of components.

```Bash
cd <v3.4-installation-dir>
./scripts/manage.sh start --exclude ingestion,analytics-manager,scheduler,api,webui
```

--------------------------------

### Set Environment Variables for Upgrade

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-agilesec-linux-upgrade-guide-3-6.md

Define the installation and installer directory paths as environment variables to simplify subsequent command execution.

```bash
export AGILESEC_INSTALL_DIR=<agilesec_install_dir>
export PREV_INSTALLER_DIR=<prev_installer_dir>
```

--------------------------------

### Remote Scan Configuration Examples

Source: https://docs.keyfactor.com/agilesec/latest/cipher-insights-sensor-user-guide.md

YAML configuration examples for the remote sensor, including basic settings and advanced options like time frame and pagination.

```yaml
scan_config:
  plugins:
    - cipher_insights
    - export
  config:
    cipher_insights:
      name: cipher_insights
      plugin_config:
        url: "<https://cipherinsights.example.com/api/v1/>"
        token: "${env:CI_TOKEN}"
        insecure: false
```

```yaml
scan_config:
  plugins:
    - cipher_insights
    - export
  config:
    cipher_insights:
      name: cipher_insights
      plugin_config:
        url: "<https://cipherinsights.example.com/api/v1/>"
        token: "${env:CI_TOKEN}"
        insecure: false
        time_frame: 24
        pagination_limit: 200
```

--------------------------------

### Remote Scan Configuration Example

Source: https://docs.keyfactor.com/agilesec/latest/venafi-sensor-user-guide.md

A sample YAML configuration file for the remote connector.

```yaml
scan_config:
  plugins:
    - venafi
    - export
  config:
    venafi:
      name: venafi
      plugin_config:
        url: "<https://venafi.company.com>"
        policy: "\\\\VED\\\\Policy\\\\Your\\\\Folder"
        token: "${env:VENAFI_TOKEN}"
        opensearch:
          address: "<https://127.0.0.1:9200>"
          username: "${env:OS_USER}"
          password: "${env:OS_PASS}"
```

--------------------------------

### Verify systemd unit installation

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-managing-services.md

Check that all AgileSec-related units are correctly installed and enabled in the systemd configuration.

```bash
systemctl list-unit-files | grep kf_agilesec
```

--------------------------------

### Upgrade Success Output

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Example of the expected console output upon successful completion of the upgrade.

```java
...
[SUCCESS] All tiers completed successfully
[INFO] Running post-upgrade hook
[SUCCESS] post-upgrade hook completed successfully
[INFO] Installation version updated to: 3.5.0
[INFO] Upgrade history recorded: upgrade-20260329-045111
[SUCCESS] Upgrade completed successfully
```

--------------------------------

### Export Directory Variables

Source: https://docs.keyfactor.com/agilesec/latest/add-a-new-scan-node.md

Define the installation and installer directory paths as environment variables for use in subsequent commands.

```bash
export installer_dir=</path/to/installer>
export agilesec_install_dir=</path/to/installation>
```

--------------------------------

### Manage .pass File

Source: https://docs.keyfactor.com/agilesec/latest/multi-node-linux-install-prerequisites.md

Commands to copy, list, and secure the non-interactive installation password file.

```bash
cp .pass.example .pass
ls -a
chmod 600 .pass
```

--------------------------------

### Start all services and enable health check

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Start all services and re-enable the health check cron job.

```Bash
cd <v3.4-installation-dir>
./scripts/manage.sh start --enable-healthcheck
```

--------------------------------

### Copy Frontend Configuration Files

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-2-adding-a-new-frontend-to-an-existing-cluster.md

Transfer environment configuration files from the backend installer directory to the respective frontend nodes.

```bash
scp $installer_dir/generate_envs/generated_envs/env.frontend-1 \
  user@<frontend-1_IP>:$installer_dir/.env

scp $installer_dir/generate_envs/generated_envs/env.frontend-2 \
  user@<frontend-2_IP>:$installer_dir/.env

scp $installer_dir/generate_envs/generated_envs/env.frontend-3 \
  user@<frontend-3_IP>:$installer_dir/.env
```

--------------------------------

### Deploy Node-Specific Environment Files

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-1-four-node-installation-for-new-cluster-2-backends-2-frontends.md

Commands to copy the appropriate environment file to the installer directory for backend and frontend nodes.

```bash
# On backend-2
cd $installer_dir/certificates/
cp env.backend-2 ../.env
cd ..

# On frontend-1
cd $installer_dir/certificates/
cp env.frontend-1 ../.env
cd ..

# On frontend-2
cd $installer_dir/certificates/
cp env.frontend-2 ../.env
cd ..
```

--------------------------------

### Manager Node Configuration Example

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-cross-cluster-search-setup-guide.md

Complete configuration block for a dedicated manager node.

```yaml
node.roles: [cluster_manager, remote_cluster_client]

plugins.security.nodes_dn:
  - "CN=*.kf-agilesec.internal,OU=Server,O=Keyfactor,ST=California,C=US"
  - "CN=*.kf-agilesec.internal,OU=Server,O=Keyfactor,ST=Ohio,C=US"

cluster.remote.agilesec-east.mode: proxy
cluster.remote.agilesec-east.proxy_address: "agilesec.us-east-1.kf-agilesec.com:9301"
```

--------------------------------

### Generate environment configuration

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-agilesec-linux-upgrade-guide-3-6.md

Extract the new installer and generate environment files for multi-node or single-node deployments.

```bash
unzip <new-installer-package>.zip
export NEW_INSTALLER_DIR=<path-to-new-unzipped-installer-package>
```

```bash
cd $NEW_INSTALLER_DIR
./generate_envs/generate_envs.sh -t multi-node --old-config $PREV_INSTALLER_DIR/generate_envs/multi_node_config.conf
```

```bash
cd $NEW_INSTALLER_DIR
./generate_envs/generate_envs.sh -t single-node --old-config $PREV_INSTALLER_DIR/generate_envs/single_node_config.conf
```

--------------------------------

### Thales CTM Configuration Examples

Source: https://docs.keyfactor.com/agilesec/latest/thales-ctm-sensor-user-guide.md

YAML configuration templates for username/password and mTLS authentication methods.

```yaml
scan_config:
  plugins:
    - thales_ctm
    - export
  config:
    thales_ctm:
      name: thales
      plugin_config:
        base_url: "<https://ciphertrust.company.com>"
        username: "${env:CTM_USER}"
        password: "${env:CTM_PASS}"
        domain: "root"
         # auth_domain: ""
         # client_id: ""
         # client_certificate: "/path/to/cert.pem"
         # client_private_key: "/path/to/privateKey.pem"
         # root_ca: "/path/to/rootca.pem"
         # interval: 60
         # page_limit: 100
```

```yaml
scan_config:
  plugins:
    - thales_ctm
    - export
  config:
    thales_ctm:
      name: thales
      plugin_config:
        base_url: "<https://ciphertrust.company.com>"
        client_id: "3ec05d42-72f0-45aa-8196-f17d73a2f9f0"
        client_certificate: "/path/to/cert.pem"
        client_private_key: "/path/to/privateKey.pem"
        root_ca: "/path/to/rootca.pem"
        # auth_domain: ""
        # root_ca: "/path/to/rootca.pem"
        # interval: 60
        # page_limit: 100
```

--------------------------------

### Three-Cluster Mesh Configuration

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-cross-cluster-search-setup-guide.md

Example configuration for scaling to a three-cluster mesh environment.

```yaml
cluster.remote.agilesec-b.mode: proxy
cluster.remote.agilesec-b.proxy_address: "<cluster-b-haproxy>"
cluster.remote.agilesec-c.mode: proxy
cluster.remote.agilesec-c.proxy_address: "<cluster-c-haproxy>"

plugins.security.nodes_dn:
  - "<agilesec-a-node-dn>"
  - "<agilesec-b-node-dn>"
  - "<agilesec-c-node-dn>"
```

--------------------------------

### Verify service status

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-single-node-installation-guide.md

Execute the management script to confirm all required services are running after installation.

```bash
$ ./scripts/manage.sh status
SERVICE                   DESCRIPTION                              STATUS              
------------------------  ---------------------------------------- --------------------
opensearch                OpenSearch Search Engine                 Running (PID: 1450891)
opensearch-dashboards     OpenSearch Dashboards                    Running (PID: 1452817)
indexing                  Indexing Microservice                    Running (PID: 1451400)
haproxy                   HAProxy Load Balancer                    Running (PID: 1451285)
mongodb                   MongoDB Server                           Running (PID: 1451281)
kafka                     Kafka Server                             Running (PID: 1451295)
webui                     Web UI Microservice                      Running (PID: 1451316)
api                       Web API Microservice                     Running (PID: 1452924)
cbom                      CBOM Exporter Microservice               Running (PID: 1453074)
sm                        Security Manager Microservice            Running (PID: 1453083)
analytics-manager         Analytics Manager Microservice           Running (PID: 1451408)
ingestion                 Ingestion Microservice                   Running (PID: 1451419)
scheduler                 Scheduler Microservice                   Running (PID: 1451450)
```

--------------------------------

### Manage HAProxy Privileged Services

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-2-adding-a-new-frontend-to-an-existing-cluster.md

Commands for starting and stopping HAProxy, noting that starting requires root privileges when binding to port 443.

```bash
cd $agilesec_install_dir
sudo ./scripts/manage.sh start haproxy
```

```bash
cd $agilesec_install_dir
./scripts/manage.sh stop haproxy
```

--------------------------------

### Extract to Alternate Directory

Source: https://docs.keyfactor.com/agilesec/latest/multi-node-linux-install-prerequisites.md

Command to extract the installer package to a specific directory.

```bash
unzip -d $installer_dir <installer_package>.zip
```

--------------------------------

### Bitbucket Scan Configuration Examples

Source: https://docs.keyfactor.com/agilesec/latest/bitbucket-sensor-guide.md

YAML configuration templates for different Bitbucket scan scenarios, including branch filtering and authentication methods.

```yaml
scan_config:
  plugins:
    - isg_bitbucket
    - trigger_discover
    - export
  config:
    isg_bitbucket:
      name: bitbucket
      plugin_config:
        url: "<https://api.bitbucket.org/2.0>"
        username: "<account email>"
        password: "${env:BITBUCKET_PASS}" # ENV for unified sensor
        branch: "develop"
        include_paths:
          - "myorg/myrepo"
```

```yaml
scan_config:
  plugins:
    - isg_bitbucket
    - trigger_discover
    - export
 config:
    isg_bitbucket:
      name: bitbucket
      plugin_config:
        url: "<https://bitbucket.<domain>.com/rest/api/1.0>"
        token: "<oauth token>"
        include_paths:
          - "internal-team"
        exclude_paths:
          - "internal-team/archived-*"
```

```yaml
scan_config:
  plugins:
    - isg_bitbucket
    - trigger_discover
    - export
  config:
    isg_bitbucket:
      name: bitbucket
      plugin_config:
        url: "<https://api.bitbucket.org/2.0>"
        username: "<account email>"
        password: "${env:BITBUCKET_PASS}" # ENV for unified sensor
        include_paths:
          - "internal-team"
        exclude_paths:
          - "internal-team/archived-*"
```

--------------------------------

### Upgrade Plan Console Output

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-agilesec-linux-upgrade-guide-3-6.md

Example console output showing the results of the upgrade plan dry run, including component version changes and configuration review reports.

```bash
$ ./install_analytics.sh upgrade-plan -p $AGILESEC_INSTALL_DIR \
--previous-installer-dir $PREV_INSTALLER_DIR

2026-07-01 16:54:54 [INFO] Logging to: /home/ec2-user/kf_agilesec_unified_installer_rhel9_3.6.0-rc2/logs/install_analytics_ip-10-100-6-254_2026-07-01T16-54-54Z_pid17407.log
2026-07-01 16:55:03 [INFO] Generating upgrade plan...
2026-07-01 16:55:09 [INFO] Running pre-check validation first...
2026-07-01 16:55:09 [INFO] Delegating to prerequisite checks...
2026-07-01 16:55:09 [INFO] Rebuilding version manifest...

2026-07-01 16:55:19 [INFO] Running pre-requisite checks...
2026-07-01 16:55:19 [INFO] Date: Wed Jul  1 04:55:19 PM UTC 2026
2026-07-01 16:55:19 [INFO] Installation directory: /home/ec2-user/351
2026-07-01 16:55:19 [INFO] Mode: upgrade

2026-07-01 16:55:19 [INFO] Running upgrade pre-checks...

================================================================================
Pre-requisite Checks Summary
================================================================================
Checks Passed:   14
Warnings:        0
Checks Failed:   0

2026-07-01 16:55:25 [SUCCESS] All pre-requisite checks passed successfully!
2026-07-01 16:57:47 [INFO] Config review report summary: /home/ec2-user/kf_agilesec_unified_installer_rhel9_3.6.0-rc2/tmp/config-review/20260701165742-17407/UPGRADE_SUMMARY.txt
========================================================================
 Upgrade Plan
========================================================================
Current Installation: /home/ec2-user/351
Installer Version: 3.5.0 → 3.6.0
Node Profile: PRIMARY_FULL_BACKEND

COMPONENT UPGRADES:
  ✓ analytics_manager: 3.5.1 → 3.6.0
  ✓ indexing: 3.5.1 → 3.6.0
  ✓ ingestion: 3.5.1 → 3.6.0
  ✓ mongodb: 7.0.30 → 7.0.37
  ✓ opensearch: 2.19.5 → 2.19.5-3
  ✓ scheduler: 3.5.1 → 3.6.0
  ✓ sm: 3.5.1 → 3.6.0
  ✓ openjdk: 17.0.14 → 17.0.19+10

CONFIGURATION CHANGES:
  ✓ analytics_manager: configuration changes detected
    Changed files (1):
      • analytics-manager (checksum changed, PRODUCT CHANGED)
```

--------------------------------

### Run Certificate Generation Script

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-certificates-management-guide.md

Command to execute the certificate generation script using the specified installation type.

```bash
<installer_directory>/certificates/generate_certs.sh -t <install_type>
```

--------------------------------

### Remote Scan Configuration Example

Source: https://docs.keyfactor.com/agilesec/latest/artifactory-sensor-user-guide.md

A sample YAML configuration for scanning a specific Artifactory repository.

```yaml
scan_config:
  plugins:
    - artifactory_import
    - trigger_discover
    - export
  config:
    artifactory_import:
      name: artifactory
      plugin_config:
        artifactory_token: "${env:ARTIFACTORY_TOKEN}"
        include_repos: ["internal-team"]
        exclude_repos: []
        artifactory_url : "<https://mycompany.jfrog.io>"
```

--------------------------------

### Generate Configuration File

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-single-node-installation-guide.md

Executes the environment generation script to create the .env configuration file for a single-node setup.

```bash
cd $installer_dir
./generate_envs/generate_envs.sh -t single-node
```

--------------------------------

### Diagnose OpenSearch Startup Failures

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-troubleshooting-guide.md

Check service status, port availability, and system limits to identify why the OpenSearch process fails to start.

```bash
cd "$installation_path"
./scripts/manage.sh status opensearch
ss -tlnp | grep -E ':(9200|9300)\b' || true
ulimit -l
tail -100 "$installation_path/services/opensearch/logs/"*.log
```

--------------------------------

### Switch to distribution Git

Source: https://docs.keyfactor.com/agilesec/latest/agilesec-3-6-1-release-notes.md

Removes the installer-provided Git symlink and installs the system-provided Git package from RHEL repositories.

```bash
sudo rm /usr/bin/git          # remove the installer's symlink
sudo dnf install git-core
```

--------------------------------

### Start AgileSec Node Services

Source: https://docs.keyfactor.com/agilesec/latest/agilesec-on-prem-validation-checklist.md

Commands to restart services on a node after completing validation tests.

```bash
cd $agilesec_install_dir
./scripts/manage.sh start
```

--------------------------------

### Provision Application Gateway

Source: https://docs.keyfactor.com/agilesec/latest/add-an-upstream-load-balancer.md

Create the Application Gateway instance with the specified configuration. Provisioning may take 10-20 minutes.

```bash
az network application-gateway create \
  --resource-group $RESOURCE_GROUP \
  --name $APPGW_NAME \
  --location $LOCATION \
  --vnet-name $VNET_NAME \
  --subnet $SUBNET_APPGW \
  --sku Standard_v2 \
  --capacity 1 \
  --public-ip-address ${APPGW_NAME}-pip \
  --http-settings-port 443 \
  --http-settings-protocol Https \
  --frontend-port 443 \
  --servers $VM_PRIVATE_IP \
  --cert-file appgw.pfx \
  --cert-password "AppGwPass123" \
  --priority 100
```

--------------------------------

### Start and check status of services

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-managing-services.md

Perform service operations using the manage.sh script even when systemd is enabled.

```bash
sudo $agilesec_install_dir/scripts/manage.sh start
sudo $agilesec_install_dir/scripts/manage.sh status
```

--------------------------------

### Extract Java keytool

Source: https://docs.keyfactor.com/agilesec/latest/byoc-prerequisites.md

Use these commands to set the installer directory and extract the bundled JRE to access the keytool utility.

```bash
# Set environment variable to installer files location
INSTALLER_DIR=<path-to-installer-dir>

# Extract java keytool to the correct location
mkdir -p $INSTALLER_DIR/tmp
tar -xzf \
  $INSTALLER_DIR/apps/openlogic-openjdk-jre-*17.0.14+7*-linux-x64.tar.gz \
  -C $INSTALLER_DIR/tmp
export \
  JAVA_PATH=$INSTALLER_DIR/tmp/openlogic-openjdk-jre-17.0.14+7-linux-x64
```

--------------------------------

### Generate and Distribute Environment Configuration

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Generate new environment files using the v3.5.0 installer and distribute them to other nodes.

```bash
unzip -d <v3.5.0-installer-dir> <v3.5.0-installer-package>.zip
cd <v3.5.0-installer-dir>
./generate_envs/generate_envs.sh -t multi-node --old-config <v3.4-installer-dir>/generate_envs/multi_node_config.conf
```

```bash
scp <v3.5.0-installer-dir>/generate_envs/generated_envs/env.backend-2 \
  <backend-2-ip>:<v3.5.0-installer-dir>/.env

scp <v3.5.0-installer-dir>/generate_envs/generated_envs/env.frontend-1 \
  <frontend-1-ip>:<v3.5.0-installer-dir>/.env
```

--------------------------------

### Run upgrade precheck

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Executes the precheck script to validate prerequisites and sync certificates from the existing v3.4 installation.

```bash
cd <v3.5.0-installer-dir>
./install_analytics.sh upgrade-precheck -p <v3.4-installation-dir> \
  --vars <v3.4-installation-dir>/scripts/.vars
```

--------------------------------

### Metadata Migration Expected Output

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Example log output indicating successful database and API migration.

```text
...
2026-03-29 05:08:27 [SUCCESS] config.yml applied successfully.
2026-03-29 05:08:29 [SUCCESS] roles.yml applied successfully.
2026-03-29 05:08:31 [SUCCESS] roles_mapping.yml applied successfully.
2026-03-29 05:08:31 [SUCCESS] OpenSearch security configuration applied successfully.
...
> npm run platform-data-init && npm run migrate-mongo:up
...
> node ./src/platform/platform.data.init.js
...
> migrate-mongo up
...
[SUCCESS] Database migration completed successfully.
...
[SUCCESS] API migration script completed successfully.
...
[SUCCESS] v3 Kafka topics created successfully
[SUCCESS] Kafka topics created successfully.
[SUCCESS] Migration completed successfully.
```

--------------------------------

### Tenable Scan Configuration Examples

Source: https://docs.keyfactor.com/agilesec/latest/tenable-sensor-user-guide.md

YAML configuration templates for Tenable scans using API keys, session authentication, or custom filters.

```yaml
scan_config:
  plugins:
    - tenable
    - export
  config:
    tenable:
      name: tenable
      plugin_config:
        url: "<https://tenable.internal.company.com/rest/>"
        access_key: "${env:TENABLE_ACCESS_KEY}"
        secret_key: "${env:TENABLE_SECRET_KEY}"
```

```yaml
scan_config:
  plugins:
    - tenable
    - export
  config:
    tenable:
      name: tenable
      plugin_config:
        url: "<https://tenable.internal.company.com/rest/>"
        username: "${env:TENABLE_USER}"
        password: "${env:TENABLE_PASS}"
```

```yaml
scan_config:
  plugins:
    - tenable
    - export
  config:
    tenable:
      name: tenable
      plugin_config:
        url: "<https://tenable.internal.company.com/rest/>"
        access_key: "${env:TENABLE_ACCESS_KEY}"
        secret_key: "${env:TENABLE_SECRET_KEY}"
        filters:
          - name: "ip"
            operator: "="
            value: "127.0.0.1"
```

--------------------------------

### Set Common Environment Variables

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-troubleshooting-guide.md

Define installation paths and service hostnames required for subsequent diagnostic commands.

```bash
export installation_path=/path/to/install
export installer_path=/path/to/installer
export analytics_internal_domain=kf-agilesec.internal

export mongodb_host=<mongodb-node-hostname> # Example: backend-1.kf-agilesec.internal
export kafka_bootstrap_host=<kafka-broker-hostname> # Example: backend-1.kf-agilesec.internal
```

--------------------------------

### Kafka Connection Warning Logs

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Example logs displayed when the Kafka service is unreachable during migration.

```text
2026-03-31 15:24:38 [INFO] Checking broker backend-1.kf-agilesec.internal:9092...
2026-03-31 15:24:38 [WARN] Kafka broker at backend-1.kf-agilesec.internal:9092 is not reachable (attempt 1).
2026-03-31 15:24:48 [INFO] Waiting 10s for broker to start (attempt 1/10)... (  0s remaining)
2026-03-31 15:25:03 [WARN] Kafka broker at backend-1.kf-agilesec.internal:9092 is not reachable (attempt 2).
2026-03-31 15:25:14 [INFO] Waiting 10s for broker to start (attempt 2/10)... (  0s remaining)
2026-03-31 15:25:29 [WARN] Kafka broker at backend-1.kf-agilesec.internal:9092 is not reachable (attempt 3).
2026-03-31 15:25:39 [INFO] Waiting 10s for broker to start (attempt 3/10)... (  0s remaining)
2026-03-31 15:25:47 [INFO] Kafka broker at backend-1.kf-agilesec.internal:9092 is reachable and mTLS verified.
2026-03-31 15:26:05 [INFO] Checking broker frontend-1.kf-agilesec.internal:9092...
2026-03-31 15:26:05 [WARN] Kafka broker at frontend-1.kf-agilesec.internal:9092 is not reachable (attempt 1)
```

--------------------------------

### Verify Git installation

Source: https://docs.keyfactor.com/agilesec/latest/agilesec-3-6-1-release-notes.md

Checks the Git version as the service user to confirm the fix is applied.

```bash
sudo -u <service user> git --version
```

--------------------------------

### Generate environment files on backend-1

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-3-multi-region-stretch-cluster-with-coordinator-node.md

Executes the environment generation script within the installer directory to create configuration files for all nodes.

```bash
cd $installer_dir
./generate_envs/generate_envs.sh -t multi-node
```

--------------------------------

### Deploy Environment Files to Secondary Nodes

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-multi-node-installation-guide.md

Commands to copy node-specific environment files to the installer directory on secondary nodes.

```bash
# On backend-2
cd $installer_dir/certificates/
cp env.backend-2 ../.env
cd ..
```

```bash
# On frontend-1
cd $installer_dir/certificates/
cp env.frontend-1 ../.env
cd ..
```

--------------------------------

### Remote Scan Configuration Examples

Source: https://docs.keyfactor.com/agilesec/latest/git-sensor-user-guide.md

YAML configuration templates for scanning public repositories, private repositories with authentication, and GitLab instances.

```yaml
scan_config:
  plugins:
    - isg_git
    - trigger_discover
    - export
  config:
    isg_git:
      name: git
      plugin_config:
        url: "<https://github.com/myorg/public-repo.git>"
        branch: "main"
```

```yaml
scan_config:
  plugins:
    - isg_git
    - trigger_discover
    - export
  config:
    isg_git:
      name: git
      plugin_config:
        url: "<https://github.com/myorg/public-repo.git>"
        branch: "main"
        username: "myuser"
        password: "${env:GIT_PASS}"
```

```yaml
scan_config:
  plugins:
    - isg_git
    - trigger_discover
    - export
  config:
    isg_git:
      name: git
      plugin_config:
        url: "<https://gitlab.com/myorg/myrepo.git>"
        branch: "develop"
        username: "myuser"
        password: "${env:GIT_PASS}"
```

--------------------------------

### Manage services with manage.sh

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-managing-services.md

The primary method for controlling platform services by navigating to the installation directory and executing the manage script.

```bash
cd $agilesec_install_dir
./scripts/manage.sh [action] [options] [services...]
```

--------------------------------

### Initialize External CA Client

Source: https://docs.keyfactor.com/agilesec/latest/thales-ctm-sensor-user-guide.md

Execute the initialization script to create the client and download the root CA when using an External CA.

```bash
./init.sh --url https://thales.ctm.local --token <Registration Token> --cert <client cert file> --name <cert common name>
```

--------------------------------

### Service Status Output Examples

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-2-adding-a-new-frontend-to-an-existing-cluster.md

Expected output for service status checks on primary and additional frontend nodes.

```text
$ ./manage.sh status
SERVICE                   DESCRIPTION                              STATUS                         UPTIME         
------------------------  ---------------------------------------- ------------------------------ ---------------
mongodb                   MongoDB Server                           Running (PID: ####)            23h 8m 51s      
opensearch                OpenSearch Search Engine                 Running (PID: ####)            23h 8m 52s      
kafka                     Kafka Server                             Running (PID: ####)          23m 17s        
scheduler                 Scheduler Microservice                   Running (PID: ####)            23h 8m 37s      
analytics-manager         Analytics Manager Microservice           Running (PID: ####)            23h 8m 37s      
ingestion                 Ingestion Microservice                   Running (PID: ####)            23h 8m 37s      
indexing                  Indexing Microservice                    Running (PID: ####)            23h 8m 37s      
sm                        Security Manager Microservice            Running (PID: ####)            23h 8m 37s      
haproxy                   HAProxy Load Balancer                    Running (PID: ####)         
```

```text
$ ./manage.sh status
SERVICE                   DESCRIPTION                              STATUS
------------------------  ---------------------------------------- --------
api                       Web API Microservice                     Running
webui                     Web UI Microservice                      Running
opensearch-dashboards     OpenSearch Dashboards                    Running
cbom                      CBOM Exporter Microservice               Running
haproxy                   HAProxy Load Balancer                    Running
```

--------------------------------

### Container Scan Configuration Examples

Source: https://docs.keyfactor.com/agilesec/latest/container-sensor-user-guide.md

YAML configuration templates for scanning public images, private registries with credentials, or private registries with token authentication.

```yaml
scan_config:
  plugins:
    - container_import
    - trigger_discover
    - export
  config:
    container_import:
      name: container
      plugin_config:
        images:
          - "docker.io/library/alpine:latest"
          - "docker.io/library/nginx:latest"
```

```yaml
scan_config:
  plugins:
    - container_import
    - trigger_discover
    - export
  config:
    container_import:
      name: container
      plugin_config:
        username: "${env:REGISTRY_USER}"
        password: "${env:REGISTRY_PASS}"
        images:
          - "myregistry.io/myapp:v2.1"
          - "myregistry.io/backend:latest"
```

```yaml
scan_config:
  plugins:
    - container_import
    - trigger_discover
    - export
  config:
    container_import:
      name: container
      plugin_config:
        token: "${env:REGISTRY_TOKEN}"
        images:
          - "myregistry.io/myapp:v2.1"
```

--------------------------------

### Azure Key Vault Scan Configurations

Source: https://docs.keyfactor.com/agilesec/latest/azure-key-vault-sensor-user-guide.md

YAML configuration examples for different Azure Key Vault scanning scenarios and performance tuning.

```yaml
scan_config:
  plugins:
    - azkeys
    - export
  config:
    azkeys:
      name: azkeys
      plugin_config:
        vault_url: "<https://my-vault.vault.azure.net/>"
        client_secret_credentials:
          tenant_id: "your-tenant-id"
          client_id: "your-client-id"
          client_secret: "${env:AZURE_CLIENT_SECRET}"
```

```yaml
scan_config:
  plugins:
    - azkeys
    - export
  config:
    azkeys:
      name: azkeys
      plugin_config:
        subscription_ids: [ "your-subscription-id" ]
        client_secret_credentials:
          tenant_id: "your-tenant-id"
          client_id: "your-client-id"
          client_secret: "${env:AZURE_CLIENT_SECRET}"
```

```yaml
scan_config:
  plugins:
    - azkeys
    - export
  config:
    azkeys:
      name: azkeys
      plugin_config:
        managed_credentials:
          client_id: "your-managed-identity-client-id"
```

```yaml
scan_config:
  plugins:
    - azkeys
    - export
  config:
    azkeys:
      name: azkeys
      plugin_config:
        threads_per_target: 10
        threads_per_vault: 4
```

--------------------------------

### List available services using manage.sh

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-managing-services.md

Command to list all services available for management.

```bash
./manage.sh list
```

--------------------------------

### Create Keystore Password File

Source: https://docs.keyfactor.com/agilesec/latest/byoc-update-secrets-manager-keystore.md

Generate a secure password file for the keystore and set appropriate permissions.

```bash
openssl rand -hex 24 > sm-service-keystore.pass
chmod 0400 sm-service-keystore.pass
SM_PASS="$(cat sm-service-keystore.pass)"
```