Install the agent
Download the MSI, choose the modules, install by hand or at scale, check it works, uninstall.
The FirstSI agent is a Windows service (Windows 10 and 11, Windows Server) that carries every module. You install it once; after that, modules are switched on or off from the console without reinstalling.
Download
In FSI Agents (#/fsi-agents), the Download button, reserved for administrators, offers two packages: Download (.msi) for Windows x64, the usual case, and Download ARM64 (.msi) for ARM-based PCs (recent Surface Pro, Snapdragon…).
Both the MSI and the executable are signed. Windows therefore shows the publisher, and remote updates check the signature before installing anything.
The three values you need
| Value | Where to find it |
|---|---|
Server address (SERVERURL) | Your console's address, for example https://console.example.com |
Registration key (APIKEY) | Settings → Organization → API Key (administrators) |
Signing secret (HMACSECRET) | Supplied with your customer account |
Install by hand
Double-click the MSI and follow the wizard. If you want to choose the modules at install time, the command line below is easier.
Silent install (mass deployment)
msiexec /i FSIAgent.msi /qn ^
SERVERURL="https://console.example.com" APIKEY="<customer key>" HMACSECRET="<supplied secret>" ^
NETDIAG=true NETFLOW=true ASSETMONITOR=trueAlways pass SERVERURL, APIKEY and HMACSECRET on the command line. The same command works in a GPO (startup script), Intune, SCCM, Toems or any deployment tool.
Installer properties
| Property | Default | Effect |
|---|---|---|
NETDIAG | false | Workstation network diagnostics (NetDiag) |
NETFLOW | false | Network flows and DNS queries of the computer (Network flows) |
ASSETMONITOR | false | Software and hardware inventory (AssetMonitor) |
FILEMONITOR | false | File access auditing, for file servers (FileMonitor) |
HOSTMONITOR | false | Availability checks run by the agent (HostMonitor) |
NETWORKMONITOR | false | SNMP, ping and network discovery (NetworkMonitor) |
DBMONITOR | false | SQL Server and MariaDB performance (DBMonitor) |
SITRACER | false | Windows authentication, to install on domain controllers (SI-Tracer) |
FILEEVENTS | false | NetDiag: files opened by applications (sensitive option) |
RELAIS | empty | Egress gateways (FirstSI relay or proxy), separated by ;. See Network egress |
RELAISDIRECT | true | false forbids falling back to a direct connection |
DEFENDEREXCLUSION | true | Adds a Windows Defender exclusion for the agent's folder and process |
The Collector (syslog and IPFIX) and Directory (Active Directory, connectors) modules have no property. You turn them on from the console, on the agent of your choice.
These properties only count at the first installation: an update leaves the configuration file in place. To change the modules of an agent that is already installed, use the gear button on its card in FSI Agents.
Check that the agent is online
Within a minute, the machine shows up in FSI Agents as Online, meaning it has checked in during the last 5 minutes. On the machine itself, the First SI - FSI Agent service must be running (automatic start, system account). After an abnormal stop it restarts on its own after 60 s, up to 3 times a day. The first data reaches the screens of the enabled modules a few minutes later.
If nothing appears, see An agent doesn't show up or stays offline.
Isolated network or mandatory proxy
A computer without Internet access can go through another FirstSI agent (a relay) or through the company proxy. For the first installation, it has to be told which gateway to use:
msiexec /i FSIAgent.msi /qn SERVERURL="https://console.example.com" APIKEY="<key>" HMACSECRET="<secret>" ^
NETDIAG=true RELAIS="relay1.example.local:3129;relay2.example.local:3129"The rest is set up in the console afterwards; see Agent network egress.
Uninstall
Go to Windows Settings → Apps (or Programs and Features) and remove "First SI - FSI Agent". Silently: msiexec /x FSIAgent.msi /qn.
Uninstalling stops the service, deletes the agent's data and log folders and its registry key, and removes the Defender exclusion if it had added one. The machine stays listed in the console until you delete it in FSI Agents.
Source: · FirstSI Docs · updated 2026-10-10