Connect Windows host
Step 1 - Open Integrations
Sign in to app.jutsu.ai, then select Integrations in the left sidebar.
- The Data Sources tab is the connection surface for endpoints, cloud platforms, and SaaS systems.
- If the Windows tile is visible but not interactive, ask a workspace Admin or Owner to complete the connection.
Step 2 - Select Windows host
In Data Sources, find the Endpoint section and select the Windows host tile.
WHAT IT COLLECTS The Windows collector streams Security and System events. Sysmon events are added automatically when the Sysmon Operational log is present on the host.
Step 3 - Register the collector
Enter a clear, unique collector name and select Create.
- Use a name that helps responders identify the device, such as its hostname, environment, or business function.
- The source types are fixed by the Windows catalog entry and cannot be edited in this flow.
- Creating the collector reserves one connected-asset slot and creates an asset record immediately.
Step 4 - Copy the Quick install command
After registration, select Copy command while the Collector registered dialog is still open.
SHOWN ONCE The command contains the newly created collector credential and is displayed only in this creation dialog. Copy it before selecting Close.
For a normal installation, use the Quick install command exactly as generated. It sets the token in the current shell and starts a child PowerShell process with a process-scoped execution-policy bypass.
$env:JUTSU_TOKEN='<token shown in Jutsu>'; powershell -ExecutionPolicy ByPass -c "irm https://api.jutsu.ai/install.ps1 | iex"
OPTIONAL INTEGRITY CHECK Expand Verify script before running to compare the downloaded collector script with the SHA256 value shown by Jutsu.
Step 5 - Open PowerShell as Administrator
On the Windows host, open Start, search for Windows PowerShell, and choose Run as Administrator.
- Approve the User Account Control prompt if Windows displays one.
- Use the 64-bit PowerShell executable on a 64-bit host. The installer rejects 32-bit PowerShell on 64-bit Windows.
WHY ELEVATION IS REQUIRED The installer writes under Program Files and ProgramData, creates an automatic Windows service, and may install the osquery service.
Step 6 - Paste and run the command
Paste the copied one-line command into the elevated PowerShell window and press Enter.
- Keep the same PowerShell window open until the installer returns to the prompt.
- Do not split or rearrange the generated command; the token assignment must run before the child PowerShell process starts.
- The bootstrap checks the Windows platform, PowerShell version, administrator rights, token format, and token-to-OS match before handing off to the Windows installer.
Step 7 - Wait for installation and validation
Allow the installer to download, configure, validate, and start the Windows agents.
During a normal run, the console reports these major milestones:
- Detect the Windows architecture and validate that the token was minted for Windows.
- Download the published Windows collector script and verify its checksum when available.
- Install or update the pinned Vector build and write the Jutsu configuration.
- Validate the configuration, register the JutsuVector service, and set it to start automatically.
- Verify the Jutsu health and data endpoints, then wait up to 60 seconds for an event to land.
- Install and restart osqueryd for compliance posture when the Jutsu control plane uses HTTPS.
ALLOW TIME The first run may take several minutes because Vector and osquery can be downloaded and installed. Network speed and endpoint security inspection affect the duration.
Step 8 - Confirm the installer completed
Wait for the success summary and the PowerShell prompt to return.
A successful installation should report:
- Service: JutsuVector is running.
- Configuration: C:\ProgramData\Jutsu\vector.yaml was written and validated.
- Connectivity: Jutsu health and ingest endpoints are reachable, or the collector will buffer until they are.
- Events: The installer either confirms an event reached Jutsu or explains that the host may be idle and to check shortly.
- Posture: osqueryd is installed and restarted when HTTPS enrollment is available.
NORMAL TIMING The final message says the host should appear under Data Sources within about 60 seconds. A quiet host can take longer to show event activity even when the service and token are valid.
Verify the connected asset in Jutsu
Return to Jutsu and open Assets. Find the collector name you created and confirm that it shows Connected.
- The asset card should display Windows host and the Windows source-type badges.
- The relative timestamp should update as health heartbeats arrive.
- Open Manage from the asset actions to review activity, recent events, health, throughput, buffer usage, and service versions.
Post-install verification
Use both the Jutsu console and the Windows host to verify that the installation is healthy. A running service proves the agent started; recent activity in Jutsu proves delivery end to end.
In Jutsu
| Check | Expected result | Interpretation |
|---|---|---|
| Asset status | Connected | A recent health heartbeat was received. |
| Health | Healthy | No current sink errors, drops, or high buffer pressure. |
| Recent activity | Events begin to appear | Windows Event Logs are reaching the Jutsu ingest path. |
| Source types | Security and System; Sysmon when available | The token and the installed log channels match. |
On the Windows host
Get-Service JutsuVector Get-Service osqueryd Test-NetConnection api.jutsu.ai -Port 443 Get-WinEvent -LogName Security -MaxEvents 5
- JutsuVector should report Status Running and StartType Automatic.
- osqueryd should be Running when posture collection was installed. Log collection can still be connected if osquery was intentionally skipped.
- The Security log command should return recent events. A quiet log can delay the first visible event in Jutsu.
STATUS TIMING Health is reported about every 30 seconds. Jutsu marks a collector offline after more than 90 seconds without a heartbeat; short gaps can appear as idle before becoming inactive.
Troubleshooting
Start with the exact message printed in the elevated PowerShell window, then use the checks below.
| Symptom | Likely cause | What to do |
|---|---|---|
| Must run elevated | PowerShell is not running as Administrator. | Close it, choose Run as Administrator, and paste the same command again. |
| PowerShell 5.1 required | The shell is older than the supported minimum. | Open Windows PowerShell 5.1 or a newer PowerShell version. |
| 32-bit PowerShell on 64-bit Windows | The x86 shell cannot install the correct Vector build. | Use C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe. |
| Token rejected or wrong OS | The command was copied incompletely or the token does not belong to the Windows collector flow. | Return to Data Sources, create a Windows host collector, and use its generated command. |
| Download fails | Outbound HTTPS, proxy, DNS, or endpoint security blocks the script or package download. | Allow HTTPS to the Jutsu endpoint and required package hosts, then rerun the installer. |
| JutsuVector does not start | Configuration validation, a locked service, or endpoint security interrupted startup. | Run Get-Service JutsuVector and review C:\ProgramData\Jutsu\startup-stderr.log if it exists; reboot and rerun if the service is stuck. |
| Connected but no events | The host is quiet, the Windows logs are unavailable, or egress to /ingest is blocked. | Check the Security log locally, wait a few minutes, and verify outbound HTTPS. The local disk buffer drains after connectivity returns. |
| No Sysmon events | Sysmon was not installed or its Operational channel was absent during setup. | Install and configure Sysmon, then rerun the same Jutsu installer command. |
| Logs arrive but posture is unknown | osquery was skipped, could not enroll, or cannot validate the TLS certificate. | Check Get-Service osqueryd and its enrollment messages. Private-CA deployments must provide the correct PEM CA bundle. |
SAFE RERUN The Windows installer supports rerunning on an existing host. It replaces the managed JutsuVector service and configuration, validates the new setup, and preserves the final automatic service state.
Day-2 operations
Manage the collector
- Health and activity: Open the Windows asset in Assets to review the latest heartbeat, event counts, buffer usage, dropped events, CPU load, memory, and versions.
- Token rotation: Rotate the collector credential from its management actions. The previous credential can remain valid during the selected grace window while the new command is redeployed.
- Archive and uninstall: Archive the asset in Jutsu to stop accepting new ingest and free the plan slot, then run the Windows uninstaller from an elevated PowerShell window to remove the local JutsuVector service, configuration, buffer, and Jutsu-managed posture agent.
Completion checklist
- The Windows host collector has a recognizable name.
- The generated command was run in an elevated 64-bit PowerShell window.
- The installer returned to the prompt without a fatal error.
- Get-Service JutsuVector shows Running.
- The Windows asset shows Connected in Jutsu.
- Security and System events are visible; Sysmon events are visible when Sysmon is installed.
- Health timestamps continue to update and the asset reports Healthy.
- osquery posture is enrolled when endpoint compliance monitoring is required.
COMPLETE The Windows host is integrated when its asset remains Connected and current Windows events are visible in Jutsu.