CyberCLI
Sign in →

← All recipes · Install

Install CyberCLI from scratch

~8 minutes

From a fresh Ubuntu VM (or LXC) to a running engine with the dashboard open at /first-30-minutes, in about 8 minutes.

Last updated 2026-06-07 · 4 steps

§1

Prerequisites

§2

What you'll do

You'll run one curl|sh line, the script will probe your host, download the signed binary, install systemd units, and bring up the dashboard on port 8090. By the end you'll have a Free-tier install with the SOC pipeline live and ready to enroll its first connector.

§3

Steps

Step 1

Run the install line

From the host you want CyberCLI running on, run the install script. The script reads what platform and architecture you're on, downloads the right signed binary, verifies its signature, and unpacks under /usr/local.

$ curl -sSfL https://cybercli.com/install.sh | bash
Verify

The script prints an `installed at /usr/local/bin/cybercli` line and shows the engine version. If verification of the binary signature fails, the script aborts cleanly — that's the expected guard.

Step 2

Run the doctor + the setup wizard

The doctor surfaces anything that's missing — config dir, port availability, disk space. The wizard probes your hardware and picks the AI lane (local Ollama if you have GPU, byo_server or off otherwise).

$ cybercli doctor
$ cybercli setup wizard
Verify

Doctor prints `All checks passed.` Wizard prints the chosen lane + the recorded AiPolicyRecord — the lane is now persisted at `~/.cybercli/ai_policy.json`.

Step 3

Start the dashboard service

The install script enables the systemd units but does not start them automatically (so you can inspect first). Start them once you're ready.

$ sudo systemctl start cybercli-syslog-ingest
$ sudo systemctl start cybercli-vector
$ cybercli dashboard serve --port 8090
Verify

`systemctl is-active cybercli-syslog-ingest` returns `active`. The dashboard prints `serving on http://127.0.0.1:8090` and stays in the foreground.

Step 4

Open the dashboard

From a browser on the same host, open http://127.0.0.1:8090. From a remote host, port-forward 8090 over SSH (`ssh -L 8090:localhost:8090 <host>`) — there is no public auth gateway on the engine port by design.

Verify

You land on the CyberCLI overview with CYCON 5 (peacetime) in the header and an empty signals queue.

§4

Verify end to end

§5

Troubleshoot

`curl|sh` errors with 'binary signature verification failed.'

Cause The downloaded binary's signature doesn't match the public key bundled in the install script. Usually a transient mirror issue; rarely a tampered binary.

Fix Re-run the install script after 30 seconds; if it fails twice, file a security issue at security@cybercli.com — do NOT bypass the signature check.

`cybercli dashboard serve` errors with `address already in use`.

Cause Another process holds port 8090. Common: a previous CyberCLI session still running.

Fix Run `ss -tlnp | grep 8090` to find the holder. Either kill it or pick a new port with `--port 8091`.

Wizard records lane=safe_disabled.

Cause Hardware probe found neither a usable GPU nor a configured byo_server endpoint, and the install is Free tier (which doesn't allow api lane).

Fix Either install Ollama + a small model (llama3.1:8b) and re-run `cybercli setup wizard`, or accept safe_disabled for now and add a byo_server endpoint later via the dashboard /settings page.

What to do next

Connect your first Wazuh manager

Point CyberCLI at an existing Wazuh manager, watch the first alerts flow through the SOC pipeline, and verify the audit chain advances.
Wire the local AI lane via Ollama

Run the entire AI digest path on a local Ollama server — no API costs, no data egress, full sovereignty.