Deployment Methods | Documentation

Deploy the QuantLayer agent in minutes on a single device or across an entire network segment—cloud, hybrid, or on‑prem (including restricted sites).

Overview

Deploy the QuantLayer agent in minutes—on a single endpoint, an OT server, or across an entire network segment. Enrollment supports cloud, hybrid, and on‑prem environments (including restricted sites where outbound internet access is unavailable).

Operational Note (OT / constrained sites)

For plants and regulated environments, QuantLayer can be deployed on‑prem (local console + local package repository) or cloud‑managed. Use the same enrollment workflow—only the agent download source and telemetry path change.

Single device enrollment
Network discovery + auto-enroll
IT / OT / IoT compatible

Method 1 — Deploy to a single device

Use Add Single Device to register one endpoint or server, then install the agent using the generated command. This is ideal for pilots, VIP assets, jump hosts, and OT engineering workstations.

1) Open Assets & Devices

Go to Infrastructure → Assets & Devices. Confirm the target device is Connected or ready to be enrolled.

2) Click Add Single Device

This creates a Registered row for the device and generates an install command for your selected OS.

3) Click Install and select OS + version

Choose Windows / Ubuntu / Debian and the version. Copy the generated install command.

4) Run the command as Administrator (Windows)

Paste into PowerShell (Run as Administrator) and execute. The agent installs, registers, and begins reporting posture and events.

5) Verify status changes to Connected

Back in the console, the device transitions from Registered → Connected. You can now open a remote console session (if enabled).

Assets & Devices list with Add Single Device and Console action — **Assets & Devices**
Add a single device, then click Install or Console from the device row.

Install modal with OS/version and generated command — **Install modal**
Select OS + version and copy the generated install command.

Endpoint execution in PowerShell (Admin) or Linux shell — **Endpoint execution**
Run the command in PowerShell (Admin) on Windows or a shell on Linux.

Example install command (Windows PowerShell)

Invoke-WebRequest 'https://<your-console>/file-download/binary/getExe/ps_script.ps1' \
  -OutFile 'ql-init.ps1'

PowerShell -ExecutionPolicy Bypass -File .\ql-init.ps1 \
  -token '<ENROLLMENT_TOKEN>' \
  -server 'https://<your-console>'

# Cleanup
Remove-Item .\ql-init.ps1

Sample output (device response)

Downloading QuantLayer Agent... OK
Installing... OK
Registering device identity (HW-rooted)... OK
Device enrolled: devFx5BmB32v...
Policy sync: 12 policies applied
Patch inventory: 18 updates detected (2 critical)
Remediation status: Pending approval

Patch management workflow (how to demo)

After enrollment, demonstrate: patch inventory → policy approval → install status. For OT, use staged windows and maintenance approvals.

Method 2 — Deploy across an entire network

For fleet onboarding, use Network & Topology to discover devices and auto-enroll them using a designated server (or scanning host). This is ideal for OT zones, remote sites, branch networks, and IoT segments.

1) Open Network & Topology

Go to Infrastructure → Network & Topology. Verify the server / scanning host is listed and named clearly (site + role).

2) Click Discover Devices (scan network)

Select OS + version for the scanning host. Copy the generated command and run it on the server to initiate discovery.

3) Auto-enroll discovered devices

As endpoints are discovered, QuantLayer enrolls them based on your policy (auto-approve or staged approvals).

4) View topology graph

The Topology view renders servers and connected devices, making it easy to show segmented zones and device relationships.

Naming convention (recommended)

Use a consistent pattern so customers instantly understand the environment: <SITE>-<ZONE>-<ROLE>-<NN>. Example: HAMILTON-OT-EDGE-SCAN-01 or PLANT1-IT-DOMAIN-CTRL-01.

Network & Topology screen with Discover Devices button — **Network & Topology**
Click Discover Devices to scan and enroll devices at scale.

Networks list table with actions — **Networks list**
Manage scanning hosts, view details, and trigger installs.

Topology visualization showing servers and connected devices — **Topology visualization**
Show many devices connected via servers across a site/zone.

Example discovery command (Linux bash)

curl -fsSL "https://<your-console>/agents/ql-init.sh" -o ql-init.sh
chmod +x ql-init.sh
sudo ./ql-init.sh \
  --token "<ENROLLMENT_TOKEN>" \
  --mode "discover" \
  --subnet "10.10.0.0/16" \
  --site "PLANT1" --zone "OT"

# Expected: discovery started, devices queued for enrollment

Sample output

Discovery started: 10.10.0.0/16
Hosts found: 64
Eligible endpoints: 42
Auto-enroll: enabled (policy)
Topology graph: updating
Next sync: 60s

On‑prem vs cloud deployment

Cloud-managed: agents download and report to the QuantLayer cloud. On‑prem: deploy a local console and local package repository; agents enroll using the same steps but point to the on‑prem endpoint. No internet: use a local mirror (USB/offline repo) and allowlist only internal traffic.

What to show in a customer demo

Use this quick flow to make the value obvious to IT, OT, and operations stakeholders.

1) Seamless enrollment

Add a device → install agent → status changes to Connected. Then show identity, posture, and policy sync.

2) Patch posture + staged enforcement

Run a patch inventory command, show results in the console, then demonstrate staged remediation for OT maintenance windows.

3) Topology visibility

Discover a network, auto-enroll devices, then show topology with servers and connected endpoints.

4) Cloud or on‑prem

Explain deployment options based on site constraints (internet access, compliance, sovereignty, air‑gapped).