Forwarder Downloads

The current file forwarder for each operating system, with its release notes and the compatibility it was tested against. Pick the row for the platform you are deploying to and download the package. If you are deploying at scale, the installers here are the same files your management tool distributes; nothing is repackaged for a particular deployment method.

New deployments should take the current version. Older supported versions are kept for environments with a compatibility constraint, and each has its own page in this section.

How do I install the Windows forwarder?

Windows ships as three packages, and the choice between them is about .NET rather than about features.

Release notes: Windows Forwarder 1.7.9.

Microsoft patches .NET monthly. If you take the standalone package, keeping that runtime current is part of your normal patching rather than something the forwarder does for you.

How do I install the macOS forwarder?

One signed package covers Intel and Apple silicon. On a managed Mac you also need the three configuration profiles below, because macOS will not let the forwarder do its job without them.

Release notes: macOS Forwarder 1.7.4.

The profiles are versioned separately from the forwarder, so a forwarder upgrade does not normally mean re-pushing them. Deliver them through your MDM before or alongside the package. A forwarder installed without the privacy preferences profile starts, registers, and collects nothing, which is the same silent failure mode the connectivity check exists to catch on the network side.

How do I install the Linux forwarder?

One package per distribution family. Match the package to the major release rather than to the kernel; the kernel column in the compatibility table is what was tested, not a requirement to match exactly.

Release notes: Linux Forwarder 2.5.1.

Two things to know before you deploy on Linux. The auditd daemon has to be enabled on every supported distribution for this forwarder version. And eBPF is not supported in the Linux forwarder today; support for it is in development.

What if the host cannot take a forwarder at all?

Use swell on a schedule instead. That is the answer for network and security appliances, for hosts whose vendor will not permit third-party agents, and for anything where you want file-level visibility without installing a service. See swell Downloads and Install on a Linux Appliance.

How long is a forwarder version supported?

Stairwell publishes an end of support date for a version at least six months before that date arrives. After it, the version reaches end of life and is no longer maintained: no security updates and no platform compatibility work.

The practical consequence is that upgrading forwarders is a routine you want in place before you need it, not a project. Asset Configuration covers the groups that make a staged upgrade one change rather than a fleet-wide one.

What do I do after installing?

Confirm the deployment took, in this order:

1. The machine appears under Assets with a recent check-in. See Assets.
2. Sightings start arriving for it, which is what proves the intake path is being used and not merely reachable.
3. The data lands in the environment you intended. See Environments.
4. Collection is tuned for the machines you deployed to, through the group policy in Asset Configuration.

If nothing arrives and the install reported success, go back to Pre-Deployment Check and run the connectivity check from that network. A forwarder that registers and delivers nothing is almost always a TLS-inspecting proxy or a firewall that allows the web app and not the intake endpoints.