Install (SentinelOne RSO)

If SentinelOne is already deployed everywhere and you would rather not stand up a second deployment tool, Remote Script Orchestrator will do the install. It downloads the bundled installer on the endpoint and runs it silently, so the endpoint needs outbound access to downloads.stairwell.com but you need nothing else in the middle.

What you need first

• A Stairwell environment ID
• A forwarder authentication token
• .NET Core 5.0 or newer, which the bundled installer includes
• SentinelOne Remote Script Orchestrator

📘

RSO is separately licensed

S1 RSO requires an additional license from SentinelOne. In some cases SentinelOne will enable it during an active security incident. If you do not have it, email your SentinelOne contact.

Background: Feature Spotlight: RemoteOps custom script actions.

🚧

Do not start with your crown jewels

The first thing a new forwarder does is a full-disk backscan, which is I/O-intensive for a few hours. Treat your first several installs as sacrificial: they upload the most unique files. Every later install is cheaper, because Stairwell already knows what the earlier ones sent. See Forwarder Performance Tuning for the deployment order that makes this cheapest.

Create the script

Both the environment ID and the token are passed in as script inputs rather than baked into the script, so the same script serves every environment and no token is stored in the RSO library.

function runfunc(
    [Parameter(Mandatory = $true)][string]$environment_id,
    [Parameter(Mandatory = $true)][string]$token
) {
    #Do your script actions here
    $TempFolder = ([io.path]::GetTempPath())
    $InceptionInstallerPath = Join-Path $TempFolder "InceptionForwarderBundle.exe"
    try {
        $ProgressPreference = 'SilentlyContinue'
        Invoke-WebRequest -Uri "https://downloads.stairwell.com/windows/latest/InceptionForwarderBundle.exe" -OutFile $InceptionInstallerPath
    }
    catch {
        Write-Error "Error downloading the inception installer. Error $PSItem"
        exit 1
    }
    Start-Process -FilePath $InceptionInstallerPath -Wait -NoNewWindow -ArgumentList "/install", "ENVIRONMENT_ID=$($environment_id)", "TOKEN=$($token)", "/quiet", "/norestart"
    # optional - DOSCAN=0 to not backscan
}
runfunc @Args # kick off the script

Two details in that script are load-bearing:

• The URL is correct as written. windows/latest/InceptionForwarderBundle.exe is the stable alias for the current bundled build, and it is the only latest path that resolves. Point it at a versioned file from Forwarder Downloads if you would rather pin a build.
• DOSCAN=0 suppresses the backscan. Add it to the argument list on machines you cannot afford to have scanned on install day, and understand what you give up: the forwarder will only see files that change from that moment on, and everything already on disk stays invisible until a backscan runs. See Force or Skip a Backscan.

Load it into RSO

Upload the script to the RemoteOps Script Library:

• Script Details
  • Script Name: Stairwell Forwarder Installer
  • Script Type: Action
  • OS Type: Windows
  • Upload the script
• Script Settings
  • Script Execution Timeout: 3600 seconds
  • Input Examples: your environment ID and token
• Review the Summary and Submit

The 3600-second timeout is not padding. The installer runs to completion under -Wait, and on a slow link the download alone can take a while.

Run it

• Go to Endpoints and select the machines or group
• Actions → Run Script
• Script Selection: choose the script you uploaded
• Input/Output
  • Script Input: the environment ID and token
  • Output Destination: None -- no output handling needed
• Verify the automation task

📘

If your fleet runs a restricted PowerShell execution policy, confirm how RSO invokes the script before you deploy widely. A policy that blocks it will fail silently across every endpoint at once.

Confirm it worked

1. Sign in at app.stairwell.com.
2. Open Assets and find the new asset names.
3. Check the All Objects count on each one.

Ingestion takes a few minutes to become visible. If an asset appears but its object count stays at zero for much longer than that, start with What to Check First.

What should I read next?

• Windows Install Parameters, for every flag the installer accepts.
• Antivirus Exclusions -- SentinelOne is on these endpoints by definition, so this one applies to you.
• Windows Troubleshooting, if an endpoint does not check in.