Deploy surveillance. Across your network.
Understand how TERO fits into your infrastructure. Choose a Sensor deployment path, plan its network placement, and follow the guide from installation to verified evidence.
A Sensor in the right place.
A clear path to evidence.
TERO’s console manages your deployment. A Sensor runs on a dedicated host inside the network zone you want to monitor. It runs your selected Decoys and reports their recorded activity back to the console.
and authorised test client
& evidence
Review investigations
The business or network boundary you organise in TERO.
The installed host responsible for that network location.
A realistic service or resource that records interactions.
Start with your infrastructure.
Choose a guide for the network where your workloads already live. Review the exact target profile and installation material in TERO before creating a new host.
Cloud VM
Place an always-on Sensor inside the VPC or VNet you want to monitor. Start with an existing virtual machine you manage.
Linux VM
Use a dedicated Linux host in your office, server network or datacenter. Keep the Sensor close to the systems and users in that zone.
Virtual Appliance
Plan a preconfigured Sensor guest for a supported hypervisor combination. Match the appliance format and guest requirements to your platform.
Windows Server
Review the host, service and runtime requirements for a Windows Server deployment. Select the exact Server version and architecture in TERO.
A documentation guide explains the deployment path. Your TERO console determines the exact platform, release and capabilities you can install.
Where should the Sensor live?
A Sensor operates from its own network position. Place it where your intended clients can reach its Decoys through deliberately scoped private rules.
| Your environment | Deployment guide | Typical Sensor location |
|---|---|---|
| Applications on AWS | Dedicated EC2 host in the intended VPC/subnet | |
| Applications on Azure | Dedicated VM in the intended VNet/subnet | |
| Applications on Google Cloud | Dedicated Compute Engine host in the intended VPC | |
| Office or datacenter systems | Dedicated host in that network or security zone | |
| Hypervisor or Windows host requirement | Appliance / Windows reference | The exact host combination defined by the deployment profile |
Do not assume one Sensor can reach every office, VPC or isolated subnet. Review routes, allowed client sources and the intended endpoint bindings for each zone.
From host to verified evidence.
Each deployment guide follows the same sequence, with provider-specific preparation and commands.
Select the target
Choose the Environment, Sensor and exact deployment profile.
Prepare the host
Set up compute, persistent storage, private access and runtime.
Install & enroll
Verify the signed release and activate the intended installation.
Prove the result
Deploy a Decoy, run a controlled test and inspect its evidence.
Always-on operation
The installed Sensor runs as a managed service. Keeping a browser or administration terminal open is not required.
Private service access
Allow only the intended client sources and Decoy ports. Keep administration separate from service ingress.
Verify each layer
Sensor connectivity, runtime health, Decoy readiness and recorded evidence are separate checks.
Before you begin.
A network zone to monitor
Identify the office, VPC, VNet or workload boundary, and its permitted test-client path.
An authorised TERO workspace
Select the intended organization, Environment and Sensor entitlement. Reuse an existing pending Sensor when recovering enrollment.
A host that matches the profile
Confirm OS, architecture, runtime, CPU, memory, persistent storage and protected administration.
The required outbound access
Plan HTTPS access to TERO, signed release downloads and the approved image registry, plus prerequisite services.
Established release trust
Use the administrator-approved verifier and signer trust. Verify authenticity before privileged installation.
A controlled test client
Prepare an authorised private client and a documented, harmless interaction for the selected Decoy.
A finance service in AWS.
Walk through the complete setup: choose the VPC, create the Sensor and test client, configure security groups, enroll, query a PostgreSQL Decoy and verify the investigation.
One controlled private interaction
Traceable investigation evidence
Common deployment questions.
Does TERO create my cloud VM?
The existing-VM workflow guides you through a host you create or already manage. Automated provisioning is a separate workflow; it is not performed by this documentation page.
Do I host the TERO console on the Sensor?
The Sensor connects to the hosted TERO API and console. Do not install the control plane or use a development laptop API as part of the customer Sensor workflow.
Is an online Sensor enough to verify installation?
No. Check the observed host and exact release, runtime readiness, Decoy readiness and a real interaction reaching the correct investigation.
Can I move the same installation to a new host?
Use the established replacement and recovery lifecycle. Do not clone an active installation identity or copy protected state into an unrelated machine.
Continue in TERO.
Your console supplies installation material for the exact pending Sensor.