The Cyrisma Linux Agent can be removed from a Linux system using standard package management commands or by deleting its configuration from the Cyrisma Web Platform. For fully decommissioned or repurposed systems, platform cleanup is required to keep your environment accurate and organized.

This guide explains how to:

• Uninstall the Cyrisma Agent from Debian-based Linux systems

• Remove the agent configuration from the Cyrisma platform

• Remove target configurations for decommissioned systems

• Understand scan data retention behavior

1. Important Considerations

Before removing a Linux agent:

• Uninstalling the Linux agent does not automatically remove its configuration from Cyisma.

• Deleting the agent in Cyrisma does not remove any historical scan data (data is retained).

• If the Linux system is online and checking in:

  • Deleting the agent in Cyrisma will instruct the agent to self-uninstall on its next check-in.

• If the system is offline, repurposed, or rebuilt:

  • You must clean up the agent/target configuration manually from the platform.

2. Uninstalling the Cyrisma Agent from Linux

The Linux agent is installed via a Debian-compliant package (.deb). Uninstallation uses the same package manager.

The package name is:

cybroker_1.2.4-390_amd64

If your environment uses a custom name, adjust commands accordingly.

Method: Uninstall Using apt (Recommended)

Run the following command:

sudo apt remove -y cybroker_1.2.4-390_amd64

To remove configuration files as well:

sudo apt purge -y cybroker_1.2.4-390_amd64

After uninstalling, remove any leftover directories:

sudo rm -rf /opt/cyrisma
sudo rm -rf /etc/cyrisma

Actual directory paths may vary depending on deployment version, but these are the standard installation locations.

Optional: Manual Removal (If Package Removal Fails)

For systems that were partially configured, misconfigured, or manually modified, you can manually delete agent files:

sudo systemctl stop cybroker.service
sudo systemctl disable cybroker.service
sudo rm -f /etc/systemd/system/cybroker.service
sudo rm -rf /opt/cyrisma
sudo rm -rf /etc/cyrisma
sudo systemctl daemon-reload

This method should only be used when package removal does not work.

3. Removing Agent & Target Configurations From the Cyrisma Platform

Depending on your situation, you may remove only the agent or both the target and agent configuration.

Option A: Remove Only the Agent Configuration

Use this when:

• The Linux machine still exists in your environment

• You want to reinstall or replace the agent

• You want to keep the target/profile configuration intact

Steps

1. Log in to Cyrisma.

2. Navigate to Admin > Scan Agents.

3. Under Update Existing Agent, search for the Linux agent.

4. Click Submit to open its configuration.

5. Click Delete and confirm.

If the Linux agent is still checking in, it will automatically self-uninstall on next contact.

Option B: Remove Both the Target and Agent Configuration

Use this when:

• The Linux machine has been wiped, rebuilt, re-imaged, or decommissioned

• You want to fully remove the asset from Cyrisma

Steps

1. Log in to Cyrisma.

2. Go to Admin > Targets.

3. Search for the Linux target.

4. Click Edit.

5. Click Delete and submit.

This removes both the target and its associated agent entry.

4. Cleanup for Decommissioned or Repurposed Linux Systems

If the system no longer exists or cannot check in:

• Local uninstall cannot occur.

• You must remove stale entries from Cyrisma manually.

Cleanup Steps:

1. Go to Admin > Targets.

2. Locate the old Linux target entry.

3. Delete it.

Cyrisma will remove both target and agent configuration but preserve all scan data.

5. Scan Data Retention Behavior

Deleting an agent or target does not erase scan data.

Historical scan records:

• Remain accessible for reporting

• Are tied to compliance/audit history

• Display deleted targets with the identifier:

  _d_YYYYMMDDHHMM

This ensures past scan activity remains intact even when systems are retired.

6. Summary Table

7. Conclusion

Removing the Cyrisma Linux Agent involves a combination of:

• Local removal using Debian package tools

• Platform cleanup in Cyrisma

• Optional removal of target configurations

Following the steps above ensures your Cyrisma environment stays accurate, free of stale assets, and aligned with your operational requirements.