🧹

Complete Agent Uninstall Guide

Step-by-step instructions to completely remove the Ayzal AI Agentic SOC Agent from all operating systems, including processes, services, logs, cache files, and all components.

📋 Table of Contents

🐧 Linux 🍎 macOS 🪟 Windows ✅ Verification 🔧 Troubleshooting

⚠️ Before You Begin

✅ Verify you have administrative/root access
✅ Backup any important logs if needed
✅ Stop any ongoing security monitoring
✅ Note down your API key (if you plan to reinstall later)
✅ Ensure you have SSH/RDP access to the system
✅ Review: This will remove ALL agent components - processes, services, logs, cache, and quarantine files

🐧 Linux

# ============================================================
# STEP 1: STOP ALL RUNNING PROCESSES
# ============================================================
# Stop all agent processes
sudo pkill -f "agentic-soc-agent" 2>/dev/null
sudo pkill -f "network-monitor.sh" 2>/dev/null
sudo pkill -f "device-monitor.sh" 2>/dev/null
sudo pkill -f "process-monitor.sh" 2>/dev/null
sudo pkill -f "auth-monitor.sh" 2>/dev/null
sudo pkill -f "physical-monitor.sh" 2>/dev/null
sudo pkill -f "email-monitor.sh" 2>/dev/null
sudo pkill -f "agent-core.sh" 2>/dev/null
sudo pkill -f "install-agent" 2>/dev/null

# Stop systemd services
sudo systemctl stop soc-network-monitor 2>/dev/null
sudo systemctl stop soc-device-monitor 2>/dev/null
sudo systemctl stop soc-process-monitor 2>/dev/null
sudo systemctl stop soc-auth-monitor 2>/dev/null
sudo systemctl stop soc-agent 2>/dev/null

# ============================================================
# STEP 2: REMOVE SYSTEMD SERVICES
# ============================================================
# Disable services from starting on boot
sudo systemctl disable soc-network-monitor 2>/dev/null
sudo systemctl disable soc-device-monitor 2>/dev/null
sudo systemctl disable soc-process-monitor 2>/dev/null
sudo systemctl disable soc-auth-monitor 2>/dev/null
sudo systemctl disable soc-agent 2>/dev/null

# Remove service files
sudo rm -f /etc/systemd/system/soc-network-monitor.service
sudo rm -f /etc/systemd/system/soc-device-monitor.service
sudo rm -f /etc/systemd/system/soc-process-monitor.service
sudo rm -f /etc/systemd/system/soc-auth-monitor.service
sudo rm -f /etc/systemd/system/soc-agent.service

# Reload systemd
sudo systemctl daemon-reload

# ============================================================
# STEP 3: REMOVE AGENT DIRECTORY AND FILES
# ============================================================
# Remove the main agent directory
sudo rm -rf /opt/agentic-soc-agent

# Remove any backup directories
sudo rm -rf /opt/agentic-soc-agent.bak*

# Remove stray agent files
sudo find /opt -name "*agentic*" -type d -exec rm -rf {} \; 2>/dev/null
sudo find /opt -name "*ayzal*" -type d -exec rm -rf {} \; 2>/dev/null

# Remove quarantine directory
sudo rm -rf /quarantine

# ============================================================
# STEP 4: REMOVE LOG FILES
# ============================================================
# Remove agent logs
sudo rm -f /opt/agentic-soc-agent/*.log
sudo rm -f /var/log/agentic-soc/*.log
sudo rm -f /var/log/ayzal/*.log

# Clear system journal logs (optional)
sudo journalctl --vacuum-time=1s

# ============================================================
# STEP 5: REMOVE CACHE FILES
# ============================================================
sudo rm -f /opt/agentic-soc-agent/*.cache
sudo rm -f /opt/agentic-soc-agent/*.tmp
sudo rm -f /tmp/*agentic* 2>/dev/null
sudo rm -f /tmp/*ayzal* 2>/dev/null

# ============================================================
# STEP 6: REMOVE CRON JOBS
# ============================================================
# Remove cron jobs
crontab -l 2>/dev/null | grep -v -E "agentic|ayzal|soc" | crontab - 2>/dev/null
sudo rm -f /etc/cron.d/agentic-soc 2>/dev/null

# ============================================================
# STEP 7: CLEAN IPTABLES (OPTIONAL)
# ============================================================
# Remove iptables rules added by agent
sudo iptables -L INPUT -n | grep -E "soc-agent|auto-blocked" | awk '{print $4}' | while read ip; do
    sudo iptables -D INPUT -s $ip -j DROP 2>/dev/null
done

# ============================================================
# STEP 8: REMOVE ENVIRONMENT VARIABLES
# ============================================================
# Remove from .bashrc and .profile
sed -i '/agentic/d' ~/.bashrc 2>/dev/null
sed -i '/ayzal/d' ~/.bashrc 2>/dev/null
sed -i '/SOC_/d' ~/.bashrc 2>/dev/null

# Unset current session variables
unset AGENTIC_SOC_API_KEY
unset AYZAL_API_KEY
unset SOC_PLATFORM_URL

echo "✅ Linux agent uninstalled successfully!"

🍎 macOS

# ============================================================
# STEP 1: STOP AND UNLOAD LAUNCH AGENTS
# ============================================================
# Unload launch agents
launchctl unload ~/Library/LaunchAgents/com.agentic-soc.agent.plist 2>/dev/null
launchctl unload ~/Library/LaunchAgents/com.agentic-soc.monitor.plist 2>/dev/null
launchctl unload ~/Library/LaunchAgents/com.agentic-soc.process.plist 2>/dev/null
launchctl unload ~/Library/LaunchAgents/com.agentic-soc.network.plist 2>/dev/null
launchctl unload ~/Library/LaunchAgents/com.agentic-soc.device.plist 2>/dev/null

# Remove plist files
rm -f ~/Library/LaunchAgents/com.agentic-soc.*.plist

# ============================================================
# STEP 2: REMOVE AGENT DIRECTORY
# ============================================================
sudo rm -rf /opt/agentic-soc-agent
sudo rm -rf /quarantine

# ============================================================
# STEP 3: REMOVE LOG FILES
# ============================================================
sudo rm -f /var/log/agentic-soc/*.log
sudo rm -f /opt/agentic-soc-agent/*.log

# ============================================================
# STEP 4: REMOVE CACHE FILES
# ============================================================
sudo rm -f /opt/agentic-soc-agent/*.cache
rm -f ~/Library/Caches/com.agentic-soc.* 2>/dev/null

echo "✅ macOS agent uninstalled successfully!"

🪟 Windows

# ============================================================
# STEP 1: STOP ALL RUNNING PROCESSES (Run as Administrator)
# ============================================================
# Stop all agent processes
Get-Process powershell* | Where-Object { $_.CommandLine -like "*AgenticSOC*" } | Stop-Process -Force
Get-Process powershell* | Where-Object { $_.CommandLine -like "*network-monitor*" } | Stop-Process -Force
Get-Process powershell* | Where-Object { $_.CommandLine -like "*device-monitor*" } | Stop-Process -Force
Get-Process powershell* | Where-Object { $_.CommandLine -like "*process-monitor*" } | Stop-Process -Force
Get-Process powershell* | Where-Object { $_.CommandLine -like "*auth-monitor*" } | Stop-Process -Force

# Stop Windows services
Stop-Service -Name "AgenticSOCAgent" -Force -ErrorAction SilentlyContinue
Stop-Service -Name "AgenticSOCDeviceMonitor" -Force -ErrorAction SilentlyContinue
Stop-Service -Name "AgenticSOCProcessMonitor" -Force -ErrorAction SilentlyContinue
Stop-Service -Name "AgenticSOCMetricsMonitor" -Force -ErrorAction SilentlyContinue
Stop-Service -Name "AyzalAgent" -Force -ErrorAction SilentlyContinue

# ============================================================
# STEP 2: REMOVE WINDOWS SERVICES
# ============================================================
sc.exe delete "AgenticSOCAgent" 2>$null
sc.exe delete "AgenticSOCDeviceMonitor" 2>$null
sc.exe delete "AgenticSOCProcessMonitor" 2>$null
sc.exe delete "AgenticSOCMetricsMonitor" 2>$null
sc.exe delete "AyzalAgent" 2>$null
sc.exe delete "soc-agent" 2>$null
sc.exe delete "soc-device-monitor" 2>$null

# ============================================================
# STEP 3: REMOVE SCHEDULED TASKS
# ============================================================
Unregister-ScheduledTask -TaskName "AgenticSOC-Agent" -Confirm:$false -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "AgenticSOC-Metrics" -Confirm:$false -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "AgenticSOC-Process" -Confirm:$false -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "AgenticSOC-Playbook" -Confirm:$false -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "AgenticSOC-EmailMonitor" -Confirm:$false -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "AgenticSOC-DeviceMonitor" -Confirm:$false -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "AgenticSOC-Network" -Confirm:$false -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "AgenticSOC-AuthMonitor" -Confirm:$false -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "AgenticSOC-PhysicalMonitor" -Confirm:$false -ErrorAction SilentlyContinue

# ============================================================
# STEP 4: REMOVE AGENT DIRECTORY AND FILES
# ============================================================
Remove-Item -Path "C:\ProgramData\AgenticSOC" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "C:\ProgramData\AyzalAgent" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "C:\ProgramData\AgenticSOC.bak*" -Recurse -Force -ErrorAction SilentlyContinue

# ============================================================
# STEP 5: REMOVE LOG FILES
# ============================================================
Remove-Item "C:\ProgramData\AgenticSOC\*.log" -Force -ErrorAction SilentlyContinue
Remove-Item "C:\ProgramData\AyzalAgent\*.log" -Force -ErrorAction SilentlyContinue

# ============================================================
# STEP 6: REMOVE CACHE FILES
# ============================================================
Remove-Item "C:\ProgramData\AgenticSOC\*.cache" -Force -ErrorAction SilentlyContinue
Remove-Item "C:\ProgramData\AgenticSOC\*.tmp" -Force -ErrorAction SilentlyContinue
Remove-Item "$env:TEMP\*agentic*" -Force -ErrorAction SilentlyContinue
Remove-Item "$env:TEMP\*ayzal*" -Force -ErrorAction SilentlyContinue

# ============================================================
# STEP 7: REMOVE REGISTRY ENTRIES (OPTIONAL)
# ============================================================
Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "AgenticSOC" -ErrorAction SilentlyContinue
Remove-Item -Path "HKLM:\SOFTWARE\AgenticSOC" -Recurse -ErrorAction SilentlyContinue
Remove-Item -Path "HKLM:\SOFTWARE\Ayzal" -Recurse -ErrorAction SilentlyContinue

# ============================================================
# STEP 8: REMOVE ENVIRONMENT VARIABLES
# ============================================================
[System.Environment]::SetEnvironmentVariable("AGENTIC_SOC_API_KEY", $null, "Machine")
[System.Environment]::SetEnvironmentVariable("AYZAL_API_KEY", $null, "Machine")
[System.Environment]::SetEnvironmentVariable("SOC_PLATFORM_URL", $null, "Machine")

# ============================================================
# STEP 9: CLEAR DNS CACHE
# ============================================================
ipconfig /flushdns

Write-Host "✅ Windows agent uninstalled successfully!" -ForegroundColor Green

✅ Verify Complete Removal

🐧 Linux

# Check processes
ps aux | grep -E "agentic|ayzal|soc" | grep -v grep

# Check files
sudo find / -name "*agentic*" -type f 2>/dev/null

# Check services
systemctl list-units --type=service | grep -E "agentic|ayzal|soc"

🪟 Windows

# Check processes
Get-Process | Where-Object { $_.ProcessName -like "*agentic*" }

# Check services
Get-Service | Where-Object { $_.DisplayName -like "*AgenticSOC*" }

# Check scheduled tasks
Get-ScheduledTask | Where-Object { $_.TaskName -like "*AgenticSOC*" }

🔧 Troubleshooting

❌ Agent processes won't stop

# Linux - Force kill
sudo kill -9 $(pgrep -f "agentic-soc-agent") 2>/dev/null

# Windows - Force kill
Get-Process | Where-Object { $_.Path -like "*AgenticSOC*" } | Stop-Process -Force

❌ Files won't delete

# Linux - Force remove
sudo rm -rf /opt/agentic-soc-agent 2>/dev/null

# Windows - Unlock and delete
icacls "C:\ProgramData\AgenticSOC" /grant Everyone:F /T
Remove-Item "C:\ProgramData\AgenticSOC" -Recurse -Force

❌ Services won't uninstall

# Linux - Remove service files
sudo rm -f /etc/systemd/system/soc-*.service
sudo systemctl daemon-reload

# Windows - Force remove
sc.exe delete "AgenticSOCAgent" 2>$null
sc.exe delete "AyzalAgent" 2>$null

❌ IPs still blocked after removal

# Linux - Remove iptables rules
sudo iptables -L INPUT -n | grep "auto-blocked" | awk '{print $4}' | while read ip; do
    sudo iptables -D INPUT -s $ip -j DROP
done

# Windows - Firewall rules (check manually)

🧹 Clean Up Platform Account (Optional)

After uninstalling the agent, remove the API key from the platform to stop receiving alerts:

Go to Settings → API Keys
Find the key used by this agent
Click Delete next to the key

Or ask your admin to delete the agent from Admin → Agent Management → Delete.

⚡ Quick Reference - One-Liner Removal Commands

# Linux
sudo pkill -f "agentic-soc-agent" 2>/dev/null; sudo rm -rf /opt/agentic-soc-agent; sudo systemctl stop soc-* 2>/dev/null; sudo systemctl disable soc-* 2>/dev/null; sudo rm -f /etc/systemd/system/soc-*.service; sudo systemctl daemon-reload; echo "✅ Done"

# Windows (PowerShell Admin)
Get-Process | Where-Object { $_.ProcessName -like "*agentic*" } | Stop-Process -Force 2>$null; Get-Service -Name "*AgenticSOC*" | Stop-Service -Force 2>$null; sc.exe delete "*AgenticSOC*" 2>$null; Remove-Item "C:\ProgramData\AgenticSOC" -Recurse -Force 2>$null; Write-Host "✅ Done" -ForegroundColor Green

⚠️ Important Notes

Uninstalling the agent does not delete your platform account or historical alerts
Blocked IPs in iptables/firewall remain until manually removed or server reboot
Quarantined files in /quarantine are deleted when the directory is removed
To reinstall later: Get the command from your Dashboard → Settings → API Key
After removal, restart your system for complete cleanup