← KB

🧹 Uninstalling the Ayzal AI Agentic SOC Agent

Complete removal steps for all operating systems. This removes the agent, its services, logs, and quarantine directory.

🟢 Linux

# Stop all agent services
sudo systemctl stop soc-agent soc-metrics-monitor soc-process-monitor soc-threat-intel.timer

# Disable services
sudo systemctl disable soc-agent soc-metrics-monitor soc-process-monitor soc-threat-intel.timer

# Remove service files
sudo rm -f /etc/systemd/system/soc-agent.service
sudo rm -f /etc/systemd/system/soc-metrics-monitor.service
sudo rm -f /etc/systemd/system/soc-process-monitor.service
sudo rm -f /etc/systemd/system/soc-threat-intel.service
sudo rm -f /etc/systemd/system/soc-threat-intel.timer

# Reload systemd
sudo systemctl daemon-reload

# Remove agent directory
sudo rm -rf /opt/agentic-soc-agent

# Remove quarantine directory
sudo rm -rf /quarantine

# Clean iptables rules added by agent (optional)
sudo iptables -L INPUT -n | grep -E "soc-agent|auto-blocked" | awk '{print $4}' | while read ip; do
    sudo iptables -D INPUT -s $ip -j DROP 2>/dev/null
done

echo "✅ Agent uninstalled"

🍎 macOS

# Unload launch agents
launchctl unload ~/Library/LaunchAgents/com.agentic-soc.agent.plist 2>/dev/null
launchctl unload ~/Library/LaunchAgents/com.agentic-soc.monitor.plist 2>/dev/null
launchctl unload ~/Library/LaunchAgents/com.agentic-soc.process.plist 2>/dev/null

# Remove plist files
rm -f ~/Library/LaunchAgents/com.agentic-soc.*.plist

# Remove agent directory
sudo rm -rf /opt/agentic-soc-agent

# Remove quarantine directory
sudo rm -rf /quarantine

echo "✅ Agent uninstalled"

🪟 Windows

# Run PowerShell as Administrator

# Stop and remove scheduled tasks
Unregister-ScheduledTask -TaskName "AgenticSOC-Agent" -Confirm:$false -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "AgenticSOC-Metrics" -Confirm:$false -ErrorAction SilentlyContinue
Unregister-ScheduledTask -TaskName "AgenticSOC-Process" -Confirm:$false -ErrorAction SilentlyContinue

# Remove agent directory
Remove-Item -Path "C:\ProgramData\AgenticSOC" -Recurse -Force -ErrorAction SilentlyContinue

Write-Host "✅ Agent uninstalled"

🧹 Clean Up Platform Account (Optional)

After uninstalling the agent, remove the API key from the platform to stop receiving alerts:

  1. Go to Settings → API Keys
  2. Find the key used by this agent
  3. Click Delete next to the key

Or ask your admin to delete the agent from Admin → Agent Management → Delete.

⚠️ Important Notes