---
title: Ephemeral Probes
description: Before running the platform specific commands listed below, you'll need to generate a Probe token using the Prelude CLI. (The registration and install string generated via the web UI cannot be used; i
---

[Skip to content](https://support.preludesecurity.com/docs/ephemeral-probe#main-content)

English

Show submenu for translations

[Contact support](https://support.preludesecurity.com/kb-tickets/new?hsLang=en)

![Prelude\_Wordmark\_Black\_Transparent.png\]](https://support.preludesecurity.com/hs-fs/hubfs/Prelude_Wordmark_Black_Transparent.png?height=50&name=Prelude_Wordmark_Black_Transparent.png)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- [Contact support](https://support.preludesecurity.com/kb-tickets/new)
- [Visit the website](https://www.preludesecurity.com/)

[Visit the website](https://www.preludesecurity.com/)

 Find what you're looking for

- There are no suggestions because the search field is empty.

1. [Knowledge Base](https://support.preludesecurity.com/?hsLang=en)
2. [Detect](https://support.preludesecurity.com/detect?hsLang=en)
3. [Probe deployment](https://support.preludesecurity.com/detect?hsLang=en#probe-deployment)

# Ephemeral Probes

### Generating a Token

Before running the platform specific commands listed below, you'll need to generate a Probe token using the [Prelude CLI](https://support.preludesecurity.com/docs/prelude-cli?hsLang=en). (The registration and install string generated via the web UI cannot be used; it's a reusable string and not a host-specific Probe token.)

If you created your account using the web UI, export your credentials (user menu \> My profile \> Export Credentials) and save the keychain.ini file to ~/.prelude/ so that when you run the Prelude CLI to generate the Probe token, the token will be linked to the account in use via the web UI.

Use the "prelude detect create-endpoint" command to generate a unique token for each instance of the ephemeral probe you intend to run. SERIAL\_NUM is intended to be a serial number but can be any unique string associated with the target machine.

Example

```
prelude detect create-endpoint -h %HOSTNAME% -s %SERIAL_NUM% -t "Tag1,Tag2"
```

Available parameters for the create endpoint function

```
Options:
  -h, --host TEXT        hostname of this machine  [required]
  -s, --serial_num TEXT  serial number of this machine  [required]
  -t, --tags TEXT        a comma-separated list of tags for this endpoint
  --help                 Show this message and exit.
```

### Windows

Open-source [Raindrop](https://github.com/preludeorg/libraries/blob/master/shell/probe/raindrop.ps1)

Run the following commands in Powershell as Administrator. Replace with the token value you generated via the Prelude CLI as mentioned above. These commands will: download the script, set the PRELUDE\_TOKEN environment variable, and start the script:

```
Invoke-WebRequest -UseBasicParsing -URI "https://api.preludesecurity.com/download/raindrop" -Headers @{"dos"="windows-x86_64"} -OutFile probe.ps1
SETX PRELUDE_TOKEN <TOKEN> /M
.\probe.ps1
```

### MacOS

Open-source [Nocturnal](https://github.com/preludeorg/libraries/blob/master/shell/probe/nocturnal.sh)

To download the ephemeral probe and run it (replace with the token created in "Generating a Token" section on this page:

```
curl -sL "https://api.preludesecurity.com/download/nocturnal" -H "dos:darwin-arm64" > probe
export PRELUDE_TOKEN=<TOKEN>
chmod +x probe
./probe
```

### Linux

Open-source [Nocturnal](https://github.com/preludeorg/libraries/blob/master/shell/probe/nocturnal.sh)

To download the ephemeral probe and run it (replace with the token created in "Generating a Token" section on this page:

```
curl -sL "https://api.preludesecurity.com/download/nocturnal" -H "dos:darwin-arm64" > probe
export PRELUDE_TOKEN=<TOKEN>
chmod +x probe
./probe
```

 

- [Monitor](https://support.preludesecurity.com/monitor?hsLang=en#main-content)

    - [Introduction to Control Monitor](https://support.preludesecurity.com/monitor?hsLang=en#introduction-to-control-monitor)
    - [Configuration](https://support.preludesecurity.com/monitor?hsLang=en#configuration)
    - [Client Hardware Security Integrations](https://support.preludesecurity.com/monitor?hsLang=en#client-hardware-security-integrations)
    - [Device Discovery Integrations](https://support.preludesecurity.com/monitor?hsLang=en#device-discovery-integrations)
    - [EDR Integrations](https://support.preludesecurity.com/monitor?hsLang=en#edr-integrations)
    - [Email Integrations](https://support.preludesecurity.com/monitor?hsLang=en#email-integrations)
    - [Identity Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#identity-management-integrations)
    - [Endpoint Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#endpoint-management-integrations)
    - [Vulnerability Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#vulnerability-management-integrations)
    - [Reporting](https://support.preludesecurity.com/monitor?hsLang=en#reporting)
    - [Troubleshooting](https://support.preludesecurity.com/monitor?hsLang=en#troubleshooting)
- [Detect](https://support.preludesecurity.com/detect?hsLang=en#main-content)

    - [Basics](https://support.preludesecurity.com/detect?hsLang=en#basics)
    - [Integrations](https://support.preludesecurity.com/detect?hsLang=en#integrations)
    - [Probe deployment](https://support.preludesecurity.com/detect?hsLang=en#probe-deployment)
    - [Security tests](https://support.preludesecurity.com/detect?hsLang=en#security-tests)
    - [Alert suppression](https://support.preludesecurity.com/detect?hsLang=en#alert-suppression)
    - [Assurance](https://support.preludesecurity.com/detect?hsLang=en#assurance)
- [Integrations](https://support.preludesecurity.com/integrations?hsLang=en#main-content)

    - [SASE](https://support.preludesecurity.com/integrations?hsLang=en#sase)
- [Account](https://support.preludesecurity.com/account?hsLang=en#main-content)

    - [SSO](https://support.preludesecurity.com/account?hsLang=en#sso)
- [CLI](https://support.preludesecurity.com/cli?hsLang=en)
- [Release Notes](https://support.preludesecurity.com/release-notes?hsLang=en)

[![Origin Technology Logo](https://support.preludesecurity.com/hs-fs/hubfs/origin_logo_inverse_000000.png?width=5000&height=5000&name=origin_logo_inverse_000000.png "Origin Technology Logo")](http://originhq.com)

Prelude Security Knowledge Base

Copyright © 2026, Origin Technology