Quickstart

This ends with you watching Kestrel correctly diagnose a real fault on a machine you own. That is the point of it — not feature coverage.

1. Create a tenant

Sign in at eyrie.kestrel.io. A new tenant is created in Hooded (observe only) and cannot be created any other way. Pick your region now; it is pinned at creation and does not move.

2. Connect one ticketing system

Go to Connectors. Read the pre-flight screen before you click anything — it lists the exact role and scopes you need, and gives you a message you can forward to whoever owns the instance. Then connect and run the connection test. It reports six checks independently; a failure names the cause and the fix.

Scope Kestrel to one queue. Not all of them. You can widen later.

3. Deploy Talon to one test machine

Use your own laptop for this. Take the enrollment token from the onboarding screen.

msiexec /i https://dl.kestrel.io/talon/1.8.2/talon-1.8.2-x64.msi ^
  ENROLL_TOKEN=<your-token> /qn /norestart

# verify
& "$env:ProgramFiles\Kestrel\talon.exe" status

curl -fsSLO https://dl.kestrel.io/talon/1.8.2/Talon-1.8.2.pkg
sudo installer -pkg Talon-1.8.2.pkg -target / \
  -applyChoiceChangesXML enroll.plist

# verify
/usr/local/bin/talon status

curl -fsSL https://dl.kestrel.io/apt/kestrel.gpg \
  | sudo tee /usr/share/keyrings/kestrel.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/kestrel.gpg] \
  https://dl.kestrel.io/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/kestrel.list
sudo apt update && sudo apt install talon
sudo talon enroll --token <your-token>

# verify
systemctl status talon

The device appears in Fleet within about 30 seconds. If it does not, see agent not checking in.

4. Confirm your posture

The onboarding shows you, rather than asking you: your tenant is Hooded. Kestrel will observe and suggest. It will execute nothing until you say so. Acknowledge and move on — this takes eight seconds and it is the step that converts anxiety into understanding.

5. Break something, on purpose

On your Windows test machine, jam the print spooler:

Stop-Service Spooler
New-Item -ItemType File -Force -Path 

Then file a ticket in your connected queue from the test machine’s user, with a body like “printer just spins, nothing comes out”.

6. Watch it work

Open Incidents. Within about fifteen seconds you should see the ticket, the correlated device, the telemetry Kestrel pulled, the runbook it retrieved, the model’s reasoning in violet, and one staged action with its risk tier and rollback procedure.

Read the reasoning. Then click Approve and watch the execution timeline populate step by step from the agent. When it finishes, look at your ticket: it is closed, with a resolution note.