Docs Getting Started

Getting Started

This guide covers installing the PCIOasisAgent, connecting your first cardholder data environment, and running your first compliance scan. Most teams finish initial setup in 20-30 minutes.

Prerequisites

Before you begin, confirm the following:

  • You have a PCIOasis account. Sign up at pcioasishq.com/register.html if you do not have one yet.
  • You have admin or read access to the systems in your CDE (firewall configs, access control lists, patch management output).
  • The host where you plan to install the agent runs Linux (Ubuntu 20.04+, RHEL 8+, Debian 11+) or Windows Server 2019+.
  • The agent host can make outbound HTTPS connections on port 443. No inbound ports need to be opened.
Starter plan: supports up to 3 CDE environments. Professional supports up to 10. Enterprise is unlimited. See Pricing if you need to adjust your plan.

Agent Installation

PCIOasisAgent is a lightweight service that reads configuration metadata from your CDE. It needs read-only access to system configuration files and sends traffic only via outbound HTTPS to the PCIOasis platform on port 443.

Linux (Debian/Ubuntu)

bash 
# Download the installer
curl -fsSL https://packages.pcioasishq.com/install.sh -o install.sh

# Verify the checksum (recommended)
sha256sum install.sh

# Run the installer with your account token
sudo bash install.sh --token YOUR_AGENT_TOKEN

# Verify the agent is running
sudo systemctl status pcioas-agent

Linux (RHEL/CentOS)

bash 
# Download the RPM package
curl -fsSL https://packages.pcioasishq.com/pcioas-agent.rpm -o pcioas-agent.rpm

# Install the package
sudo rpm -ivh pcioas-agent.rpm

# Configure your agent token
sudo pcioas-agent configure --token YOUR_AGENT_TOKEN

# Start the agent service
sudo systemctl enable --now pcioas-agent

Windows Server

Download the MSI installer from your PCIOasis dashboard under Settings > Agent Downloads. Run the installer as Administrator and enter your agent token when prompted. The agent registers as a Windows Service named PCIOasisAgent.

Agent token: find your agent token in the PCIOasis dashboard under Settings > Agent Tokens. Each environment should use its own token. Tokens can be rotated at any time without reinstalling the agent.

Add an Environment

Once the agent runs, add your environment in the dashboard.

  1. Log in to your PCIOasis dashboard and navigate to Environments.
  2. Click Add Environment and enter a name for this CDE (for example, "Production CDE" or "Staging CDE").
  3. Select your environment type: Cloud Account, On-Premises, or Hybrid.
  4. If prompted, enter your cloud provider credentials or confirm the on-premises agent connection. The dashboard shows a green status indicator when the agent is communicating successfully.
  5. Optionally, tag the environment by business unit or compliance scope for easier filtering later.
Scope note: only add systems that are in scope for your PCI assessment. Adding out-of-scope systems inflates your findings and complicates evidence review.

Run Your First Scan

PCIOasis automatically runs continuous scans after connection. You may trigger a manual scan at any time.

Trigger a scan via the dashboard

  1. Navigate to Environments and select your environment.
  2. Click Run Scan Now. The scan typically completes in 2-10 minutes depending on environment size.
  3. When complete, the Findings tab shows results grouped by PCI DSS requirement family.

Trigger a scan via the API

bash 
curl -X POST https://api.pcioasishq.com/v1/environments/ENV_ID/scan \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

The response includes a scan_id you can use to poll for results. See the API Reference for full polling details.

Alert Routing

Send drift alerts through email, Slack, or PagerDuty. Enterprise plans support custom webhooks.

Configure email alerts

  1. Go to Settings > Alert Routing in the dashboard.
  2. Click Add Channel and choose Email.
  3. Enter one or more recipient addresses and select the severity levels and requirement families that trigger an alert.
  4. Save the channel. A test alert is sent immediately so you can confirm delivery.

Configure Slack alerts

Use the Slack integration in Settings > Integrations. You will need to authorize the PCIOasis app in your Slack workspace and choose a destination channel.

Routing by requirement family: you can send alerts for Requirement 1 (network controls) to your network team and alerts for Requirement 8 (access controls) to your identity team. Routing rules are configured per channel.

Next Steps

  • Explore the API Reference to pull scan results and evidence packages programmatically.
  • Navigate to the Evidence tab in your dashboard to preview the evidence packages PCIOasis builds automatically.
  • Check the SAQ Wizard in the dashboard to map your environment to the applicable SAQ type.
  • For questions, use the in-app chat or email [email protected].