Infocyte: ARR Agent Install Instructions

Description

Here you will find the installation instructions for the EDR Agent

 

Required Parameters

  • Your ARR Instance name - Provided during your onboarding
  • Please be certain to replace the *********** in the commands with the Instance name.
  • Your ARR Agent Registration Key (Regkey) Obtained in the portal 
  • Please be certain to replace the %%%%%%%%% in the commands with the Regkey.

Installation for Windows OS

Method 1 - Powershell command (RECOMMENDED)

  •  Ensure to run PSConsole as Administrator if doing a manual install
  • Make sure your current AntiVirus policy does not block PSConsole usage or have Memory protection enabled without the proper Infocyte exclusions placed
  • Copy script into PowerShell Console  
    [System.Net.ServicePointManager]::SecurityProtocol = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072); (new-object Net.WebClient).DownloadString("https://raw.githubusercontent.com/Infocyte/PowershellTools/master/AgentDeployment/install_huntagent.ps1") | iex; installagent *********** %%%%%%%%%

Method 2 - Installer

64 Bit Installer

32 Bit Installer

Method 3 - Group Policy

Prerequisites:

  • Windows Server 2012 R2 or greater
  • Domain Administrator account
  • Microsoft Windows endpoints
  • File to convert into a Batch file "install_agent.txt"
  • Instancename (provided by SonicWall Managed Services
  • Regkey (provided by SonicWall Managed Services)

Getting Ready:

  • Copy the following code into a text editor: 
    @echo off
:: Install Hunt Agent
:: For use in a GPO Startup Script (Note: Logon script will not work as it operates with the user's non-admin permissions)
:: Best Reference for steps: https://www.petri.com/run-startup-script-batch-file-with-administrative-privileges
:: Set "instancename" to the instance name provided by SonicSentry
:: Set "regkey" to your registration key provided by SonicSentry
set instancename=myinstancename123
set regkey=myregkey123
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nologo -win 1 -executionpolicy bypass -nop -command "[System.Net.ServicePointManager]::SecurityProtocol = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072); (new-object Net.WebClient).DownloadString('https://raw.githubusercontent.com/Infocyte/PowershellTools/master/AgentDeployment/install_huntagent.ps1') | iex; installagent %instancename% %regkey%"
  • Change the myinstancename123 to the the instancename provided by SonicWall Managed Services.
  • Change the myregkey123 to the regkey provided obtained from the instance.
  • Save the file as “install_agent.bat” 

Create the GPO:

  • Open Server Manager and go to Tools > Group Policy Management
  • In Group Policy Management Console select domain and click Group Policy Objects
  • Right-click Group Policy Objects and select New
  • For Name type "Install HUNT Agent" and click OK
  • Right-click the new GPO in the right pane and click Edit
  • In the Group Policy Management Editor window, click Computer Configuration, then Policies, then Scripts. Double-click Startup
  • On the Scripts tab of the Startup Properties box, click Show Files. Copy the "install_agent.bat" file created in the previous Getting Ready section of this article
  • Click Add
  • Click Browse and select the file "install_agent.bat"
  • Click OK
  • Find the Domain or OU that you wish to link to the newly created GPO
  • Right-click it and click Link an Existing GPO
  • Click OK

Your script should now run and install the ARR agent on all machines in the selected group.

Validating Install

  • You can validate a successful install if you see the service ‘Infocyte HUNT Agent’ running on the machine

Image

 

 

Uninstall 

  • In order to uninstall an agent on Windows, users can uninstall via Add/Remove Programs or via command line as an Administrator using the following command: 
    "C:\Program Files\Infocyte\Agent\agent.exe" --uninstall
  • If needed, the /quiet Windows command switch can be added to run the uninstall silently.

 

Installation for Linux

Linux Support for Agent Installation:

  • To install the Linux Agent, systemd is required as the default init for the system. This is the default with most modern Linux OSes.
  • The check if you are using systemd, type this command: 
    file /sbin/init
  • The output should be something similar to: 
    sbin/init: symbolic link to /lib/systemd/systemd

 

Installing Agent

64-Bit

  • Download the 64-bit installer from: https://s3.us-east-2.amazonaws.com/infocyte-support/executables/agent.linux64.exe
  • After downloading the agent, navigate to the download folder (or location of downloaded file) and run the following command to prep the agent for execution: 
    chmod +x linux64.exe
  • After downloading the agent, navigate to the download folder (or location of downloaded file) and run the following command to prep the agent for execution:
  • Now you can run the installer with the following command:  
    sudo ./linux64.exe --key %%%%%%%%% --url https://***********.infocyte.com

32-Bit

  • Download the 32-bit installer from: https://s3.us-east-2.amazonaws.com/infocyte-support/executables/agent.linux32.exe
  • After downloading the agent, navigate to the download folder (or location of downloaded file) and run the following command to prep the agent for execution:  
    chmod +x linux32.exe
  • Now you can run the installer with the following command:  
    sudo ./linux32.exe --key %%%%%%%%% --url https://***********.infocyte.com

 

Validating Install

  • Run the following command in Terminal:  
    systemctl status huntagent

 

Uninstall (Linux)

  • Run the following command:  
    sudo /usr/local/infocyte/agent/agent.exe --uninstall

 

Manual Uninstall

  • Run the following commands in a terminal: 
    systemctl stop HUNTAgent
systemctl disable HUNTAgent
rm /etc/systemd/system/HUNTAgent.service
systemctl daemon-reload
systemctl reset-failed
rm -rf "opt/ infocyte

 

MacOS - El Capitan -> Mojave

Installing Agent

 

Validating Install (All macOS)

  • Run the following command from a macOS terminal.  
    ps -u root | grep agent
  • You should see something similar to the following screenshot.

Image

 

Uninstall

  • Run Command  
    sudo /usr/local/infocyte/agent/agent.exe --uninstall

 

Manual Uninstall

  • Run the following commands in a terminal:  
    systemctl stop HUNTAgent
systemctl disable HUNTAgent
rm /etc/systemd/system/HUNTAgent.service
systemctl daemon-reload
systemctl reset-failed
rm -rf "opt/ infocyte

 

MacOS - Catalina –> Monterey

Installing Agent

  • Run command:  
    sudo ./rts.macos-catalina.exe --url https://***********.infocyte.com  --key %%%%%%%%%

 

Validating Install (All macOS)

  • Run the following command from a macOS terminal.  
    ps -u root | grep agent
  • You should see something similar to the following screenshot.

Image

 

Uninstall

  • Run Command:  
    sudo /usr/local/infocyte/agent/agent.exe --uninstall

 

Manual Uninstall

  • Run the following commands in a terminal:  
    systemctl stop HUNTAgent
systemctl disable HUNTAgent
rm /etc/systemd/system/HUNTAgent.service
systemctl daemon-reload
systemctl reset-failed
rm -rf "opt/ infocyte

 

MacOS - Ventura –> Sonoma

Installing Agent

  • Open the Terminal.
  • Run the following command:  
    sudo spctl --master-disable
  • Enter Admin Password when prompted.
  • Rename the file to: rts.macos.exe
  • Move the renamed file to the documents folder.
  • Open Terminal.
  • Navigate in Terminal to the documents folder:  
    cd documents
  • Run the following command:  
    cat rts.macos.exe > rts.macos-catalina.exe
  • When the following window pops up, select OK

Image

  • Run the following command:  
    chmod +x rts.macos-catalina.exe
sudo ./rts.macos-catalina.exe --url https://***********.infocyte.com  --key %%%%%%%%%
  • Enter Admin Password when prompted.
  • Enter the final command:  
    sudo spctl --master-enable

CAUTION: BE CERTAIN TO RUN THE LAST COMMAND TO RE-ENABLE SYSTEM SECURITY

 

Validating Install

  • You can use EITHER of the following methods to validate agent is installed and running on the device.
  • Look for agent.exe process in the Activity Monitor.

Image

OR

  • Run the following command from a macOS terminal.  
    ps -u root | grep agent

Image

Uninstall

  • Navigate to and open /Library/LaunchDaemons/com.infocyte.HUNTAgent.plist.
  • Delete ONLY the FIRST empty line in the file.
  • Save the changes to the file.
  • Run the following uninstall command:  
    sudo /usr/local/infocyte/agent/agent.exe --uninstall

 

Manual Uninstall

  • Navigate to and open /Library/LaunchDaemons/com.infocyte.HUNTAgent.plist.
  • Delete ONLY the FIRST empty line in the file.
  • Save the changes to the file.
  • Run the following commands in a terminal:  
    systemctl stop HUNTAgent
systemctl disable HUNTAgent
rm /etc/systemd/system/HUNTAgent.service
systemctl daemon-reload
systemctl reset-failed
rm -rf "opt/ infocyte

 

RMM Install

 !!Deploying the agent via RMM may limit our ability to assist with troubleshooting stability issues!!

Installation Using Atera PowerShell Script

Disclaimer :  Deploying the agent via RMM may limit our ability to assist with troubleshooting stability issues.

  • We do not use this RMM tool directly and all instructions were created from feedback provided by existing partners.
  • As RMM GUI’s update, some of the information might vary in this document
  • We are open and request feedback from partners to help us keep this document updated

Creating the Script

  • Navigate to the Admin area.
  • Select Scripts under Monitoring.

Image

  • On the next screen, select Create Script.

Image

  • Enter a Description and Filename.
  • Confirm that .ps1 is selected as the script type.

Image

  • In the script editor section, copy the PowerShell install script contents provided by the SonicWall Managed Security Services engineer.
  • Select Create Script button

 Deployment

  • Navigate to the devices list within Atera
  • Select a device(s) and deploy the script create above

Installation Using SyncroRMM PowerShell Script

Disclaimer: Deploying the agent via RMM may limit our ability to assist with troubleshooting stability issues.

  • We do not use this RMM tool directly and all instructions were created from feedback provided by existing partners.
  • As RMM GUI’s update, some of the information might vary in this document.
  • We provide these instructions as best effort and are open and request feedback from partners to help us keep this document updated.

Prerequisites 

  • PowerShell 4.0 is required for this method to work.

Creating the Script

  • In Syncro:
  • Log into your SyncroMSP Account
  • Select Scripts from the Top Menu
  • Select the New Script Button

Image

  • Enter a Name for the Script (E.g. ARR Infocyte Install)

Optional

  • Mark the Script as a Favorite
  • Check "Available on Every Customer Portal"
  • Copy and Paste the contents of the PowerShell script into the Script box. 
  • Select Create Script button

Using Variables

  • If using Target Groups inside the Infocyte portal, a variable for can be used for the Regkey parameter.

Create a new 'Customer Field'

  • In SyncroRMM
  • Navigate to the Admin Tab - Customer Custom Field
  • Click New Field
  • Name:
  • Field Type: Text Field

Add the Customer Field variable to each Customer

  • Navigate to the Customers Tab
  • Click Edit in the Customer Fields section

  • Add the RegKey for the Target Group of this Customer

Image

  • Edit the installation script
  • Navigate to your previously created script
  • Click the Add Script Variable button
  • Choose Platform under variable type
  • Use the dropdown to find your customer custom field
  • Input a name into the Variable Name field
  • Update your PS script to match the variable name

Image

Deployment

  • Select the Assets and RMM menu item.
  • Select the Computer you want to install the ARR agent on or alternatively, select the top checkbox to install ARR on all computers.

Image

  • At the top select Manage > Run Script

Image

Image

 

Related Articles

  • SonicWall Endpoint Security (SES) MDR : Frequently Asked Questions (FAQs)
    Read More
  • Sophos MDR: Frequently Asked Questions (FAQs)
    Read More
  • SES MDR POC : Frequently Asked Questions (FAQs)
    Read More

Categories

Managed Security Services
Infocyte
not finding your answers?
Ask the Community
Chat