11.4 EP Agent Install: Introduction

Note: The information in this guide applies to Version 11.1 and later.

Hosts can be laptops, workstations, servers, physical or virtual, where a supported operating system is installed. An Endpoint Agent can be deployed on a host with either a Windows, Mac, or Linux operating system. The installation process involves:

1. (Optional) Configuring the Relay Server

Note: You must set up the default relay server before generating the Agent packager. Whenever the Relay server configuration is modified, agent policy is updated automatically. For more information on configuring the relay server, see Endpoint Configuration Guide.

1. Generating an agent packager
2. Generating the agent installer

You can run the agent installer specific to your operating system to deploy agents on the hosts. The agents collect endpoint data and tracking events from these hosts. It monitors key behaviors related to process, file, registry, console, and network, and forwards them as events to the Endpoint Server over HTTPs.

Note: The Endpoint agent can operate either in Insights or Advanced mode depending on the policy configuration. For more information, see the NetWitness Endpoint Configuration Guide.

Supported Operating Systems

Windows

The agent software runs on the following Windows operating systems:

• Windows 7 (32 and 64-bit)
• Windows 8 (32 and 64-bit)
• Windows 8.1 (32 and 64-bit)
• Windows 10 (32 and 64-bit) (up to version 2004*)
• Windows 2008 R2 (32 and 64-bit)
• Windows 2012 Server
• Windows 2012 Server R2
• Windows 2016 Server
• Windows 2019 Server

* Support for Windows 10, version 2004 (32 and 64-bit) is from 19041.329 onwards.

Linux

The agent software runs on either i386 or x84_64 architecture and on the following Linux operating systems:

• CentOS 6.x, 7.x, and 8.x
• Red Hat Enterprise Linux 6.x, 7.x, and 8.x
• Ubuntu 16.04 LTS, 18.04 LTS, and 20.04 LTS

Mac

The agent software runs on the following Mac operating systems:

• macOS X 10.9 (Mavericks)

• macOS X 10.10 (Yosemite)
• macOS X 10.11 (El Capitan)
• macOS X 10.12 (Sierra)

• macOS 10.13 (High Sierra)

• macOS 10.14 (Mojave)
• macOS 10.15 (Catalina)

Hardware Requirements

The following are the minimum hardware requirements to deploy an agent:

• 256 MB RAM

• 300 MB disk space

• Single-core CPU

Installation Flowchart

The following flowchart illustrates the Endpoint agent installation process: