Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

EP Agent Install 11.5: Introduction

Document created by RSA Information Design and Development Employee on Sep 8, 2020Last modified by RSA Information Design and Development Employee on Jan 6, 2021
Version 5Show Document
  • View in full screen mode

Note: The information in this guide applies to Version 11.1 and later.

Hosts can be laptops, workstations, servers, physical or virtual, where a supported operating system is installed. An Endpoint Agent can be deployed on a host with either a Windows, Mac, or Linux operating system. The installation process involves:

  1. (Optional) Configuring the Relay Server

Note: You must set up the default relay server before generating the Agent packager. Whenever the Relay server configuration is modified, agent policy is updated automatically. For more information on configuring the relay server, see Endpoint Configuration Guide.

  1. Generating an agent packager
  2. Generating the agent installer

You can run the agent installer specific to your operating system to deploy agents on the hosts. The agents collect endpoint data and tracking events from these hosts. It monitors key behaviors related to process, file, registry, console, and network, and forwards them as events to the Endpoint Server over HTTPs.

Note: The Endpoint agent can operate either in Insights or Advanced mode depending on the policy configuration. For more information, see the NetWitness Endpoint Configuration Guide.

Supported Operating Systems


The agent software runs on the following Windows operating systems:

  • Windows 7 (32 and 64-bit)
  • Windows 8 (32 and 64-bit)
  • Windows 8.1 (32 and 64-bit)
  • Windows 10 (32 and 64-bit) (up to version 20H2)
  • Windows 2008 R2 (32 and 64-bit)
  • Windows 2012 Server
  • Windows 2012 Server R2
  • Windows 2016 Server
  • Windows 2019 Server


The agent software runs on either i386 or x84_64 architecture and on the following Linux operating systems:

  • CentOS 6.x, 7.x, and 8.x
  • Red Hat Enterprise Linux 6.x, 7.x, and 8.x
  • (Version 11.5.1) SUSE Linux Enterprise Server 12 SP5

  • Ubuntu 16.04 LTS, 18.04 LTS, and 20.04 LTS


The agent software runs on the following Mac operating systems:

  • macOS X 10.9 (Mavericks)

  • macOS X 10.10 (Yosemite)
  • macOS X 10.11 (El Capitan)
  • macOS X 10.12 (Sierra)
  • macOS 10.13 (High Sierra)

  • macOS 10.14 (Mojave)
  • macOS 10.15 (Catalina)

Hardware Requirements

The following are the minimum hardware requirements to deploy an agent:

  • 256 MB RAM

  • 300 MB disk space

  • Single-core CPU

Installation Flowchart

The following flowchart illustrates the Endpoint agent installation process:

Endpoint agent installation procedure

Next Topic:Prerequisites
You are here
Table of Contents > Introduction