PREP-STEP 1: Retrieve Installers

---

info

Execute the following procedures to retrieve the necessary host agent installers, config files, and keys necessary for whatever you are trying to deploy.

---

Retrieve the Endgame Sensor API Key

note

These procedures assume that a Sensor Profile has been created per 262COS-EG-SOP-001 - Endgame Sensor Setup.

Procedures

1. Login with an admin account to https://endgame
2. Navigate to Administration -> SENSOR
3. Copy the API KEY – this value will later be stored in the $EndgameAPIKey PowerShell variable for Endgame deployment
4. Continue to OPTION B if you wish to deploy the outdated agent's provided by the PMO
   OTHERWISE - Click Download Profile to download the Endgame agent bundle and continue to OPTION A to retrieve the updated agents

---

OPTION A: Retrieve Updated Agents (RECOMMENDED)

info

On CVA/H DIPs configured IAW 262COS-DIP-SOP-001 - CVAH DIP Setup with the Fleet_Server package installed, and the included Elastic-artifact-server Helm chart installed from the TFPlenum Catalog - the following up-to-date host agent installers can be retireved directly from the Controller (http://controller/agent_pkgs/)

The following agents are made available for download on the Controller (http://controller/agent_pkgs/):

Installers	EXE	MSI	ELF	RPM	DEB	Deploy-Agent.psm1 compatible
Auditbeat	✅	❌	✅	✅	✅	✅ Can Install
Filebeat	✅	❌	✅	✅	✅	✅ Can Install
Winlogbeat	✅	❌	❌	❌	❌	✅ Can Install
Metricbeat	✅	❌	✅	✅	✅	❌ Manual install
OSQuerybeat	✅	❌	✅	❌	❌	❌ Manual install
Packetbeat	✅	❌	✅	✅	✅	❌ Manual install
Elastic Agent	✅	✅	✅	✅	✅	❌ Manual install
Sysmon	✅	❌	❌	❌	❌	✅ Can Install

Procedures

1. Navigate to the HTTP page hosted on the controller Controller (http://controller/agent_pkgs/)
2. Download each agent installer and config template that you need for your deployment
3. Copy the installers to the Fileserver's SMB Share under /MISSION/03_EXECUTION/07_STAGING/HOST_AGENTS/

---

OPTION B: Retrieve PMO Provided Agents

Retrieve Windows Installers (Endgame, Sysmon, Winlogbeat)

info

On "vanilla" CVA/H DIPs the following OUTDATED *Beats agents (v7.16.3 as of CVA/H 3.8.3) are made available for between the PMO AppStore and TFPlenum agent deployer:

Installers	EXE	MSI	ELF	RPM	DEB	Deploy-Agent.psm1 compatible
Auditbeat	✅	❌	✅	✅	❌	✅ Can Install
Filebeat	✅	❌	✅	✅	❌	✅ Can Install
Winlogbeat	✅	❌	❌	❌	❌	✅ Can Install
Metricbeat	✅	❌	✅	✅	❌	❌ Manual install
Packetbeat	✅	❌	✅	✅	❌	❌ Manual install
Sysmon	✅	❌	❌	❌	❌	✅ Can Install

note

If needed, another installer package can be created for Filebeat and Auditbeat - but these specific agents need to have their configurations tuned

Procedures

1. Login to TFPlenum at https://controller.<KIT_DOMAIN>
2. Navigate to Remote Agents
3. Click Add Installer Config and fill the following:

   Setting	Value
   Configuration Name	Endgame+Sysmon+Winlogbeat
   Applications	🗹 Install Endgame Agent 🗹 Install Sysmon 🗹 Install Winlogbeat
   Connect to Endgame Server:	Endgame Server IP: 10.<X>.<Y+2>.200 Endgame Server Username: admin Endgame Server Password: <ENDGAME_PASSWORD> Endgame Server Port: 443
   Select Endgame Agent:	Sensor Profile: PERSISTENT (Select DISSOLVABLE if directed by MEL/MP)
   Options for Winlogbeat:	Traffic Destination: <DIP_EXTERNAL_IP> Traffic Destination Port: 5045

4. Select the radio button for the Endgame+Sysmon+Winlogbeat package and click Download Installer
5. Copy the installer package to the Fileserver's SMB Share under /MISSION/03_EXECUTION/07_STAGING/HOST_AGENTS/

Retrieve Linux Installers (Filebeat, Auditbeat, Metricbeat)

info

Some Linux installers (non-DEB) can be found on the PMO provided CVA/H external drive's Appstore (or the Fileserver's SMB AppStore share under /Elastic Stack/Elastic Beats Products/) – or they can all be directly downloaded from https://www.elastic.co/downloads/beats/

Copy the installers to the Fileserver's SMB Share under /MISSION/03_EXECUTION/07_STAGING/HOST_AGENTS/

---