Skip to main content

Introduction

Revision History​

DateAuthorSummary
06-NOV-2022TSgt. BernadotteInitial draft
12-DEC-2022TSgt. BernadotteUpdated references to required scripts
15-MAR-2023TSgt. BernadotteAdded arguments for sending results to Elasticsearch
13-JUN-2023TSgt. BernadotteConverted document to markdown
22-DEC-2023TSgt. BernadotteAdded common troubleshooting issues
09-JAN-2024TSgt. BernadotteEnhanced procedures to include new script options
06-FEB-2026CW2 BernadotteRemoved CVA/H version from SOP title and updated content

Purpose​

The purpose of this SOP is to provide instructions, and a reference, on using the 262COS-CVAH_Agent_Deployer-SCRIPT-001 (Deploy-Agent.psm1) script to deploy host agents to Linux and Windows endpoints.

End-State​

The purpose of this SOP is to install/uninstall host agents against both Windows and Linux hosts at mass in a multi-threaded fashion.

  1. If deploying - depending on the combination of agents chosen to be deployed, the following end-state can be achieved:
    • Sysmon (Windows only)
    • Endgame
    • Winlogbeat (Windows only)
    • Auditbeat
    • Metricbeat
    • Filebeat
  2. If uninstalling – agents deployed via TFPlenum or the Deploy-Agent.psm1 module used in this SOP will be uninstalled
  3. If updating config files or certificates – agents deployed via TFPlenum or the Deploy-Agent.psm1 module used in this SOP will be updated and restarted for changes to take affect
  4. The following output files will be produced by the Deploy-Agent.psm1 module used in this SOP:
    • Deploy-Agent-#############.log - A timestamped execution log
    • Deploy-Agent.summary-#############.csv - A per-target summary of actions taken and results
    • Deploy-Agent.artifacts-#############.csv - A per-target summary of artifacts left on the target as part of deployment

Requirements​

  1. 262COS-CVAH_Agent_Deployer-SCRIPT-001
  2. If deploying to Linix – PuTTy (plink.exe and pscp.exe) installed on the deploying system (this installed by default on the CPT Windows 10 VM)
  3. If deploying Endgame, a Sensor Profile created per 262COS-ENDGAME-SOP-001 - Endgame Sensor Deployment in order to have an installer and API key to download
  4. Authentication credentials for privileged accounts on the planned deployment targets
  5. The respective agent installer files:
    • Endgame
      • Installers/configs downloaded from the Endgame SMP
      • API key copied from the Endgame SMP
    • Sysmon
      • Installer/config downloaded from TFPlenum
    • Winlogbeat
      • Installer/config downloaded from TFPlenum
    • Filebeat/Auditbeat
    • Metricbeat

Considerations​

  1. The 262COS-CVAH_Agent_Deployer-SCRIPT-001: Deploy-Agent.psm1 script used in this SOP is not able to deploy to non-Fedora or Debian based operating systems when targeting Linux systems
  2. The 262COS-CVAH_Agent_Deployer-SCRIPT-001: Deploy-Agent.psm1 script used in this SOP is not able to account for reinstalling, updating, or uninstalling agents on endpoints where they have already been installed in a manner that did not involve using the script or TFPlenum in non-standard locations outside of:
    • Sysmon install location:
      • C:\Program Files\Sysmon
    • ****Beat install location:
      • C:\Program Files\****beat
      • /etc/****beat
      • /usr/share/****beat
  3. The 262COS-CVAH_Agent_Deployer-SCRIPT-001: Deploy-Agent.psm1 script used in this SOP deploys to 3 targets at a time in parallel and can be changed with the -BatchSize option – this can be increased but keep in mind that this will increase the processing strain on the deploying host
  4. Reinstalling Sysmon multiple times on the same system may eventually cause the service to go into a state where it will not be removed until the machine reboots, preventing reinstallation until a reboot occurs. It is highly recommended to identify if Sysmon is already present, and if it is worth the risk to update the Sysmon install and potentially break the Sysmon install until reboot
  5. The same version Sysmon binary that was used to install Sysmon is also often required to uninstall it
  6. The same Endgame binary and config used to install Endgame is also required to uninstall it
  7. Sysmon can be tuned IAW 262COS-AID-HA-001 - Sysmon Config Tuning prior to deployment
  8. Endgame should be configured IAW 262COS-AID-EG-001 - Endgame Sensor Deployment prior to deployment
  9. All beat agents should be configured with the following SOPs prior to deployment:
    • Winlogbeat - 262COS-AID-HA-002 - Winlogbeat Config Tuning
    • Filebeat - 262COS-AID-HA-003 - Filebeat Config Tuning
    • Auditbeat - 262COS-AID-HA-004 - Auditbeat Config Tuning