Install AgentX Client on Windows (individual)

Prerequisites

• Windows Server 2016/2019/2022 or Windows 10/11/11 Pro (64-bit)

• Local administrative permissions

• AgentX Client installer downloaded from Release Notes

• IP address of Logpoint where AgentX Server and AgentX Manager are installed

• Network access to Logpoint on ports 1514 and 1515

Procedure (command line)

1. Open Command Prompt as administrator.

2. Run the following command:

msiexec /i AgentX_Client_windows_version.msi MANAGER_ADDRESS=XX.XX.XX.XX ADDLOCAL=OsqueryFeature /qn

Replace XX.XX.XX.XX with your Logpoint IP address.

This installs AgentX Client in the default path (C:\Program Files (x86)\ossec-agent).

Install to custom path

To install to a custom path:

msiexec /i AgentX_Client_windows_version.msi MANAGER_ADDRESS=XX.XX.XX.XX INSTALLATION_TYPE=custom INSTALL_DIR="C:\YourPath" ADDLOCAL=OsqueryFeature /qn

If the specified path does not exist, the installation fails.

Use custom osquery configuration

To use a custom osquery configuration file:

msiexec /i AgentX_Client_windows_version.msi MANAGER_ADDRESS=XX.XX.XX.XX INSTALLATION_TYPE=custom INSTALL_DIR="C:\YourPath" ADDLOCAL=OsqueryFeature CUSTOM_OSQUERY_CONF="C:\Config\osquery.conf" /qn

Use custom SSL certificates

To use custom SSL certificates:

msiexec /i AgentX_Client_windows_version.msi MANAGER_ADDRESS=XX.XX.XX.XX INSTALLATION_TYPE=custom INSTALL_DIR="C:\YourPath" ADDLOCAL=OsqueryFeature SSL_CERT="D:\Certs\agent.cert" SSL_KEY="D:\Certs\agent.key" /qn

Procedure (user interface)

1. Right-click the AgentX Client installer and select Install.

2. Select Next.

3. Select the terms and conditions checkbox and select Next.

4. To disable osquery: Double-click AgentX, select the dropdown, and select Entire feature will be unavailable. Otherwise, select Next.

5. Select an installation path:

   • Default - Installs OSSEC in C:\Program Files (x86)\ossec-agent and osquery in C:\Program Files\osquery

   • Custom - Enter a custom path. If you enter C:\Program Files or its subdirectories, OSSEC installs in C:\Program Files (x86)\ossec-agent and osquery installs in the specified path

6. Select Next.

7. Enter the Logpoint IP address where AgentX Server and AgentX Manager are installed.

8. Select Next.

9. Select Install.

10. Select Finish.

Expected outcome

• OSSEC installs in the specified path

• osquery installs in the specified path (if enabled)

• AgentX Client service starts automatically

• The agent connects to Logpoint and appears in Settings > Configuration > AgentX > Agents

Verification

1. Go to Settings > Configuration and select AgentX.

2. Select Agents.

3. Verify that your endpoint appears in the agents list.

If the endpoint does not appear, verify:

• Network connectivity to Logpoint on ports 1514 and 1515

• AgentX Client service is running on the endpoint

• The correct Logpoint IP address was entered during installation

Change Logpoint IP address after installation

If you need to change the Logpoint IP address after installation:

1. Go to the AgentX Client installation path.

2. Run win32ui.exe.

3. Enter the new Logpoint IP address in Manager IP.

4. Select Save.

5. Select Manage > Restart.

6. Select OK and Save.

Next steps

• Configure AgentX in device

• Install AgentX Client on Windows (mass installation) via:

  • Microsoft Intune

  • GPO

  • SCCM

• Access Windows logs