.Endpoint Agent deployment vv7.6.0

Supported endpoints 

Devo Endpoint Agent supports different kinds of endpoints. This section depicts the operating systems where the client can be deployed. 

Windows endpoints

• Windows x64: Osquery and the Devo Endpoint Agent Client are fully supported in Windows 64-bit architecture.
• Windows x86: Devo Endpoint Agent and Osquery are not supported in Windows 32-bit architectures.

Linux endpoints

Most Linux x86_64 distributions are supported, and installers are provided for both Debian (Ubuntu) and RedHat (CentOS) based systems.

macOS endpoints

macOS is supported from 10.14 onward. Continuous integration currently tests stable release versions of osquery against macOS 10.14. There are no reported issues that block expected core functionality on 10.11 and greater, however, 10.9 and previous macOS versions are not supported.

• Apple Silicon M1 chip support: Osquery is compiled as Universal Binary using Apple rosetta so it should work in M1 ARM-based devices. Native M1 build support is currently in development.

Access Endpoint Agent repository

1. Open the agents' repository URL in the EA Manager installation for your environment (https://<DEAM_IP>:8081). Access credentials were defined during the EA Manager installation process.

2. A warning message is displayed (no certificates available). Click on the advanced configuration button and then click on Proceed to [...]

3. Use the configured credentials to access the agent's repository website.

EAM’s agents' repository is displayed with all available versions of the Universal Agent listed per targeted platform:

Deploying Windows Endpoint Agent

Click on win-dea-Osquery-xxxxx.zip to download the Endpoint Agent package and unzip it in the local filesystem of the endpoint to monitor (e.g., in C:\user\Downloads\DEA).

The unzipped folder contents should look like this:

1. Follow the instructions in the README.txt file. A common issue is the permissions level required to execute the installation script. Should that be the case, make sure you temporarily disable all restrictions using the commands listed in the same file. Remember to also restore the restrictions as they were configured before.

2. Once the installation script is finished, check that the agent is up and running by opening Windows’ task manager and finding the Osquery daemon listed as an active process:

   
   

3. Log in to the Endpoint Agent Manager (see above for instructions). The endpoint should be automatically detected and listed as an active host.

4. Log in to the destination domain in Devo (US > demo for the demo platform). Open one of the box.devo_ea.xxx.xxx tables in it. Data corresponding to the endpoint should start appearing in the data structure, identified by the hostname.

Deploying the Linux Endpoint Agent

Click on deb-dea-osquery-X.X.X-devo-ea-manager.tgz to download the Endpoint Agent package and untar (tar -xzf deb-dea-osquery-X.X.X-devo-ea-manager.tgz) it in the local filesystem of the endpoint to monitor (e.g., in /var/tmp/devo-ea-manager). The untar folder contents should look like this:

1. Follow the instructions in the README.txt file.

2. Once the installation script is finished, you can check that the agent is up and running by executing ps -ef | grep osquery . You should see several osquery processes running:

   

3. Log in to the EAM (see previous paragraphs for instructions). The endpoint should be automatically detected and listed as an active host.

   

4. Log in to the destination domain in Devo (US > demo for the demo platform). Open one of the box.devo_ea.xxx.xxx tables in it. Data corresponding to the endpoint should start appearing in the data structure, identified by the hostname. In the next screenshots you can see some examples:

• • To check the operations system connected with Endpoint Agent:

     

    
    

                 

• • To check the network connected with Endpoint Agent:

    

        

.                             

Deploying the macOS Endpoint Agent

Click on darwin-dea-Osquery-xxxxx.zip to download the Endpoint Agent package and unzip it in the local filesystem of the endpoint to monitor (e.g., in C:\user\Downloads\DEA).

The unzipped folder contents should look like this:

1. Follow the instructions in the README.txt file.

2. Once the installation script is finished, you can check that the agent is up and running by executing ps -ef | grep osquery . You should see several osquery processes running.

3. Log in to the EAM (see previous paragraphs for instructions). The endpoint should be automatically detected and listed as an active host.

4. Log in to the destination domain in Devo. Open one of the box.devo_ea.xxx.xxx tables in it. Data corresponding to the endpoint should start appearing in the data structure, identified by the hostname.