Install the Arctic Wolf Agent Containment Driver on Windows using the MSI file

You can manually install the Arctic Wolf® Agent Containment Driver using the MSI file.

If you use this installation method:

• The Agent Containment Driver status does not appear in the Arctic Wolf Unified Portal.
• The Agent Containment Driver does not update automatically.

When a host is successfully contained, this notification appears: "This machine has been quarantined."

Before you begin

• For your EDR system to communicate with the Agent endpoint during containment, you might need to allowlist your EDR system. Contact your Concierge Security® Team (CST) at security@arcticwolf.com to configure Agent allowlisting.

Steps

1. Install the Arctic Wolf Agent Containment Driver.
2. (Optional) Verify that the Arctic Wolf Agent Containment service is installed.

Step 1: Install the Arctic Wolf Containment Driver using the MSI file

1. Sign in to the Arctic Wolf Unified Portal.

2. Click > Open a New Ticket, to contact your Concierge Security® Team (CST) to download the Agent Containment installation file.

3. Double-click the file to start the installation or use a Group Policy Object (GPO) to install the driver.

   See Create an Arctic Wolf Agent Group Policy Object for more information.

Step 2: Verify that the Arctic Wolf Agent Containment service is installed

This step is optional.

1. In Windows Services, verify that the Agent Containment service is installed and running.

   Note: If you installed the Agent Containment Driver using the MSI file, the Containment Driver does not show as Deployed.

2. Contact your Concierge Security® Team (CST) at security@arcticwolf.com to verify that containment is working correctly.

See also

• Arctic Wolf Agent Containment Driver