Install the Arctic Wolf Agent Containment Driver on Windows using the Arctic Wolf Unified Portal

Arctic Wolf® Agent containment requires that you install the Agent Containment Driver. Arctic Wolf recommends that you use the Arctic Wolf Unified Portal to install your Agent Containment Driver.

When a host is successfully contained, this notification appears: "This machine has been quarantined."

When host containment is removed, this notification appears: “This machine’s quarantine has been lifted.”

Requirements

• Agent version 2023-01
• A supported operating system (OS):
  • Desktop:
    • Windows 10 or 11
  • Server:
    • Windows Server 2012 R2, 2016, 2019, or 2022

Before you begin

• For your EDR system to communicate with the Agent endpoint during containment, you might need to allowlist your EDR system. Contact your Concierge Security® Team (CST) at security@arcticwolf.com to configure Agent allowlisting.

Steps

1. Install the Arctic Wolf Agent Containment Driver.
2. (Optional) Verify that the Arctic Wolf Agent Containment service is installed.

Step 1: Install the Arctic Wolf Agent Containment Driver

1. Sign in to the Arctic Wolf Unified Portal.

2. Click Telemetry Management > Agents.

3. Select the checkbox beside each Arctic Wolf Agent you want to install.

4. Click Enable Containment Driver.

   A notification indicates that the driver is enabled. The Containment Driver status changes to Installation Pending.

Step 2: Verify that the Arctic Wolf Agent Containment service is installed

This step is optional.

1. In Windows Services, verify that the Agent Containment service is installed and running.
2. If you installed the Containment Driver using the Arctic Wolf Dashboard, verify that the Containment Driver status displays the driver version number. For example v1.2.5.
3. Contact your Concierge Security® Team (CST) at security@arcticwolf.com to verify that containment is working correctly.

See also

• Arctic Wolf Agent Containment Driver