Install Arctic Wolf Agent on multiple Linux endpoints

You can install Arctic Wolf® Agent on multiple endpoints in your organization using a package manager.

Requirements

• Administrator permissions or the ability to do administrator or root level functions

• One of these operating systems:

  • Amazon Linux 2
  • CentOS 7 or 8
  • CentOS Stream 9
  • Debian 11.2 (Stable)
  • Linux Mint 20.3
  • Oracle Linux 8.5
  • Red Hat 7, 8, or 9
  • Ubuntu 16.04, 18.04, 20.04, or 22.04

  Note: Vulnerability scanning is not supported on CentOS.

• These system resources:

  • A x64 or x86 processor
  • At a minimum:
    • A dual-core CPU
    • 2 GB of memory
    • 50 MB of disk space

  Notes:

  • Agent is designed to maintain a minimal footprint on all systems, but Arctic Wolf recommends some OS requirements. Arctic Wolf cannot guarantee Agent functionality on virtual machine (VM) environments if resources do not meet recommended levels.
  • Agent does not support ARM architecture.

Before you begin

• If the Linux distribution is Debian, make sure that sudo is installed on the root account.

• Make sure outbound access is available for ports 443 and 1514.

• Configure your firewall to allow traffic to Agent DNS hostnames:

  1. Sign in to the Arctic Wolf Unified Portal.
  2. Click > Allowlist Requirements.
  3. Configure your firewall to allow outbound traffic for all the hostnames, not IP addresses, listed in the Agent section.

  Note: Agent must contact Arctic Wolf servers to register. If this process fails, Agent retries every 15 seconds. This has no negative effect on the system.

• If you install Agent and an antivirus, endpoint scanner, Endpoint Detection and Response (EDR) solution, Unified Threat Management (UTM) solution, or similar software, add Agent processes to the allowlist in those applications to maintain stable CPU and memory utilization:

  1. Configure your security systems to allow the processes listed in Arctic Wolf Agent Processes.

     Tip: Arctic Wolf recommends that you define a security rule or policy exclusion for the parent folder. Then, if new processes are added during a future Agent software update, the new rule or policy exclusion applies to it. For example, for a Windows endpoint, define a rule that applies to this file path: C:\Program Files\Arctic Wolf Networks\Agent\.

  2. Add the files listed in Arctic Wolf Agent SHA-256 Hash Values to all allowlists.

  3. If you use an EDR solution, verify that your EDR configuration changes are applied to all endpoints.

  See the technical documentation for the security systems that you are configuring for more information.

Steps

1. Download the Agent installer:

   1. Sign in to the Arctic Wolf Unified Portal.
   2. Click > Downloads.
   3. In the Arctic Wolf Agent section, in the Operating System list, select the required operating system.
   4. Click Download Agent.

2. Make sure that the Agent zip file is extracted into the arcticwolfagent_<version>.<deb|rpm> package file and the customer.json file.

   Caution:

   • Do not edit the customer.json file. Editing this file causes installation errors.
   • Do not save the Agent installer or customer.json to a location with public access. Keep the customer.json file confidential.

3. Based on your OS and preferred package manager, run one of these commands:

   • Ubuntu using APT:

     sudo DEBIAN_FRONTEND=noninteractive AWN_CUSTOMER_JSON=/tmp/customer.json apt install /tmp/arcticwolfagent_<version>.deb

   • CentOS, Red Hat, or Amazon Linux:
     • YUM (preferred):

       sudo AWN_CUSTOMER_JSON=/tmp/customer.json yum install arcticwolfagent_<version>.rpm

     • Zypper:

       sudo AWN_CUSTOMER_JSON=/tmp/customer.json zypper install --allow-unsigned-rpm arcticwolfagent_<version>.rpm

     • DNF:

       sudo AWN_CUSTOMER_JSON=/tmp/customer.json dnf install arcticwolfagent_<version>.rpm

   Notes:

   • You must save customer.json in the /tmp folder.
   • Use an absolute path to customer.json and verify that it is correct. If any errors occur pertaining to the customer.json file, see Arctic Wolf Agent Troubleshooting.
   • You can install Agent with any package manager on CentOS, Red Hat, or Amazon Linux, but only YUM has been tested.
   • Agent only performs automated tests with YUM, DNF, and Zypper.

4. When the command line prompts you, install the Linux utilities that are required for your operating system if they are not installed:

   Operating systems	Required Linux utilities
   Debian Linux Mint Ubuntu	adduser bsdutils coreutils debconf debianutils dnsutils hostname iproute2 iptables libc6 (>= 2.7) lsb-release lshw net-tools network-manager procps systemd usbutils
   Amazon Linux 2 CentOS Oracle Linux Red Hat	chkconfig coreutils hostname iptables lshw net-tools systemd which Note: Red Hat, CentOS, and other RPM-based Linux distributions do not require the net-tools utility.

5. Contact your Arctic Wolf Customer Success Manager or your Concierge Security® Team (CST) at security@arcticwolf.com to confirm that Agent data is reaching Arctic Wolf.

See also

• Arctic Wolf Agent
• Uninstall Arctic Wolf Agent