Install Arctic Wolf Agent on a single Windows endpoint using the Agent installer

You can install Arctic Wolf® Agent on a single Windows endpoint using the Agent installer.

Note:

  • Agent is designed to maintain a minimal footprint on all systems, but Arctic Wolf recommends some OS requirements. Arctic Wolf cannot guarantee functionality on virtual machine (VM) environments if resources do not meet recommended levels.

  • Native ARM architecture is not currently supported. Support for ARM-based systems is limited to emulated mode. Agent Containment Driver is not supported on ARM architecture.

These resources are required:

  • To correctly view Agent risks in the Unified Portal, Windows Agent version 2023-02_138 or later is required

  • Administrator permissions or the ability to do administrator or root level functions

  • A supported Windows operating system. For more information, see Agent support for Windows.

  • The minimum system resources. For more information, see Agent hardware requirements.

These actions are required:

  • Confirm the installation location. Install Agent on the same drive as your ProgramFilesFolder, such as Program Files or Program Files (x86). This is usually the C:\.

  • Make sure outbound access is available for ports 443 and 1514.

Configure your environment firewall

Configure your firewall to allow traffic to Agent DNS hostnames.

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Resources > Allowlist Requirements.
  3. Configure your firewall to allow outbound traffic for all the hostnames, not IP addresses, listed in the Agent section.
    Note:

    Agent must contact Arctic Wolf servers to register. If this process fails, Agent retries every 15 seconds. This has no negative effect on the system.

Add Agent processes to the allowlist

If you install Agent and an antivirus, endpoint scanner, Endpoint Detection and Response (EDR) solution, Unified Threat Management (UTM) solution, or similar software, add Agent processes to the allowlist in those applications to maintain stable CPU and memory utilization.

  1. Configure your security systems to allow the processes listed in Arctic Wolf Agent processes.
    Tip:

    Arctic Wolf recommends that you define a security rule or policy exclusion for the parent folder. Then, if new processes are added during a future Agent software update, the new rule or policy exclusion applies to it. For example, for a Windows endpoint, define a rule that applies to this file path: C:\Program Files (x86)\Arctic Wolf Networks\

  2. Add the files listed in Arctic Wolf Agent hash values to all allowlists.
  3. If you use an EDR solution, verify that your EDR configuration changes are applied to all endpoints.
    For more information, see the technical documentation for the security systems that you are configuring.

Trust Agent scanner signed files

You must trust Agent scanner signed files to ensure Agent vulnerability and benchmark scanning is not impacted by other endpoint security tools installed on the endpoint.

If you partnered with Arctic Wolf as an Aurora Vulnerability Management (Aurora VM) customer before December 11, 2025, your vulnerability and benchmark scanning uses the PowerShell console by default. Scans fail if the console usage is blocked by endpoint security tools.

As of December 11, 2025, Arctic Wolf uses signed PowerShell scripts by default. Do one of these actions to ensure successful scans:

Enable VBScript

VBScript must be enabled to install Arctic Wolf Agent.

If you have disabled VBScript, you must re-enable this Windows feature.
  1. Go to Start > Settings > System > Optional features.
  2. Select View features.
  3. In the search dialog, enter VBSCRIPT, and then select the check box for the VBScript search result.
  4. To enable the VBScript feature, click Next.

Install Arctic Wolf Agent on Windows using the Agent installer

  1. Download the Agent installer:
    1. Sign in to the Arctic Wolf Unified Portal.
    2. In the navigation menu, click Resources > Downloads.
    3. In the Arctic Wolf Agent section, in the Operating System list, select the required operating system.
    4. Click Download Agent.
    5. Extract the Agent zip contents.
      The Agent install file and customer.json file are extracted.
  2. Right-click the MSI file.
  3. Click Open to run the installation.
  4. Follow the prompts to proceed with the installation.
  5. Contact your Arctic Wolf Customer Success Manager or your Concierge Security® Team (CST) at security@arcticwolf.com to confirm that Agent data is reaching Arctic Wolf.