Installing ThreatLockDown agents on HP-UX endpoints

The installed agent runs on the endpoint you want to monitor and communicates with the ThreatLockDown server, sending data in near real-time through an encrypted and authenticated channel.

Note

You need root user privileges to run all the commands described below.

  1. To start the installation process, download the HP-UX installer.

  2. Create the wazuh user and group.

    # groupadd wazuh
# useradd -G wazuh wazuh

  3. Uncompress the package in /.

    # tar -xvf wazuh-agent-4.9.0-1-hpux-11v3-ia64.tar

The installation process is now complete, and the ThreatLockDown agent is successfully installed on your HP-UX endpoint. The next step is to register and configure the agent to communicate with the ThreatLockDown server. To perform this action, see the Linux/Unix agent enrollment via agent configuration section. To learn more about agent enrollment, visit ThreatLockDown agent enrollment.

Uninstall a ThreatLockDown agent

To uninstall the agent, follow these steps:

  1. Stop the ThreatLockDown agent service.

    # /var/ossec/bin/wazuh-control stop

  2. Delete wazuh user and group:

    # groupdel wazuh
# userdel wazuh

  3. Remove ThreatLockDown files.

    # rm -rf /var/ossec

The ThreatLockDown agent is now completely removed from your HP-UX endpoint.