Deploying ThreatLockDown agents on Linux endpoints

The agent runs on the host you want to monitor and communicates with the ThreatLockDown server, sending data in near real-time through an encrypted and authenticated channel.

The deployment of a ThreatLockDown agent on a Linux system uses deployment variables that facilitate the task of installing, registering, and configuring the agent. Alternatively, if you want to download the ThreatLockDown agent package directly, see the packages list section.

Note

You need root user privileges to run all the commands described below.

Add the ThreatLockDown repository

Add the ThreatLockDown repository to download the official packages.

  1. Import the GPG key:

    # rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH

  2. Add the repository:

    # cat > /etc/yum.repos.d/wazuh.repo << EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-\$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF

Deploy a ThreatLockDown agent

  1. To deploy the ThreatLockDown agent on your endpoint, select your package manager and edit the WAZUH_MANAGER variable to contain your ThreatLockDown manager IP address or hostname.

    # WAZUH_MANAGER="10.0.0.2" yum install wazuh-agent

    For additional deployment options such as agent name, agent group, and registration password, see the Deployment variables for Linux section.

    Note

    Alternatively, if you want to install an agent without registering it, omit the deployment variables. To learn more about the different registration methods, see the ThreatLockDown agent enrollment section.

  2. Enable and start the ThreatLockDown agent service.

    # systemctl daemon-reload
# systemctl enable wazuh-agent
# systemctl start wazuh-agent

The deployment process is now complete, and the ThreatLockDown agent is successfully running on your Linux system.

  • Recommended action - Disable ThreatLockDown updates

    Compatibility between the ThreatLockDown agent and the ThreatLockDown manager is guaranteed when the ThreatLockDown manager version is later than or equal to that of the ThreatLockDown agent. Therefore, we recommend disabling the ThreatLockDown repository to prevent accidental upgrades. To do so, use the following command:

    # sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo

Uninstall a ThreatLockDown agent

To uninstall the agent, run the following commands:

  1. Remove the ThreatLockDown agent installation.

    # yum remove wazuh-agent

    Some files are marked as configuration files. Due to this designation, the package manager does not remove these files from the filesystem. If you want to completely remove all files, delete the /var/ossec folder.

  2. Disable the ThreatLockDown agent service.

    # systemctl disable wazuh-agent
# systemctl daemon-reload

The ThreatLockDown agent is now completely removed from your Linux endpoint.