How to deploy Hexnode XDR Agent via IBM

About Hexnode XDR agent

The Hexnode XDR (Extended Detection and Response) Agent is a software component installed on Windows endpoints that continuously monitors them to detect security details such as process details, file changes, network connections, and user behaviors. The Agent then communicates the security details to the centralized Hexnode XDR portal. It can also perform local analysis to determine whether any process is malicious. The Agent is deployed to target endpoints via the Hexnode XDR Agent package.

How do you download the Hexnode XDR Agent package to the admin system?

The Hexnode XDR Agent package is in the .msi packaging format. The Agent package can be downloaded from the XDR portal using the following steps:

1. Log into your Hexnode XDR portal.
2. Navigate to the Endpoints tab and select the Installation sub-tab.
3. Select the correct Hexnode XDR Agent package, based on whether it is the latest version corresponding to your OS architecture.
4. Click on Download to download the Hexnode XDR package installer as a .msi file.
5. Copy the passkey (Portal token) from the top of the Installation page; this will be used at the endpoint during package installation.
6. The downloaded .msi file can be deployed to the target endpoints from the IBM MaaS360 portal.

How do you deploy the Hexnode XDR Agent via IBM MaaS360?

The Hexnode XDR Agent package can be deployed from the IBM MaaS 360 Portal by leveraging the App Catalog feature. The .msi installer file of the Hexnode XDR package can be added to the App Catalog as a Windows Enterprise application and distributed to the devices. Below are the steps to add the package installer to IBM MaaS 360:

1. From your IBM MaaS360 portal home page, navigate to Apps > Catalog.
2. In the App Catalog page, select the Add button and expand the Windows section from the dropdown menu.
3. Further, select Enterprise App for Windows
4. In the Enterprise App for Windows pop-up screen, enter the following information under the App Details tab:
   • App upload option: Choose the MSI file upload option.
   • App: Upload the .msi file here by browsing from the system.
   • App Code, App Name and App Version: These information about the Hexnode XDR Agent package can be obtained using the Windows App Management Admin Utility. On any Windows system running PowerShell 2.0 or higher, download and install the Utility from the IBM MaaS360 portal, install the Agent package on the system and run the Utility. Select the app from its location on the system and Select Get App Properties from the context menu to obtain the App Code (both Product Code and Upgrade Code), App Name and App Version.
   • App Icon: Upload an app icon of size 30 x 30 pixels.
   • Description: Add an app description of less than 10000 characters.
   • Category: Enter the app category. If more than one, provide by separating with commas.
   • Screenshot(s): Provide the app UI screenshots
5. In the Installation Requirements tab, configure the following options:
   • Installation Mode: Choose Silent Installation to install the package in the System installation context, without the need for user interference.
   • Installation Context: Choose System or All Users so that all users of the Windows device have the Agent installed.
   • Execution Commands: The Install and Uninstall commands will be auto populated once the .msi file is uploaded. Manual editing is not required here.
   • Relevance to Install: The Agent package is installed on devices that pass the relevance to install criteria only.You can define these criteria by choosing among three options from the drop-down menu – Registry Key exists, File exists or Process Running. These criteria are optional.
   • Requires Restart: Check this box to restart the device upon completing Agent package installation.
   • Install Success Criteria: Check this box to define criteria that determine whether the Agent has been successfully installed.
6. Navigate to the Policies and Distribution tab on the same screen.
7. Configure the following options:
   • Remove App on: Choose whether to remove the added app from the managed devices during MDM Control Removal, Selective Wipe or Deleting from portal or stopping distribution.
   • Install Settings: Install Automatically is enabled by default and is non-configurable.
   • Distribute to: Choose between None, Specific Device, Group or All Devices. This option can be added multiple times using the + sign.
8. Click on Add to finalize adding the Hexnode XDR package as an Enterprise app to the IBM MaaS360 App Catalog.
9. If None is chosen in Distribute to, the Hexnode XDR package will not be distributed to devices immediately. If Specific devices, Group or All Devices are chosen, the package will be distributed to devices as per selection.

What happens after the XDR agent is installed on the endpoints?

The Hexnode XDR Agent runs silently in the background to automatically detect anomalies and threats, after it is installed on the endpoint device. The device will be listed under the Endpoints tab in the Hexnode XDR portal.