# The Hexnode Store: Vetting, Curating, and Deploying Enterprise Binaries In a global enterprise environment managing 500,000 devices across 50 sub-companies, manual application packaging is an operational bottleneck that introduces security risks and configuration drift. The **Hexnode Store** is a strategic, **Hexnode-maintained repository** containing an extensive catalog of over 1,300+ pre-packaged applications designed to replace legacy manual workflows with a standardized, high-velocity **application delivery model**. Think of the Hexnode Store as a curated enterprise equivalent of a public App Store or Play Store, but natively integrated and maintained by Hexnode. Unlike the **Add Apps** (Enterprise App) workflow, where administrators must manually package, upload, and configure binaries, the Hexnode Store provides a built-in library of **pre-packaged macOS and Windows applications**. This includes essential productivity tools (Microsoft 365, Slack), web browsers (Chrome, Firefox), and communication platforms (Zoom, Webex), all ready for immediate deployment. ### **The Hexnode Store Advantage: Visible Performance** To maintain a high-security posture, visibility into catalog capability is essential. Hexnode Store provides: - **1,300+ Managed Applications**: While traditional patch management tools often limit coverage to a few hundred titles, the Hexnode Store offers a materially larger catalog of 1,300+ applications across Windows and macOS. - **3–5 Business Day SLA**: New stable versions are vetted, packaged, and added to the store within a week of vendor release. - **High-Velocity Tracking**: Hexnode tracks and maintains **30–60 new versions per cycle** across Windows and macOS, eliminating the manual “vulnerability window” for IT teams. The Enterprise Binary Lifecycle ------------------------------- Hexnode treats every application as a **managed asset**. The lifecycle follows a structured “**Upload-to-Deployment**” path. ### 1. Vetting & Integrity Verification Hexnode ensures binary security through a “Zero-Trust” execution model. Before any app is installed, the **Hexnode Agent** must verify the binary against its cryptographic fingerprint to prevent tampering or corruption. Security & Readiness Hexnode Store Apps Custom Enterprise Apps **Integrity Check** **SHA-256 Hashing**: Pre-calculated by Hexnode. The Agent validates the file bit-for-bit before execution. **SHA-256 Hashing**: Admin-provided. The Agent validates the hash to ensure no corruption occurred during transit. **Vetting Source** **Hexnode Curated**: Binaries are sourced from official vendors and scanned for malware by Hexnode. **Admin Managed**: Admins are responsible for ensuring the “Golden Binary” is trusted and compliant. **Deployment Readiness** **Ready-to-deploy**: Pre-packaged and optimized for immediate distribution. **Depends on Admin Configuration**: Requires manual upload and metadata setup before use.**Install Logic** **Pre-Configured**: Silent switches (e.g., /S, /quiet) and post-install scripts are built-in. **Manual Config**: Admins must research and define install arguments for unattended deployment. **Maintenance****Managed**: Hexnode updates the repository when new stable versions are released.**Manual**: Admins must manually upload and version-control new versions of the binary.### 2. The Curated “Hexnode Store” Catalog The Hexnode Store provides a **curated set of commonly deployed macOS and Windows applications**, maintained directly within the **Hexnode Inventory**. - **Ready-to-Deploy Applications**: Hexnode Store apps can be deployed instantly using **Required Apps policies** or the **Install Application** remote action. - **Operational Consistency**: Because Hexnode Store applications are pre-packaged, version-controlled, and centrally maintained by Hexnode, administrators can deploy the same validated application build across devices, regions, and sub-companies, reducing configuration drift and deployment failures. ### 3. Strategic Patch Remediation & Version Currency In large-scale environments, the Hexnode Store simplifies and accelerates application update distribution for commonly used macOS and Windows applications. - **Centralized Version Availability**: Hexnode maintains and updates application packages within the Hexnode Store as vendors release newer stable versions. Administrators always have access to a ready-to-deploy, vetted version without the need to repackage installers or redefine silent install logic. - **Admin-Controlled Patch Rollouts**: When a newer version is available in the Hexnode Store, administrators can redeploy the application using **Remote Actions**, or **Automation** workflows. This replaces outdated versions on devices with the latest Store-maintained build in a highly controlled manner. - **Faster Security Remediation**: When vulnerable or outdated versions are identified, the Hexnode Store enables rapid fleet-wide remediation. Technicians can trigger updates for specific **Dynamic Groups** immediately, shrinking the “vulnerability window.” - **Clear Responsibility Boundary**: - **Hexnode Store**: Maintains packaging, silent install logic, and version availability. - **Administrators**: Control testing, scheduling, and the rollout strategy. - **Hexnode Agent**: Enforces integrity checks and final installation. Deployment at Scale -------------------- At large scale, application delivery is optimized through Hexnode’s **DAFS (Distributed Apps and Files Server)** architecture to minimize WAN congestion. - **Deterministic Staging**: Application payloads are staged across regional **DAFS nodes** to optimize download paths. - **Resilient Downloads**: The **Hexnode Agent** supports **Byte-Range Resumption**, allowing large packages to resume downloading after a network interruption. - **Ordered Deployment**: Administrators can control installation sequencing using **Policy-based deployment** when complex dependencies exist. Governance: App Siloing & Versioning ---------------------------------------- To support multi-company environments, Hexnode implements strict logical isolation. Feature Technical Implementation **App Siloing** **Tenant-Level Separation** ensures apps in Sub-Company A are not visible or accessible to admins or users in Sub-Company B.**Version Control** Maintain multiple versions simultaneously. Admins can **Upgrade or Downgrade** devices by re-deploying the required version via policies.**Auto-Update Support**Public apps (Chrome, Zoom) distributed via **Apple VPP** or **Managed Google Play** update automatically through native managed channels. **License Management** Integration with **VPP** and **Play Store** to track licenses and reclaim during employee offboarding.Technical Workflow (The “Push” Logic) ------------------------------------- The deployment workflow is dictated by the application source selected within the **Apps inventory**. ### 1.Inventory Sourcing - **Hexnode Store**: Administrators select from a curated library of **macOS** and **Windows** applications. No file upload or metadata configuration is required. - **Enterprise Apps**: Administrators upload custom binaries (.msi, .exe, .pkg, or .dmg) and manually configure installation metadata, such as silent install switches and post-install scripts. - **Store Apps**: Administrators add applications distributed through the **Volume Purchase Program (VPP)** or **Managed Google Play**. ### Deployment & Execution Flow - **Deployment Configuration**: The application is assigned to specific [**Dynamic Groups**](https://www.hexnode.com/mobile-device-management/help/dynamic-device-groups/) using a **Policy** or **Action**. - **Device Sync**: The device receives the installation command during its next check-in. - **Agent Execution**: Based on the application source, the Hexnode Agent initiates installation: - **Hexnode Store**: Downloads the Hexnode-hosted, pre-packaged binary. - **Enterprise Apps**: Downloads the administrator-uploaded binary with defined install parameters. - **Store Apps**: Triggers installation via the native OS-managed channel (e.g., Apple VPP or Managed Google Play). - **Integrity Verification**: The Hexnode Agent validates the binary using SHA-256 hashing prior to execution. - **Installation**: The installer runs with **system-level privileges**, enabling a silent, unattended user experience. Post-Deployment Operations -------------------------- The lifecycle continues beyond the initial installation to ensure long-term stability and user satisfaction. - **Feedback Loop**: After the deployment, gathering user feedback is crucial. This can be done through surveys or direct communication. Understanding user experiences helps in making necessary adjustments and improvements for future deployments. - **Ongoing Maintenance**: Regular updates and maintenance are essential to keep the application running smoothly. This includes applying patches, updating features, and ensuring compatibility with other software used within the organization. Implementation Checklist: App Phase ----------------------------------- 1. Define **Dynamic Groups** for automated software targeting. 2. Establish **App Categories** based on sub-company or departmental structures. 3. Upload **Golden Binaries** for core enterprise productivity suites. 4. Configure **[Compliance policy](https://www.hexnode.com/mobile-device-management/help/how-to-create-a-compliance-policy-for-devices/)** to automatically detect and remove **Blocklisted** applications.