Deploying the Datto Endpoint Security agent

NAVIGATION   > Organizations > select an organization > select a location >  > Download Agent

SECURITY   Datto EDR subscription with administrator-level platform access or Datto AV subscription with administrator-level platform access

SECURITY   Service account or administrator-level rights on the target endpoint

This article describes the process for directly installing the Endpoint Security agent on an endpoint. For alternate deployment methods, refer to the Additional resources section of this article.

NOTE  Datto AV protection is delivered by the Datto Endpoint Security agent and is managed from the Policies page.

Prerequisites

Before you begin, we need to understand your current environment and what you'd like to do.

  • If you're a Datto EDR or Datto AV customer deploying the Endpoint Security agent to endpoints that currently don't have it, proceed to the next section of this article.

  • If you're a Datto EDR or Datto AV customer seeking to enable AV protection on one or more endpoints where the Endpoint Security agent is present, you do not need to redeploy any software. Refer to our Working with the Policies page article.

Direct installation

To monitor your endpoints, you'll need to install a lightweight software agent on all protected hosts.

IMPORTANT   Verify that your endpoints meet the minimum hardware and operating system requirements. Refer to the article Hardware and operating system requirements

IMPORTANT  This agent collects telemetry data and other information without dependencies on the underlying operating system. We have tested the Endpoint Security agent on the minimum versions of the platforms noted in this document and plan to support them indefinitely.

Download and install the Datto Endpoint Security agent by performing the following steps:

  1. Log in to your EDR instance. In the top navigation menu, click Organizations.

  2. Select the organization and the location to which you'll be deploying the agent. For more information, refer to Creating and managing organizations, locations, and devices.

  3. From the Location page, click the menu above the Location Details pane. Then, select Download Agent.

  4. The Download Agent modal will open.

  5. Select the installer that matches your endpoint's operating system.

    • To download the agent to your current computer, click Download.

    • To copy the installer's unique download link for use on another endpoint or to include in an installation script, click Copy Download Link.

    IMPORTANT  The download link is location-specific. You should not use it to deploy the agent to other locations in your organization.

  1. Select a topic to continue.

Interactive install

  1. Run the installer as an administrator. A Command Prompt window will open.

  2. Input the cname or full URL of your EDR instance (such as https://mycompanyname.infocyte.com). The URL will be supplied to you via email or by your EDR representative.

  3. If the agent should use a proxy account, enter the username, password, IP address, and port information in the format shown by the installer.

  4. Verify the installation directory. Make any necessary changes.

  5. If you'd like to assign a human-friendly name for this agent, enter it when prompted.

  6. Should you wish to automatically assign this agent to an organization and location, input a registration key. Doing so streamlines the process when you have hundreds or thousands of agents to manage at once. You can generate registration keys at > Admin > Agents > Registration Keys. For more information about managing organizations and locations, refer to Creating and managing organizations, locations, and devices.

  7. To begin the installation process, enter Y when prompted.

  8. Once the installation completes, the Command Prompt window will automatically close.

Command line install

To install the agent via command line, run the executable within an administrator shell (such as PowerShell) in the following format:

SYNTAX:
windows64.exe [FLAGS] [OPTIONS] [SUBCOMMAND]

EXAMPLE:
windows64.exe --key <Registration Key> --url https://mycompany.infocyte.com
					
FLAGS:
 --debug Turn on debug logging
 --enforce-https-certs Use TLS certificate validation (only use if providing own cert!)
 --help Prints help information
 --ignore-versioning Don't update local binary to match server
 --no-extensions Don't run custom extensions
 --no-install Do not install the agent, default = install
 --no-intense-io Don't do any io-intensive file operations
 --no-rts Do not run in RTS mode, only normal scans
 --no-verify Don't verify the remote api is reachable
 --quiet Do not send output to console (only log file)
 --repl Launch lua repl with built in runtime extensions
 --service Run as a service
 --uninstall Remove HUNT Agent that was installed via --install
 --version Prints version information
 --verbose Turn on verbose logging

OPTIONS:
 --url <api-url>
 Sets the API URL (ex: https://192.168.1.1) to use for either generating a file or API communication

 --auth <auth> Authenticator to use for auto-registration (optional)
 --config <config> Use this as the configuration file
 --database-name <database-name> Name of database to use for persistent storage
 --extension <extension> Path to an extension or directory containing extensions
 --friendly <friendly> Set a friendly name for this agent on the HUNT Server
 --generate-config <generate> Create a new configuration file
 --install-dir <install-dir> Specify directory in which to install HUNT Agent
 --interval <interval> Sets the interval (in seconds) to use when pinging the API
 --log-dir <log-dir> Sets the directory in which to store log files
 --max-extension-run-time <max-extension-run-time> Max number of seconds an extension can run
 --proxy <proxy>
 Sets the optional HTTP proxy to use (ex: user:password@192.168.1.1:8080)

 --key <server-key> Registration key (optional)

SUBCOMMANDS:
 help - Prints this message or the help of the given subcommand(s)
 survey - performs only survey actions, saving data to disk and exiting

Installation process

  1. After you download the installer, open a Terminal session on your Linux system and run the following command to make the installer executable.

chmod +x linux64.exe

  1. Next, launch the installer as a super user. Replace all values in brackets with the values corresponding to your instance.

sudo ./linux64.exe --key [Registration Key] --url [https://mycompany.infocyte.com]

  1. Follow the prompts to install the agent.

Prerequisites

The Endpoint Security agent supports Apple endpoints with Intel x86 and Apple M1 (ARM) processors.

Installation process

  1. After downloading the installer, rename the file agent.macos.bin.

    • The downloaded file name will be agent.macos-amd64.<sha256 hash>.bin or agent.macos-arm64.<sha 256 hash>.bin.

    • Note that the hash in the downloaded file name will change with each build when agent changes are pushed out.

  2. Open Terminal.

  3. Run the following command to navigate to the downloads folder.
cd ~/Downloads
  1. Run the following command to make the installer executable.
chmod +x ./agent.macos-amd64.<sha256 hash>.bin
  1. Launch the installer as a super user.
sudo ./agent.macos-amd64.<sha256 hash>.bin

NOTE  Sudo command is not required if the user who initially downloaded the file is logged into the system.

  1. Follow the prompts to install the agent.

NOTE  On Mac ARM machines, the user may be prompted to install Rosetta before the agent can be installed.

Alternatively, the agent can be installed with a single command line:

sudo ./agent.macos-amd64.<sha256 hash>.bin --url <instance URL>

NOTE  The default installation directory is /usr/local/infocyte/agent. The service name will be HUNTAgent.

Wrapping up

If this agent deployment is for or will include Datto AV service, proceed to our Working with the Policies page article to continue.

Uninstallation

To remove the Endpoint Security agent from a Windows system, you can launch its built-in uninstaller via the Add/Remove Programs feature. Alternatively, you can run the following PowerShell commands on the endpoint.

PS > cd "C:\Program Files\Infocyte\Agent"
PS > .\agent.exe --uninstall

To remove the Endpoint Security agent from a Linux or macOS system, you can either automatically or manually perform the uninstall from a Terminal session.

Automatic method 

sudo /usr/local/infocyte/agent/agent.exe --uninstall

Manual method 

systemctl stop HUNTAgent
systemctl disable HUNTAgent
rm /etc/systemd/system/HUNTAgent.service
systemctl daemon-reload
systemctl reset-failed
rm -rf /opt/infocyte

Additional resources

The following articles provide alternate methods to deploy the Endpoint Security agent: