Windows: Installation with PowerShell
The windows PowerShell script installer will install the agent on the system using a private HTTP/HTTPS repo contained on the AO Hub server, or a shared drive. It will then configure the agent (ossec.conf), and register the agent to the hub.
These instructions can also be found in your Atomic HUB by navigating to Asset Management > Add Agent
Requirements
- Administrator rights
- PowerShell 5.1 or higher
Step 1: Open PowerShell as an Administrator and run the following command to download the agent installer Note: Windows defaults the download of the installer to system32. We recommend changing the download location to a directory to which the user has permissions such as c:\users
Invoke-WebRequest http://<hub_address>/installers/agent_deployV2.ps1 -Outfile .\agent_deployV2.ps1Step 2: In PowerShell, in the directory where agent_deployV2.ps1 was downloaded, run the following where <hub_address> is the address of the OSSEC hub
powershell -executionpolicy bypass -file .\agent_deployV2.ps1 -ossec_exe http://<hub_address>/channels/awp-hub-repo/windows/ossec-agent-latest.exe -server_ip <hub_address> -secure_protocol udpInstaller options
Optional:
- -ossec_exe
URL to agent .exe (default: hub downloads ossec-agent-latest.exe)
- -agent_name
Agent name (default: hostname or FQDN)
- -port
Authd/registration port (default: 1515)
- -secure_port
Manager port for events (default: 1514)
- -secure_protocol
udp or tcp (default: udp)
- -password
Registration auth password
- -group
Agent group (default: default)
- -ossec_path
Install path (default: C:\Program Files (x86)\ossec-agent\)
- -prompt_agent_name
0 or 1: prompt for name (default: 0)
- -use_fqdns
0 or 1: use FQDN as name (default: 1)
- -reinstall
0 or 1: reinstall if present (default: 1)
- -rekey
0 or 1: force re-registration (default: 0)
- -default_name
Use <External IP>-<Hostname>
- -update_agent
Switch: update to latest agent