MicroAgent manual installation

MicroAgent manual installation steps

Please download/copy provided MicroAgent package in system and have below mentioned port opened as well.

Port/Protocol: 12102/TCP

Please follow below steps to deploy Winlogbeat & Sysmon agents in Windows end systems:

Winlogbeat installation

Below are the steps for Winlogbeat installation:

• Open Command Prompt > Run as Administration

• Copy the complete path where the ‘Deploy Agent’ file is and enter the command as cd <paste

the path> as shown below:

cd C:\ .......... \MicroAgent

• Type ‘Deploy_Agent.bat’ (without apostrophe) and enter. This will automatically install the agent

To confirm, please open ‘Services’ application and look for ‘winlogbeat’ service and check if whether it is in Running state with type Automatic. If not you can stop and restart the service.

Sysmon installation:

Pre-requisite:

Firstly, latest Sysmon version has to be downloaded from Microsoft Sysinternals website.

Sysmon latest version is available at below link

https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

A zip file will be downloaded from the Sysinternals website and we need to copy all the

contents of that zip file and paste them into the 'sysmon' folder of MicroAgent package.

Below are the steps for Sysmon installation:

Then please follow below steps to deploy Sysmon.

• Open Command Prompt > Run as Administration

• Copy the complete path where the ‘Deploy Sysmon’ file is and enter the command as cd <paste

the path> as shown below:

cd C:\ .......... \MicroAgent

• Type ‘Deploy_Sysmon.bat’ (without apostrophe) and enter. This will automatically install the agent

To confirm, please open ‘Services’ application and look for ‘Sysmon’ service and check if whether it is in 'Running' state with type 'Automatic'. If not you can stop and restart the service.

Note: Please make sure Firewall is not blocking the data from end points to Log Collector

Uninstallation of Winlogbeat and Sysmon

Below are the steps on how to uninstall both Winlogbeat and Sysmon:

• Open Command Prompt > Run as Administration

• Copy the complete path where the ‘Uninstall_Agent-Sysmon’ file is and enter the command as

cd <paste the path> as shown below:

cd C:\ .......... \Micro-Agent

• Type ‘Uninstall_Agent-Sysmon.bat’ (without apostrophe) and enter. This will automatically

uninstall the both winlogbeat and Sysmon agents.

This will remove winlogbeat and Sysmon service and its related files.

Troublesooting Giude:

A. Verify if Winlogbeat and Sysmon Services are Running

1. Open Services:

• Press Windows + R, type services.msc, and press Enter.

2. Locate Winlogbeat:

• In the Services window, scroll down and look for Winlogbeat and sysmon.

3. Check Status:

• Ensure that the Status column shows Running.

• If it’s not running, right-click on Winlogbeat and select Start.

B. Check Connectivity to Log Collector

1. 2. Open Command Prompt by pressing Windows + R, typing cmd, and pressing Enter.

Ping the Log Collector’s IP:

• Type the following command and press Enter:

ping <Log_Collector_IP>

Replace <Log_Collector_IP> with the IP address of the log collector.

• If the ping is successful, it indicates connectivity. If it fails, ensure there are no network

issues or firewalls blocking the connection.

C. Ensure Logs are Being Generated in Event Viewer

1. Open Event Viewer:

• Press Windows + R, type eventvwr.msc, and press Enter.

2. Navigate to Windows Logs:

• In the Event Viewer window, expand Windows Logs in the left pane.

• Select Application or Security, depending on which logs you expect to see from Winlogbeat

or Sysmon.