Install on Linux | XenXDR docs

Get the bundle

Download the installer bundle for the organization from Settings › Agents. Linux bundles contain the amd64 and arm64 agent, the install script, the ingest CA certificate and a scoped enrolment token.

Install

As root, in the bundle folder:

bash

./install.sh --gateway wss://gw.xdr.example.com/agent \
             --enroll-token <token from the bundle> \
             --org <organization id> \
             --log-pipe ingest.xdr.example.com:<ingest port>

The script installs the agent to /opt/xenxdr, writes configuration to /etc/xenxdr, installs the ingest CA certificate, applies the fleet policy for telemetry collection, and enables xenxdr-agent.service.

Verify

bash

systemctl status xenxdr-agent
journalctl -u xenxdr-agent -n 50

The host appears on the Hosts page within a minute, with the capabilities the agent reported for it. Install auditd for the fullest telemetry coverage.

Network isolation on Linux

The agent preserves the host's existing firewall policy and restores it when containment is released. If configuration management enforces host firewall rules, exclude the XenXDR containment rules from enforcement so the two stay in agreement. See Network isolation.

Uninstall

bash

./uninstall.sh              # removes the service and /opt/xenxdr, keeps data
./uninstall.sh --purge-data # also removes /etc/xenxdr and /var/lib/xenxdr