Install on Linux | XenXDR docs

Get the bundle

Download the Linux bundle for the organization from Settings › Fleet › Add agent. Linux bundles contain the amd64 and arm64 agent, the install script, the ingest CA certificate and a scoped enrolment token.

Install

As root, in the bundle folder:

bash

./install.sh --gateway wss://gw.xdr.example.com/agent \
             --enroll-token <token from the bundle> \
             --org <organization id> \
             --logpipe ingest.xdr.example.com:<ingest port>

The script installs the agent to /opt/xenxdr, writes configuration to /etc/xenxdr, installs the ingest CA certificate, applies the fleet policy for telemetry collection, and enables xenxdr-agent.service.

Verify

bash

systemctl status xenxdr-agent
journalctl -u xenxdr-agent -n 50

The host appears on the Hosts page within a minute, with the capabilities the agent reported for it. Install auditd for the fullest telemetry coverage.

Network isolation on Linux

The agent preserves the host's existing firewall policy and restores it when containment is released. If configuration management enforces host firewall rules, exclude the XenXDR containment rules from enforcement so the two stay in agreement. See Network isolation.

Uninstall

bash

./uninstall.sh --token <removal token>              # removes the service and /opt/xenxdr, keeps data
./uninstall.sh --token <removal token> --purge-data # also removes /etc/xenxdr and /var/lib/xenxdr

Create the removal token from the host's panel on the Hosts page.