Bundles are per organization
Every organization has its own installer bundle. The bundle carries an enrolment token scoped to that organization, so an agent installed from it can only ever enrol there. Providers therefore hand each customer their own bundle and never share one across tenants.
Download bundles, or copy the install command, from Settings › Fleet › Add agent. The same card holds the organization's enrolment token: Rotate replaces it and Revoke removes it. Either one invalidates bundles downloaded earlier. Agents already enrolled are unaffected because they hold their own credential.
Enrolment
At first connect the agent presents the enrolment token once. XenXDR verifies it, issues the agent its own credential and a server-generated fleet identifier, and records the enrolment in the audit trail. The token is never used again by that agent.
If a token leaks, rotate it. Agents that enrolled with the old token keep working; new enrolments with the old token are refused.
Fleet groups and policy
Settings › Fleet lets you define fleet groups per organization and assign hosts to them. A group's policy sets:
- which log shippers run on the host;
- the required security tools checklist used by Security Tool Availability;
- which event classes the agent collects;
- managed sensors the agent installs and keeps configured, such as Sysmon or audit rules;
- on-host rules and the response each one takes;
- a maintenance window;
- whether the hosts are always-on, so an alert is raised when one stops reporting.
Agents pick up policy changes within about a minute.
Removal tokens
Removing an agent through uninstall.ps1 or uninstall.sh needs a removal token for that host. Admins create one from the host's panel on the Hosts page; it is valid for one hour. Uninstalls without a token are refused and reported.