One agent, one service
The XenXDR agent runs as a Windows service or a Linux systemd unit. It does two jobs:
- collect: send the host's security telemetry to the deployment over TLS;
- respond: give an analyst a live console on the host: processes, files, a shell, network isolation, application control, a triage snapshot.
It installs and updates without a reboot and connects outbound only. Every command an analyst runs reaches the host over the agent's authenticated, encrypted connection with the analyst's identity attached.
What it collects
| Platform | Sources |
|---|---|
| Windows | Windows Event Log channels including Security, System and PowerShell; Sysmon; Microsoft Defender Antivirus detections. |
| Linux | journald, SSH and sudo authentication, auditd. |
The fleet policy for the organization decides what each host collects. See Telemetry.
What it can do
| Capability | Summary |
|---|---|
| Processes | List, kill, suspend, resume. |
| Files | Browse, stat, preview, hash, collect. |
| Live shell | Interactive terminal on the host. |
| Network isolation | Five containment modes, lease-based, reboot-safe. |
| Application control | Block and unblock by image or hash. |
| Quick triage | One-shot snapshot of the places that matter. |
| Security tool availability | Reports when a required tool goes down. |
Each capability has its own page in this section.
Size and footprint
The Windows agent is about 12 MB and the Linux agent about 13 MB on disk, with a light memory footprint. The Windows tray helper, if deployed, is a separate 4 MB executable with read-only access to agent status.
Where it lives
| Windows | Linux | |
|---|---|---|
| Program | C:\Program Files\XenXDR | /opt/xenxdr |
| Configuration | C:\ProgramData\XenXDR | /etc/xenxdr |
| State and spool | C:\ProgramData\XenXDR | /var/lib/xenxdr |
| Service name | XenXDRAgent | xenxdr-agent.service |
Identity and trust
At first connect the agent presents the organization's bootstrap enrolment token once and receives its own credential. From then on it authenticates with that credential, so every agent in the fleet has a credential of its own. The agent's fleet identifier is issued by XenXDR at enrolment, so a renamed or cloned machine keeps a distinct identity.
Updates are signed by FluenceSecurity and verified on the host against a key pinned at install time before they are applied. See Updates.