Agent overview

What the XenXDR endpoint agent is and what it does on the host.

One agent, one service

The XenXDR agent runs as a Windows service or a Linux systemd unit. It does two jobs:

  • collect: send the host's security telemetry to the deployment over TLS;
  • respond: give an analyst a live console on the host: processes, files, a shell, network isolation, application control, a triage snapshot.

It installs and updates without a reboot and connects outbound only. Every command an analyst runs reaches the host over the agent's authenticated, encrypted connection with the analyst's identity attached.

What it collects

PlatformSources
WindowsWindows Event Log channels including Security, System and PowerShell; Sysmon; Microsoft Defender Antivirus detections.
Linuxjournald, SSH and sudo authentication, auditd.

The fleet policy for the organization decides what each host collects. See Telemetry.

What it can do

CapabilitySummary
ProcessesList, kill, suspend, resume.
FilesBrowse, stat, preview, hash, collect.
Live shellInteractive terminal on the host.
Network isolationFive containment modes, lease-based, reboot-safe.
Application controlBlock and unblock by image or hash.
Quick triageOne-shot snapshot of the places that matter.
Security tool availabilityReports when a required tool goes down.

Each capability has its own page in this section.

Size and footprint

The Windows agent is about 12 MB and the Linux agent about 13 MB on disk, with a light memory footprint. The Windows tray helper, if deployed, is a separate 4 MB executable with read-only access to agent status.

Where it lives

WindowsLinux
ProgramC:\Program Files\XenXDR/opt/xenxdr
ConfigurationC:\ProgramData\XenXDR/etc/xenxdr
State and spoolC:\ProgramData\XenXDR/var/lib/xenxdr
Service nameXenXDRAgentxenxdr-agent.service

Identity and trust

At first connect the agent presents the organization's bootstrap enrolment token once and receives its own credential. From then on it authenticates with that credential, so every agent in the fleet has a credential of its own. The agent's fleet identifier is issued by XenXDR at enrolment, so a renamed or cloned machine keeps a distinct identity.

Updates are signed by FluenceSecurity and verified on the host against a key pinned at install time before they are applied. See Updates.