Before you start
Have the requirements in place: a Linux host with Docker, public DNS names for the console, gateway and portal, and the licence bundle from FluenceSecurity.
Get the deployment files
git clone <deployment repository URL> xenxdr
cd xenxdr/deploy
Configure secrets
Copy the example environment file and generate the ingest certificates:
cp .env.example .env
./scripts/gen-certs.sh ingest.xdr.example.com
The certificate script creates the certificate authority for log ingest over TLS. Distribute its CA certificate to every sender; re-run the script to rotate.
Open .env and replace every value marked CHANGE_ME. Generate secrets with openssl rand -hex 24; the console session password needs at least 32 characters. The groups you will find:
| Group | What it controls |
|---|---|
| Hostnames | The console, gateway and portal names and the email address for certificate issuance. |
| Service credentials | Passwords for the platform's own accounts. |
| Ingest | The shared key for the HTTP and HEC inputs. |
| Fleet | The bootstrap enrolment token (each agent receives its own credential at first connect) and the fleet operator token. |
| Console authentication | The session password and the bootstrap administrator's email and password. |
| Single sign-on (optional) | Issuer, client ID and secret for Fluence Account. See Single sign-on. |
| AI (optional) | A self-hosted model endpoint and an optional hosted fallback. See Model setup. |
Start the stack
docker compose up -d --build
The first start prepares the database. Check that everything is up:
docker compose ps
curl -s https://gw.xdr.example.com/api/health
Every service should show Up or healthy, and the health check should answer with ok: true.
First sign-in
Open https://console.xdr.example.com and sign in with the bootstrap administrator credentials from the environment file. Then:
- Go to Settings › Team & roles and create accounts for your analysts. Roles are admin, lead, analyst and viewer; grants can be limited to specific organizations.
- Go to Settings › Organizations and create an organization for each entity you protect. A single-company deployment still has one organization.
- Go to Settings › System to confirm database health and version.
Continue with the first hour checklist.
Upgrading
Pull the new deployment files, follow the steps in the release notes for your version, then docker compose up -d --build. See Upgrades.