Introduction

Within this guide we will cover how to obtain the Linux Endpoint Agent installation packages, the commands to install the Endpoint Agent and how to Uninstall the agent using the CLI.

This article covers the following topics:

• Linux Agent Overview
• Obtain an installation package
• Install the Linux Endpoint Agent
  • Debian/Ubuntu
  • RedHat
• Uninstall the Linux Endpoint Agent
  • Debian/Ubuntu
  • RedHat
• Verify the Installation
  • Debian/Ubuntu
  • RedHat

Linux Agent Overview

The Field Effect MDR Linux agent is natively built and runs as a privileged systemd service. The default user-mode agent install monitors processes (starts|stops), network activity, users, logon sessions, software packages, services/scheduled jobs, drives. It also collects general information about the host OS (OS, kernel version, etc.). We also support static file scanning and log monitoring where relevant to security. 

Most of this data is available to view on the Appliance Dashboard.

Obtain an installation package

The installation package for the Linux, and all other support, endpoint agent can be downloaded from the MDR Portal's Downloads page.

Packages are available in either a Debian (.deb) or RedHat (.rpm) package. 

.deb files are the files used for Debian Linux based operating systems. 

.rpm files are the files that are used for Red Hat Linux based operating systems.

You must install the license file first, followed by the agent file.

Install the Linux Endpoint Agent

Ensure to replace the <version> with the Endpoint Agent version in the filename of the package you have downloaded.

Debian/Ubuntu

sudo dpkg -i "covalence-endpoint-license.deb" 
sudo dpkg -i "covalence-endpoint-x86_64-<version>.deb"

RedHat

sudo rpm -i "covalence-endpoint-license.rpm" 
sudo rpm -i "covalence-endpoint-x86_64-<version>.rpm"

Uninstall the Linux Endpoint Agent

Here are the CLI commands required to uninstall the Linux Endpoint Agent:

Debian/Ubuntu

sudo dpkg -r covalence-endpoint-license 
sudo dpkg -r covalence-endpoint

RedHat

sudo rpm -e covalence-endpoint-license 
sudo rpm -e covalence-endpoint

Verify the Installation

To verify if the agent was successfully installed, you can run the following Linux commands:

Debian/Ubuntu

dpkg -s covalence-endpoint

If the agent was installed successfully, the command should return the following output (or something similar, depending on your version):

Package: covalence-endpoint
Status: install ok installed
...

RedHat

rpm -q covalence-endpoint

If the agent was installed successfully, the command should return the following output (or something similar, depending on your version):

covalence-endpoint-3.3.24-1.x86_64