Managing the Workload Protection agent on Windows servers

After you provision an instance of the IBM Cloud® Security and Compliance Center Workload Protection service in IBM Cloud, you can deploy the Workload Protection agent on your Windows servers to collect events and protect your workloads.

For examples of threat detection on Windows and troubleshooting detected events, see Windows Threat Detection with IBM Cloud Security and Compliance Center Workload Protection.

Before you begin

Complete the following steps:

  1. Obtain the access key for your Workload Protection instance.

  2. Obtain the ingestion URL for your instance. For more information, see Collector endpoints.

  3. Verify that you have Administrator permissions on the Windows server.

Downloading the agent

The Workload Protection agent uses Falco to ensure workload security and compliance. The agent has two components: the Connection Manager and the Security Manager, which are both managed by the Agent Installer.

You can install the Workload Protection agent by using either the GUI or the CLI.

Download the agent in MSI format. If you need to install the agent on a host that runs only in the IBM private network, download it from IBM Cloud Object Storage.

Installing the agent by using the GUI

To install the agent by using the GUI:

  1. Run the MSI installer.

  2. Accept the EULA.

  3. Select custom as the region.

  4. Complete the following fields:

    Custom Collector
    The ingestion URL for the region where your Workload Protection instance is available. For more information, see Collector endpoints. For example, ingest.private.us-east.security-compliance-secure.cloud.ibm.com.
    Custom Collector port
    The collector port. Set to 6443.
    Custom API URL
    The API endpoint URL for the region where your Workload Protection instance is available. For more information, see API endpoints. For example, https://private.us-east.security-compliance-secure.cloud.ibm.com.
    Access Key
    The ingestion key for your instance.

  5. Complete the installation.

Installing the agent by using the CLI

To install the agent by using the CLI, run the MSI in silent mode from the command line or PowerShell.

Replace <COLLECTOR_URL>, <API_ENDPOINT>, and <AGENT_ACCESS_KEY> with the values from your Workload Protection instance:

msiexec /i sysdig-host-shield-latest.msi REGION=custom ACCESS_KEY=<AGENT_ACCESS_KEY> COLLECTOR_URL=<COLLECTOR_URL> COLLECTOR_PORT=6443 API_URL=<API_ENDPOINT> VM_FEATURE_ENABLED=True POSTURE_FEATURE_ENABLED=True ACCEPT_TERMS_CONDITIONS=True /qn

Where:

AGENT_ACCESS_KEY
The ingestion key for your instance.
COLLECTOR_URL
The ingestion URL for the region where your Workload Protection instance is available. For more information, see Collector endpoints. For example, ingest.private.us-east.security-compliance-secure.cloud.ibm.com.
API_ENDPOINT
The API endpoint URL for the region where your Workload Protection instance is available. For more information, see API endpoints. For example, https://private.us-east.security-compliance-secure.cloud.ibm.com/api.