Installing the Arctic Wolf Agent
Recently we had to go about deploying an agent from a managed SOC called “Arctic Wolf” to all of our server endpoints. The trouble is, the MSI file had to be in the same directory as a “customer.json” file in order to work. This was an issue because Automox only allows you to upload the MSI. Luckily, with PowerShell your imagination is the limit. This is how we got around the limitation as the “customer.json” file is a rather small (one line) file and can be created at runtime with PowerShell.
- Create a
Required Softwarepolicy for Windows - Upload the MSI to Automox
- Set the
Package NameandPackage Versionto how it appears in the Win32_Product WMI class when installed on a machine. This is how Automox determines if the package is installed and if a machine is compliant. Currently as of writing this, the name isArctic Wolf Agent 2020-05_01and the version is20.20.0501. - Use the following PowerShell syntax to install the software, replacing the
customerUUIDandregisterDnsJSON attribute values with your own.
$json = '{"customerUuid":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","registerDns":"xxxx-xxxx-reg.xxxxxxx.com"}' #This will be what is written to the customer.json file
$Utf8NoBomEncoding = New-Object System.Text.UTF8Encoding $False #Set encoding for the output file to UTF8 with no Byte-order-mark
bSystem.IO.File]::WriteAllText("$pwd\customer.json",$json,$Utf8NoBomEncoding) #Write the file to the current working directory with UTF8 no BOM encoding. It is important to use native .Net functions to do this as Out-File adds a \r\n newline after the file. This will cause the installation to break. The -NoNewLine paramenter in Out-File only works on PowerShell 5+
exit (Start-Process -FilePath 'msiexec.exe' -ArgumentList ('/qn', '/i', '"arcticwolfagent-2020-05_01.msi"', '/l*v c:\AWAgent.log', '/norestart') -Wait -Passthru).ExitCode #Install with MSIExec and write to log c:\AWAgent.log
- Apply the policy to the appropriate groups and schedule as required!
If you need to ever change the customer.json file after the agent is installed.
You MAY run into a case where the AW agent was installed and the customer.json file was incorrect or corrupted. In this case, you will have a customer.json file in the installation directory, but no .agent_info file. You will need to create a worklet like this in order to rectify the situation:
Evaluation Code:
if((Test-Path -Path "C:\Program Files (x86)\Arctic Wolf Networks\Agent") -and (!(Test-Path -Path "C:\Program Files (x86)\Arctic Wolf Networks\Agent\.agent_info")))
{
exit 1 #Checks if the install directory exists but .agent_info doesn't exist (broken installation); returns 1
}
else
{
exit 0 #Returns 0 if this worklet doesn't apply to the machine it is run on.
}
Remediation Code:
The remediation code overwrites the customer.json file and restarts the service to get the agent to register with Arctic Wolf
try{
$automoxdir = "C:\Program Files (x86)\Arctic Wolf Networks\Agent"
$json = '{"customerUuid":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","registerDns":"xxxx-xxxx-reg.xxxxxxx.com"}'
$Utf8NoBomEncoding = New-Object System.Text.UTF8Encoding $False
System.IO.File]::WriteAllText("$automoxdir\customer.json",$json,$Utf8NoBomEncoding)
Restart-Service -Name ArcticWolfAgentMgr
Exit 0
}
catch
{
Exit 1
}
Hopefully this helps someone out there in a similar situation, even if it is with a different application!