Install Traps Agent for Windows - Cortex XDR - Cortex XDR Agent - Advanced Endpoint Protection - Cortex - Security Operations

Before installing Traps™ agent 5.0 on a Windows endpoint, verify that the system meets the requirements described in Traps Agent for Windows Requirements.

Download the Traps installer for Windows from the Traps management service.

Ensure that you download the Windows installer for the Windows architecture (x64 or x86) installed on the endpoint.

Run the MSI file on the endpoint.

The installer displays a welcome dialog.

Click Next.

Install the agent.

The installer displays a User Account Control dialog.

Click Yes.

The installer displays a reboot notification.

Click OK.

After you complete the installation, restart the endpoint and verify the Traps agent can establish a connection.

Before installing Traps™ agent 5.0 on a Windows endpoint, verify that the system meets the requirements described in Traps Agent for Windows Requirements.

Use one of the following methods to open a command prompt as an administrator.

Run the msiexec command followed by one or more supported options and properties.

For example:

msiexec /i c:\install\traps.msi /l*v C:\temp\trapsinstall.log /qn

After you complete the installation, restart the endpoint and verify the Traps agent can establish a connection.

Install Traps Agent 5.0 Using Msiexec and include the proxy_list argument.

The argument format is proxy_list=”<proxy>:<port>”

1. You can assign up to five different proxies per agent. For each proxy, enter the IP address and port number. You can also configure the proxy by entering the FQDN and port number. When you enter the FQDN, you can use both lowercase and uppercase letters. Avoid using special characters or spaces.

   For example:

   msiexec /i c:\install\cortexxdr.msi proxy_list=”My.Network.Name:808,10.196.20.244:8080”

2. To install a Traps agent communicating through the Palo Alto Networks Broker Service, you must enter the Broker VM IP address and a port number. You can use default port 8888 or set another port number.

   Warning

   You are not permitted to configure port numbers between 0-1024 and 63000-65000, or port numbers 4369, 5671, 5672, 5986, 6379, 8000, 9100, 15672, 25672. Additionally, you are not permitted to reuse port numbers you already assigned to the Syslog Collector applet.

After the initial installation, you can change the proxy settings if necessary from the Endpoints page of Cortex XDR.

Install any software that you plan to have on the VDI instances.

1. On the golden image, Install Traps Agent 5.0 Using Msiexec and include the VDI_ENABLED=1 VDI flag.

   For example:

   msiexec /i c:\install\traps.msi /l*v C:\temp\trapsinstall.log /qn VDI_ENABLED=1

2. Install additional required software.

Scan your golden image for files and request verdicts.

Use Cytool to scan your endpoint. We recommend this step to populate the golden image with verdicts for executable files, DLLs, and files containing macros. If you do not perform this step, the Traps agent has to evaluate each file when it attempts to run on an endpoint during each VDI session.

1. Open a command prompt as an administrator and navigate to C:\Program Files\Palo Alto Networks\Traps.

2. If you plan to output the scanning report to the Traps folder, you must run the cytool protect disable command to disable Traps service protection.

3. Run the cytool imageprep scan [timeout <timeoutin hours>] [upload <upload timeout in minutes>][path <full path>] command where: the scan timeout is the number of hours you permit Cytool to run the scan (default is 4 hours), the upload timeout is the number of minutes that you permit Cytool to upload unknown files to assess the verdict (default is 95 minutes), and path is the path to the directory in which you want to output the scanning report.

   For example:

   C:\Program Files\Palo Alto Networks\Traps>cytool imageprep
   scan timeout 4 upload 60 path c:\report
   Start Time       : 17:56:46
   Elapsed Time     : 00:04:17
   State            : Running
   Scanned Files    : 5427
   Suspicious Files : 0
   Failed Files     : 9
   Volume Root Path : \\?\C:\
   Window Usage     : 0                       236                       20000
   Path             : ...t\cache2\entries\9B982CE198BF046E6CCF25478920DDFD9E5842E5
   
   Scan completed successfully
   
   Complete report can be found at: C:\report\imageprep_2018-03-06_08-59-30.xml

   Tip

   If you need to install additional software after performing this step, you must re-scan the endpoint to allow the Traps agent to obtain verdicts for the new software.

4. If you previously disabled service protection, enable it using the cytool protect enable command after the scan is complete.

5. Review any portable executable (PE) files that WildFire^® determined to be malicious.

   1. Open the scan report in Microsoft Excel or an editor of your choice.

   2. Perform one of the following actions for each malicious PE file:

      • Remove the malicious file from the golden image.

      • If you believe the WildFire verdict is incorrect, override the verdict for the PE file on the Hash Exceptions page of the Traps management service. Then perform a Check In from the Traps console on the golden image.

If you later rename the golden image, you must run the cytool vdi update to update the golden image name in the registry.