Installing GuardMode Agent on Windows

Downloading and launching GuardMode Agent installer

Go to the Catalogic MySupport website. Select the latest version of GuardMode Agent and click the installer download link.

Once the download is completed, launch the installer. The Catalogic GuardMode Agent Setup Wizard will initiate. Go through the Wizard clicking Next and making selections as required.

Selecting installation directory

You can select a custom installation path by clicking on the folder icon next to the default installation path or continue with the default path.

Next, you will be prompted to create a password to access GuardMode Agent via its REST API.

See also. To learn more about GuardMode Agent’s REST API, see REST API documentation.

You can also configure GuardMode Agent REST API authentication using CLI in the project’s root directory:

.\Catalogic.GuardMode.Agent config update basic-authentication --username {username} --password {password}

Setting up notifications

The Setup DPX notifications checkbox (checked by default) guides you through the following configurations:

• Setting up DPX Notification Provider to send events and logs to the DPX panel

• Adding Catalogic GuardMode Agent to DPX Master Server (registering it as a Node, which allows you to configure the Agent through DPX web interface)

The Setup Syslog notifications option (unchecked by default) guides you through the following configurations:

• Setting up GuardMode Agent to send notifications to the Syslog server

• Setting up communication using TLS

DPX configuration panel (optional)

Tip. This step will be skipped if you unchecked the Setup DPX notification box.

To configure your GuardMode Agent with DPX, you need to provide the following information:

• Hostname is the DPX Master Server hostname or IP address

• Username is the DPX web interface username (by default, this is sysadmin)

• Password is DPX web interface password

• Disable TLS certificate validation: Tick the checkbox to disable the DPX Master Server’s TLS certificate validation. This may be required if a certificate error is thrown while configuring DPX notifications

Note. When configuring notification providers or DPX authentication, you can specify a full hostname with the protocol (e.g. http://dpxserver.com) instead of just the hostname. If no protocol is provided, the default HTTP will be used.

Tip. You can enable or disable DPX SSL certificate validation using GuardMode CLI. For details, see: .\Catalogic.GuardMode.Agent.exe config update notification-provider dpx --help

You can also configure GuardMode Agent with DPX using CLI in the project’s root directory:

.\Catalogic.GuardMode.Agent config add notification-provider dpx --hostname {dpx_hostname} --username {dpx_username} --password {dpx_password}

Note. Make sure GuardMode Agent and the DPX Master Server are in the same network.

Syslog configuration panel (optional)

To configure GuardMode Agent with Syslog, tick the Setup Syslog notifications checkbox during the Additional configuration step.

Note. Starting with GuardMode 2024.3, Syslog notifications follow the CEF (Common Event Format) standard.

To configure your GuardMode Agent with Syslog, you need to provide the following information:

• Application Name is the name that will be displayed in Syslog message parameters

• Hostname is the hostname or IP address of the Syslog server

• You only need to modify the Port (514 by default) value if you want to use the TLS protocol to send your GuardMode Agent notifications.

To use TLS with GuardMode Agent, you will need a TLS certificate. You also need use to change the value of Port to 6514. In the TLS certificate field, you need to provide a path to the certificate. If your certificate is untrusted, you can check the Disable certificate validation checkbox.

You can also configure GuardMode Agent with Syslog using CLI in the project's root directory:

.\Catalogic.GuardMode.Agent config add notification-provider syslog --hostname "{hostname}" --port "{port}" --validate-tls-certificate "{validate_certificate}" --tls-enabled "{use_tls}" --tls-certificate-path "{certificate_path}" --application-name "{app_name}"

Note. Make sure GuardMode Agent and the DPX Master Server are in the same network.

Finishing installation

Now the installation wizard will start the deployment of GuardMode Agent to your machine.

Once the installation is complete, you can make sure the GuardMode Agent is running by opening the Services tab of Windows Task Manager and finding a service named CatalogicGuardModeAgent with the status Running.

See also. If you want to alter audit rules after installation, see Altering Audit Rules.

If you selected the Setup DPX notifications checkbox and specified valid credentials in the DPX configuration step, a Data Security node will be added to your DPX Master Server.