ShieldLinks docs

Overview

ShieldLinks has three main parts:

• Agents run on the machines you want to protect. They collect logs, file changes, software inventory and configuration data, and send them to the server.
• The server (manager) analyses the data with detection rules, raises alerts and runs automated responses.
• The dashboard is the web interface where you see alerts, investigate events, deploy new agents and track vulnerabilities and compliance.

Requirements

The agent uses about 35 MB of RAM and very little CPU in normal operation. You need administrator (Windows) or root (Linux, macOS) rights to install it.

Network ports

Open these ports on the ShieldLinks server and in any firewall between it and your agents:

Install from the dashboard

The easiest way to install an agent is from the dashboard. Open Agents → Deploy new agent, choose the operating system and architecture, enter your server address and copy the generated command. It does the same steps as the manual commands below.

In the commands below, replace SERVER with the address of your ShieldLinks server and VERSION with the agent version shown in your dashboard.

Windows agent

Open PowerShell as Administrator and run:

$SERVER = "SERVER"
$dir    = "${env:ProgramFiles(x86)}\ossec-agent"

# 1. Download and install silently
Invoke-WebRequest -UseBasicParsing -Uri "http://${SERVER}:8088/packages/shieldlinks-agent-VERSION.exe" `
  -OutFile $env:tmp\shieldlinks-agent.exe
Start-Process -Wait -FilePath $env:tmp\shieldlinks-agent.exe -ArgumentList '/S'

# 2. Point the agent at your server
(Get-Content "$dir\ossec.conf") -replace '<address>.*</address>', "<address>$SERVER</address>" |
  Set-Content "$dir\ossec.conf"

# 3. Enrol the agent and start it
& "$dir\agent-auth.exe" -m $SERVER
NET START ShieldLinksSvc

Linux agent

Ubuntu, Debian (DEB)

curl -so shieldlinks-agent.deb http://SERVER:8088/packages/wazuh-agent_VERSION-1_amd64.deb
sudo WAZUH_MANAGER='SERVER' dpkg -i ./shieldlinks-agent.deb
sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-agent

On ARM64 machines, use wazuh-agent_VERSION-1_arm64.deb.

Red Hat, CentOS, Rocky, AlmaLinux, Amazon Linux, SUSE (RPM)

curl -so shieldlinks-agent.rpm http://SERVER:8088/packages/wazuh-agent-VERSION-1.x86_64.rpm
sudo WAZUH_MANAGER='SERVER' rpm -ihv ./shieldlinks-agent.rpm
sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-agent

On ARM64 machines, use wazuh-agent-VERSION-1.aarch64.rpm.

macOS agent

Open Terminal and run:

curl -so shieldlinks-agent.pkg http://SERVER:8088/packages/wazuh-agent-VERSION-1.intel64.pkg
echo "WAZUH_MANAGER='SERVER'" > /tmp/wazuh_envs
sudo installer -pkg ./shieldlinks-agent.pkg -target /
sudo /Library/Ossec/bin/wazuh-control start

On Apple silicon Macs (M1 and later), use wazuh-agent-VERSION-1.arm64.pkg.

A few seconds after the agent starts, it shows up as Active in the dashboard.

Manage the agent

To uninstall: on Windows, remove ShieldLinks Agent in Settings → Apps; on Debian/Ubuntu run sudo apt-get remove wazuh-agent; on RPM systems run sudo rpm -e wazuh-agent.

Troubleshooting

The agent doesn't appear in the dashboard

• Check that the machine can reach the server on ports 1514 and 1515 (Windows: Test-NetConnection SERVER -Port 1514; Linux/macOS: nc -zv SERVER 1514).
• Check that the <address> in ossec.conf is your server's address.
• Read the agent log (see the table above).

The agent shows as Disconnected

Make sure the agent service is running and that no firewall blocks port 1514 between the agent and the server. Then restart the agent.