Installing Linux Agents Using a Golden Image

Follow the steps in this section to install the agent software on your Linux endpoint using a master or golden image.

To create a master or golden image to install the agent software on your Linux endpoint:

Open a Terminal session on the Linux endpoint that you used to download the Linux agent installation package in Downloading an Agent Installation Package from the Web UI.
username@localhost:~$
Use the cd command to change to the FireEye directory you created in step 5 of Downloading an Agent Installation Package from the Web UI.
username@localhost:~$ cd desktop
username@localhost:~/Desktop$ cd FireEye
Use the tar zxf command to unzip the Linux agent installation image .tgz file:
username@localhost:~/Desktop/FireEye$ tar zxf IMAGE_HX_AGENT_LINUX_[xAgent version].tgz.
The .zip file (Linux) includes the agent .rpm files (xagt-[xAgent version]-1.el6.x86_64.rpm and xagt-[xAgent version]-1.el7.x86_64.rpm), and the agent configuration file (agent_config.json).
Run the rpm file that corresponds to your Linux OS.
username@localhost:~/Desktop/FireEye$ sudo rpm -ihv xagt_dev-[xAgent version]-1.el6.x86_64.rpm
Import the Agent configuration file on a master or golden image.
username@localhost:~/Desktop/FireEye$ sudo /opt/fireeye/bin/xagt -i ./agent_config.json
When the golden or master image is created using this installation method, the agent service remains stopped. The agent service will only start if you manually start it or if you restart your system. This allows unique agent IDs to be created for each endpoint on which the golden or master image is deployed.

Since the agent service starts on the next system boot, you should install the TrellixxAgent as the last step before preparing the final image.

You can use the master or golden image to deploy the agent to your Linux endpoints. If you reboot your golden image to update it, then you must uninstall the agent and use the above steps to reinstall it.