Press CTRL+K to open search

Modifying the configuration file for a single endpoint

  • Published on Sep 8, 2026
  • 3 minute(s) read
Prev Next
Skip to main content

This procedure explains how to modify and apply the agent_config.json configuration file for an individual agent on a single endpoint.

Important

Trellix Endpoint Security (HX) xAgent version 26.21.x introduces support for the sc control parameter paramchange in Windows environments. When the Trellix Endpoint Security (HX) xAgent configuration file is manually modified, this command notifies the agent of the change and generates a restart of the agent service if it is required.

To modify and apply the agent_config.json file for a single endpoint:

  1. Verify that you are logged in as an administrator of the machine on which the agent is installed.

  2. On the command line, navigate to the version agent installation directory where the xagt.exe file is stored. The default location is %ProgramFiles%\FireEye\xagt\ (32-bit environments) or %ProgramFiles(x86)%\FireEye\xagt\ (64-bit environments).

  3. Export the agent_config.json file from the agent database:

    xagt -x agent_config.json

  4. Using a text editor, modify the configuration file to disable the dynamic update of the configuration file from the Endpoint Security (HX) server. To do this, change the config_pull_enabled key to false in the configuration file. If you fail to do this, any changes you make to the agent_config.json file will be overwritten the next time the configuration file is dynamically updated.

  5. Make other changes (as needed) based on the instructions in the rest of this documentation.

  6. When all changes have been made, run the file through a JSON validator to ensure that the JSON code is valid.

  7. When the file has been validated, save it.

    Caution

    Saving the agent_config.json file in a format other than UTF-8 is not supported.

  8. Import the agent_config.json file back to the agent database:

    xagt -i agent_config.json

  9. Restart the agent.

    sc control xagt paramchange

Host Sets in Multiple Channels

A host set can be specified in multiple custom configuration channels. However, settings in different custom configuration channels are not merged. The agent settings in the custom configuration channel with the highest priority (the lowest priority number) will be used.

For example, suppose you create multiple custom configuration channels for the same host set, each specifying an entirely different set of non-overlapping (partial) agent configuration settings. Even though the agent settings are not repeated in the configuration channels for the host set, the result will be that the configuration channel with the highest priority number (the lowest priority channel) will be ignored. The agent settings in the channel with the lowest priority number (the highest priority channel) will be used for the hosts in the host set. Any agent settings missing from that channel will use the agent default values described in Agent Configuration File Reference.

You can see custom configuration channel priorities using the GET https://HX_IP_<address>:<port_number>/hx/api/v3/host_policies/channels API endpoint.

:
Related articles
  • Using API Custom Configuration Channels
    Endpoint Security Agent (HX) > Endpoint Security Agent (HX) 35 Administrator Guide > Appendices > Modifying xAgent configuration settings
  • Host Sets in Multiple Channels
    Endpoint Security Agent (HX) > Endpoint Security Agent (HX) 36 Administrator Guide > Appendices > Modifying xAgent configuration settings > Modifying the configuration file for a single endpoint
  • Creating a custom configuration channel
    Endpoint Security Agent (HX) > Endpoint Security Agent (HX) 36 Administrator Guide > Appendices > Modifying xAgent configuration settings > Using API Custom Configuration Channels