AgentX Manager
AgentX Manager is the centralized management component for AgentX,
operating directly from Logpoint SIEM. It manages communication
with all deployed AgentX clients and provides a unified platform
to monitor endpoint activity, analyze security events, and coordinate
threat detection and response across the environment.
Key Information
-
AgentX Manager v1.9.0 is compatible with Logpoint v7.9.0, AgentX Server v1.8.0, AgentXKB v1.6.0, and AgentX Windows Client and Linux Client v1.7.0 or v1.8.0.
-
Upgrading to AgentX Manager v1.9.0 requires upgrading AgentX Server to v1.8.0. AgentX Manager and AgentX Server must be upgraded together to maintain compatibility. Upgrade AgentX Server before upgrading clients to avoid compatibility issues.
Enhancements
EDR-3877
Wazuh Upgrade
AgentX now uses Wazuh version 4.14.4. This upgrade improves stability and performance, includes the latest security and vulnerability fixes, and provides access to newer Wazuh capabilities for a more secure and reliable customer experience.
EDR-1512
NAT support for static 1:1 NAT environments
You can now use AgentX in supported static 1:1 NAT environments by registering the agent with the public IP address seen by Logpoint. This allows Logpoint to match the agent to the correct device when that device is configured with its public IP, helping configuration push and template synchronization work reliably.Bug Fixes
EDR-3480
In some cases, after changing device IP addresses for existing agents in a clustered setup, agents experienced frequent restarts and were assigned incorrect templates.
EDR-3371
Templates were not synced to Windows collectors configured via
LPC after upgrading AgentX Manager and Server to v1.7.0.
EDR-3127
In some cases, AgentX server cluster process memory usage could
increase over time until system memory was exhausted.
Past Releases
AgentX Manager v1.8.0▾
Enhancement
Expanded the audit logging coverage for the following:
- Distributed Mode Operations: Added logging for switching between distributed and standalone modes, cluster setup, and related configuration updates. All cluster-related actions are now fully traceable.
- AgentX Migration and Rollback: Added logging for migrations from Logpoint Agent to AgentX and rollbacks from AgentX to Logpoint Agent. Each log entry includes operation status and agent details for improved tracking.
- Certificate Actions: Added logging for certificate generation, upload, and download. Each action includes user, timestamp, and outcome details for complete visibility.
Bug Fixes
EDR-3291
In Logpoint v7.7.0, agents configured with hostnames
and dynamic IPs did not display template details,
including the template name, sources, and last
configuration update, in the UI.
EDR-1795
Agents in a cluster setup had frequent restarts,
high CPU usage, and log loss due to conflicting
configuration updates.
EDR-1549
When searching or sorting by sources on the AgentX
Manager Templates page, the page displayed the
"Logpoint Not Accessible" message instead of displaying data.
AgentX Manager v1.7.0▾
Bug Fixes
EDR-1404
If the agent settings were not updated, they
continued using the default settings that lacked
the required label field. As a result, the agents
forwarded logs without labels, leading AgentX
to reject those logs.
EDR-2626
Users could not access the Agents list
because AgentX servers were overloaded while
populating agent information, resulting in frequent
delays and timeouts.
EDR-2179
When AgentX was used with an LPC, saving
a template on Logpoint
Collector displayed a misleading warning
about pending encryption/decryption.
EDR-1533, EDR-1901, EDR-1870
The AgentX dashboard displayed only 200 agents
due to a pagination limitation, restricting visibility
to all agents.
EDR-2140
The Last Config Update displayed
time in UTC, regardless of the timezone
selected in User Preferences.
EDR-2964
AgentX Manager couldn’t add or remove devices
in bulk in distributed environments with
many agents.
EDR-2971
In a distributed environment, AgentX certificates could
not be generated or downloaded from other remote
Logpoints.
EDR-3052, EDR-3087
When users silently upgraded the Windows client,
the manager’s IP address was reset to 0.0.0.0.
EDR-2979
Migration from Logpoint Agent to
AgentX failed if a template with an
identical name already existed in both LPA and
AgentX.
EDR-2682
The default registry monitoring parameters had
a high recursion depth, which caused locks during
deep scans and blocked monitoring of File Integrity Scanner and
other modules until the scans were completed.
EDR-3050
In some cases, the installation of OS Query failed if other
packages were still being installed.
EDR-2628
In environments with a high number of agents,
AgentX Manager repeatedly checked agent availability,
leading to API request overload and resulting
in frequent timeouts and delays.
EDR-2165, EDR-2634
OSQuery logs were duplicated, increasing the
risk of disk space exhaustion.
EDR-3178, EDR-3168
Log collection stopped because newly created
templates failed to deploy to LPC-connected devices.
Key Information
- Upgrade the AgentX Server before updating the AgentX Manager to maintain compatibility. Additionally, update the AgentX Windows and Debian installers to v1.7.0 to prevent log loss.
- If OSQuery is not installed during the AgentX Client installation and later enabled in a template, AgentX will monitor non-existent files, resulting in warning log messages. To prevent this, make sure OSQuery is installed before using it in a template.
- Users should not change the installation directory from the previous installed directory when upgrading to AgentX v1.7.0 through the Command Line Interface.
AgentX Manager v1.6.0▾
Enhancements
EDR-2869
Four new pre-configured templates are
introduced:
- vendor_template_default_windows: Fetches Windows event log, file collection, file integrity scanner, and registry scanner.
- vendor_template_linux: Fetches Debian Linux’s file collection.
- vendor_template_minimal_windows: Fetches Windows event log and file collection logs.
-
vendor_template_baseline_windows_workstation:
Fetches Windows logs from the following
sources:
- Security
- Application
- System
- PowerShell
- Sysmon
- Microsoft Defender
EDR-2909
API calls made by AgentX Manager to check agent
availability are optimized, reducing timeouts
and improving performance.
Bug Fixes
EDR-2624
Agent settings were redundantly updated every
time AgentX configurations were changed, causing
excessive disk usage, frequent timeouts, and
performance delays.
EDR-2688
In distributed mode,
saving a default template without
making changes caused the template settings to
change, frequently restarting agents and stopping
log collection.
EDR-2869, EDR-1977
Changes made to default templates were
lost after upgrading AgentX Manager to v1.5.0,
stopping log collection.
EDR-2874
Upgrading AgentX Server to v1.5.0 caused agents
to disconnect from distributed mode, stopping
log collection.
EDR-2806
Creating a custom SSL certificate caused
agents to be unassigned from their device groups
temporarily, leading to log loss until they were
reassigned.
Key Information:
- Upgrade AgentX Manager to v1.5.0 before upgrading to v1.6.0 to prevent errors during upgrade.
- After upgrading AgentX Manager to v1.6.0, upgrade AgentX Server to v1.6.0 to ensure that agents do not disconnect from distributed mode.
- In File integrity scanner or File Collection, use the short-name of files in the file path for files with commas in their names. See Known Issues for more details.
- After upgrading to v1.6.0, refresh the browser to see the UI changes.
- AgentX no longer provides active support and maintenance for AgentX Manager versions older than v1.4.6.
Comments
Article is closed for comments.