AgentX Manager
AgentX Manager is the centralized management component for AgentX, operating directly from Logpoint SIEM. It manages communication with all deployed AgentX clients and provides a unified platform to monitor endpoint activity, analyze security events, and coordinate threat detection and response across the environment.
Key Information
- AgentX Manager v1.9.1 is compatible with Logpoint v7.9.0 or later, AgentX Server v1.8.0, AgentXKB v1.6.0, and AgentX Windows Client and Linux Client v1.7.0 or v1.8.0.
- Upgrading to AgentX Manager v1.9.1 requires upgrading AgentX Server to v1.8.0. AgentX Manager and AgentX Server must be upgraded together to maintain compatibility. Upgrade AgentX Server before upgrading clients to avoid compatibility issues.
Bug Fixes
EDR-4049
The AgentX management page could take a long time to load, or fail to load, on systems with a large number of agents.
EDR-4165
Newly added agents were sometimes not enrolled into their groups, so their logs weren't collected, on systems with a large number of agents.
Past Releases
AgentX Manager v1.9.0 ▾
Enhancements
EDR-3877
Wazuh Upgrade
AgentX now uses Wazuh version 4.14.4. This upgrade improves stability and performance, includes the latest security and vulnerability fixes, and provides access to newer Wazuh capabilities for a more secure and reliable customer experience.
EDR-1512
NAT support for static 1:1 NAT environments
You can now use AgentX in supported static 1:1 NAT environments by registering the agent with the public IP address seen by Logpoint. This allows Logpoint to match the agent to the correct device when that device is configured with its public IP, helping configuration push and template synchronization work reliably.Bug Fixes
EDR-3480
In some cases, after changing device IP addresses for existing agents in a clustered setup, agents experienced frequent restarts and were assigned incorrect templates.
EDR-3371
Templates were not synced to Windows collectors configured via LPC after upgrading AgentX Manager and Server to v1.7.0.
EDR-3127
In some cases, AgentX server cluster process memory usage could increase over time until system memory was exhausted.
AgentX Manager v1.8.0 ▾
Enhancement
Expanded the audit logging coverage for the following:
- Distributed Mode Operations: Added logging for switching between distributed and standalone modes, cluster setup, and related configuration updates. All cluster-related actions are now fully traceable.
- AgentX Migration and Rollback: Added logging for migrations from Logpoint Agent to AgentX and rollbacks from AgentX to Logpoint Agent. Each log entry includes operation status and agent details for improved tracking.
- Certificate Actions: Added logging for certificate generation, upload, and download. Each action includes user, timestamp, and outcome details for complete visibility.
Bug Fixes
EDR-3291
In Logpoint v7.7.0, agents configured with hostnames and dynamic IPs did not display template details, including the template name, sources, and last configuration update, in the UI.
EDR-1795
Agents in a cluster setup had frequent restarts, high CPU usage, and log loss due to conflicting configuration updates.
EDR-1549
When searching or sorting by sources on the AgentX Manager Templates page, the page displayed the "Logpoint Not Accessible" message instead of displaying data.
AgentX Manager v1.7.0 ▾
Bug Fixes
EDR-1404
If the agent settings were not updated, they continued using the default settings that lacked the required label field. As a result, the agents forwarded logs without labels, leading AgentX to reject those logs.
EDR-2626
Users could not access the Agents list because AgentX servers were overloaded while populating agent information, resulting in frequent delays and timeouts.
EDR-2179
When AgentX was used with an LPC, saving a template on Logpoint Collector displayed a misleading warning about pending encryption/decryption.
EDR-1533, EDR-1901, EDR-1870
The AgentX dashboard displayed only 200 agents due to a pagination limitation, restricting visibility to all agents.
EDR-2140
The Last Config Update displayed time in UTC, regardless of the timezone selected in User Preferences.
EDR-2964
AgentX Manager couldn’t add or remove devices in bulk in distributed environments with many agents.
EDR-2971
In a distributed environment, AgentX certificates could not be generated or downloaded from other remote Logpoints.
EDR-3052, EDR-3087
When users silently upgraded the Windows client, the manager’s IP address was reset to 0.0.0.0.
EDR-2979
Migration from Logpoint Agent to AgentX failed if a template with an identical name already existed in both LPA and AgentX.
EDR-2682
The default registry monitoring parameters had a high recursion depth, which caused locks during deep scans and blocked monitoring of File Integrity Scanner and other modules until the scans were completed.
EDR-3050
In some cases, the installation of OS Query failed if other packages were still being installed.
EDR-2628
In environments with a high number of agents, AgentX Manager repeatedly checked agent availability, leading to API request overload and resulting in frequent timeouts and delays.
EDR-2165, EDR-2634
OSQuery logs were duplicated, increasing the risk of disk space exhaustion.
EDR-3178, EDR-3168
Log collection stopped because newly created templates failed to deploy to LPC-connected devices.
Key Information
- Upgrade the AgentX Server before updating the AgentX Manager to maintain compatibility. Additionally, update the AgentX Windows and Debian installers to v1.7.0 to prevent log loss.
- If OSQuery is not installed during the AgentX Client installation and later enabled in a template, AgentX will monitor non-existent files, resulting in warning log messages. To prevent this, make sure OSQuery is installed before using it in a template.
- Users should not change the installation directory from the previous installed directory when upgrading to AgentX v1.7.0 through the Command Line Interface.
AgentX Manager v1.6.0 ▾
Enhancements
EDR-2869
Four new pre-configured templates are introduced:
- vendor_template_default_windows: Fetches Windows event log, file collection, file integrity scanner, and registry scanner.
- vendor_template_linux: Fetches Debian Linux’s file collection.
- vendor_template_minimal_windows: Fetches Windows event log and file collection logs.
-
vendor_template_baseline_windows_workstation: Fetches Windows logs from the following sources:
- Security
- Application
- System
- PowerShell
- Sysmon
- Microsoft Defender
EDR-2909
API calls made by AgentX Manager to check agent availability are optimized, reducing timeouts and improving performance.
Bug Fixes
EDR-2624
Agent settings were redundantly updated every time AgentX configurations were changed, causing excessive disk usage, frequent timeouts, and performance delays.
EDR-2688
In distributed mode, saving a default template without making changes caused the template settings to change, frequently restarting agents and stopping log collection.
EDR-2869, EDR-1977
Changes made to default templates were lost after upgrading AgentX Manager to v1.5.0, stopping log collection.
EDR-2874
Upgrading AgentX Server to v1.5.0 caused agents to disconnect from distributed mode, stopping log collection.
EDR-2806
Creating a custom SSL certificate caused agents to be unassigned from their device groups temporarily, leading to log loss until they were reassigned.
Key Information:
- Upgrade AgentX Manager to v1.5.0 before upgrading to v1.6.0 to prevent errors during upgrade.
- After upgrading AgentX Manager to v1.6.0, upgrade AgentX Server to v1.6.0 to ensure that agents do not disconnect from distributed mode.
- In File integrity scanner or File Collection, use the short-name of files in the file path for files with commas in their names. See Known Issues for more details.
- After upgrading to v1.6.0, refresh the browser to see the UI changes.
- AgentX no longer provides active support and maintenance for AgentX Manager versions older than v1.4.6.
Comments
Article is closed for comments.