Skip to main content

Installing The Linux Cerulean Agent

Updated

A step-by-step guide to installing and managing the Cerulean Agent on your Linux operating systems.

Overview

The Cerulean Agent provides automated data collection and configuration services for your end points and lays the framework for AgileBlue's autonomous response capabilities. The Cerulean Agent includes several enhancements and remote support capabilities not included in previous AgileBlue Management Agent versions.

Relevant Agent Versions

This guide covers the installation process for the Cerulean Agent, starting with version 2304.3.2.

For questions regarding installation of previous AgileBlue Agent versions, click here.

Supported Operating Systems

The Cerulean Agent supports the following Linux operating systems:

  • Linux Kernel 2.6.23 64bit and newer 

Please note, Systemd must be installed and functional on all Linux machines in order to run the Cerulean Agent.

Minimum System Requirements

The agent is specially designed to use minimal system resources; the requirements for the agent are simply that of the operating system installed. Special consideration should be made on virtual machine infrastructure such that the actual allocation of resources meets the operating system / user load requirements. Specifically, shared computing environments such as VDI desktops or Terminal Server / Services should have adequate resources to handle the user load. (E.g. enough physical resources that each user has sufficient resources allocated to their session.) AgileBlue cannot guarantee the complete functionality of the agent if resources do not meet recommended levels.

Networking Requirements

The Cerulean Agent, and its associated data collection services, securely sends data over the internet to the AgileBlue Cloud. To allow this, the following ports should be configured for outbound traffic on all devices and environment firewalls, routers, etc.

  • TCP Outbound Port 443
  • TCP Outbound Port 9243

Additionally, the Cerulean Agent will install the Elastic Agent, which requires the following TCP ports to be available:

  • 6791/HTTP
    • This port is leveraged for performance monitoring of the Elastic Agent
  • 6789/GCRP
    • Used for management of the Elastic Agent

Any endpoint receiving the Cerulean Agent must also be able to reach the following domains for full functionality:

  • agentapi.agileblue.com
  • data.agileblue.com
  • response.agileblue.com
  • artifacts.security.elastic.co

Anti-Virus Configuration

The Cerulean Agent performs administrative actions on your devices that some anti-virus systems may identify as malicious. To prevent anti-virus systems from quarantining or otherwise impeding the agent from performing its responsibilities, please be sure to whitelist the related files and services.

  • /usr/local/cerulean/*
  • /usr/bin/elastic-agent
  • /opt/Elastic/*

Download the Installer

When downloading the Cerulean Agent installer, you will receive a ZIP file containing two files: linux_installer3 and config.json. Both items will important for the installation process.

  1. Open a web browser and navigate to the AgileBlue Portal
  2. Select Agent from the management section of the navigation menu

    Screenshot 2024-03-11 at 1.29.58 PM-1
  3. Click on the Linux Agent Installer tile

    Linux-1
     
  4. Take note of the API Key provided on the corresponding pop-up

    Linux-Popup-png

Grant Executable Privileges

Before installing the agent, you'll need to convert the installer downloaded in the previous section into an executable.

  1. Extract the required files from the .zip downloaded in the previous section
  2. Navigate to the directory containing the files via Terminal and run the following command:
chmod +x linux_installer3

Install the Agent

The Cerulean Agent can be installed locally on your Linux machine via Terminal or deployed via your RMM. This section covers local installations.

  1. In the Terminal window, navigate to the directory containing your installer
  2. If the config.json file is in the same directory, run the following command
    1. sudo ./linux_installer3 install
  3. Alternatively, if you do not store the config file in the same directory, you can run the full install command below
    1. sudo ./linux_installer3 -a YOURAPIKEYHERE -u https://agentapi.agileblue.com install

Confirm Installation Success

There are a couple of different methods to confirm the installation of the agent. Most importantly, you will want to verify that the following services are present on the machine:

  • Cerulean Agent
  • Cerulean Updater
  • Elastic Agent
  • Elastic Endpoint

Manage Your Installation

In addition to the installation commands above, the Cerulean Agent has several helpful built-in options available to you as well. When operating with sudo privileges in Terminal, you can utilize the following commands and flags to achieve the listed actions. Additionally, you can add the command help to see these commands during the installation, uninstallation, or troubleshooting processes:

sudo ./linux_installer3 help

Available General Commands:
 

  • help
    • Help about any command
  • install
    • Installs the Cerulean Agent onto the system
  • repair
    • Repair a Cerulean Agent installation
  • uninstall
    • Uninstalls the Cerulean Agent

Available Flags:

  • -h
    • help for windows_installer3.exe
  • -v
    • Verbose output
  • -i
    • Places agent into image mode, ment for Golden Image usage
  • -s
    • Places agent into syslog mode

Agent Deployment

If you are leveraging an RMM for deployment of the Cerulean Agent, utilize the following command:

sudo ./linux_installer3 install -a YOURAPIKEYHERE -u https://agentapi.agileblue.com

Questions? Contact AgileBlue Support. 

Email: support@agileblue.com 
Phone: (216) 606-9400🚨