Deploy agents using the deployment script

Procedure

1. If you want to use a custom download location, prepare the installer package first.
   1. Follow the steps for downloading the installer package in Deploy agents using the installer package.
   2. Upload the archived agent installer package to a location your endpoints can access.
      Save the full URL location of the package, including the archive file extension.

      An example URL might look like: https://sample.fileserver.us-east-1.amazonaws.com/TMSensorAgent_Windows.zip

   Important Verify your endpoint can access the custom location. If the script is unable to connect to the custom location, installation fails. The package downloaded from the custom location uses the agent installer proxy settings configured when the package was created.

2. In the TrendAI Vision One™ console, go to Endpoint Security → Endpoint Inventory.
3. Click Agent Installer.
4. For Deployment method, select Deployment script.
5. Select the Endpoint group you want to assign to the new agent.
   Selecting the endpoint group in this step determines which protection features to install.

   • Selecting a group managed by Standard Endpoint Protection installs Standard Endpoint Protection features.
   • Selecting a group managed by Server & Workload Protection installs Server & Workload Protection features.
   • Selecting the group Default for sensor installs agents with only Endpoint Sensor features.
6. Configure the operating system and initial policy settings.

   Setting		Standard Endpoint Protection	Server & Workload Protection	Sensor only
   Operating system		Setting is automatic based on the Endpoint group you select: Windows macOS	Choose from: Windows Linux	Choose from: Windows Linux macOS
   Initial policy	Group enrolled in Endpoint Security Policies	-	Use endpoint security policy assignment Agent applies the Base priority of the Endpoint Security policy assigned to the group.	-
   	Group not enrolled in Endpoint Security Policies	-	Select the Protection Manager policy to apply during installation, or select None	-
   Relay group		-	Select the relay group to assign the endpoint to, or select None	-

7. Select the Installer package download source.
   • TrendAI™: The deployment script connects to TrendAI™ services to download the latest agent installer package.
   • Custom location: The deployment script connects to a location you specify to download the agent installer package. If you choose this option, you must also specify the Installer package source URL, including the full file path.
     An example URL might look like: https://sample.fileserver.us-east-1.amazonaws.com/TMSensorAgent_Windows.zip
8. If you selected TrendAI™ for the download source, select the Agent installer proxy.
   • Direct connect: The agent installer attempts to connect directly to TrendAI Vision One™ without using a proxy.
   • Custom proxy: The agent installer attempts to connect using a user-defined proxy.
     To use this option, you must provide values the following attributes in the custom script before attempting to deploy:
     • PROXY_ADDR_PORT: The IP address or FQDN and port of the proxy server. For example: 127.0.0.1:40
     • PROXY_USERNAME: If the proxy server requires credentials, provide the username.
     • PROXY_PASSWORD: If the proxy server requires credentials, provide the password.
   • Service Gateway: The agent installer attempts to connect using a deployed Service Gateway with Forward Proxy Service enabled.
     This option requires a Service Gateway with Forward Proxy Service installed and enabled. For more information, see Deploy a Service Gateway and Configure Firewall Exceptions.

   Important The deployment script does not utilize the custom proxies defined in the Agent Installer Proxy settings. Agents adopt the Runtime Proxy settings assigned to their endpoint group after installation and registration is successfully completed.

9. To include TLS validation, select Validate TrendAI Vision One™ server TLS certificate.
   When enabled, the deployment script checks if the TrendAI Vision One™ download server is using a valid TLS certificate from a trusted certificate authority (CA). TrendAI™ recommends enabling this feature to help prevent "man in the middle" attacks.
10. To include signature validation, select Validate the signature on the agent installer.
    When enabled, the deployment script performs a digital signature check on the downloaded agent installer file. The installation process is stopped if the check fails.
11. Review and obtain the deployment script.
    Copy or download the script to your target endpoint.
    • Click the download icon () to save the script.
      For Windows deployments, the script is saved as a PowerShell script (.PS1). For Linux and macOS deployments, the script is saved as a Bash script (.SH).
    • Click the copy icon () to copy the script.
12. Run the script from the command line interface.
    Use the command which corresponds to your operating system and interface:

    • Windows
      • Command prompt: Run the command powershell.exe -File scriptname.ps1
      • PowerShell: Run the command .\scriptname.ps1
    • Linux terminal: Add the execute permission to the file and run ./scriptname.sh
    • macOS terminal: Add the execute permission to the file and run ./scriptname.sh
    The deployment script downloads the agent installer package to the endpoint and begins installation. After installation successfully completes, the agent registers to TrendAI Vision One™ and appears in the Endpoint Inventory. The agent automatically adopts any settings or policies assigned to the managing endpoint group.