SIEM Agent Deployment Guide

Most Popular Deployment Tool option for Admins

We currently assume Windows Admins prefer the Group Policy deployment option. Future supported deployment options include ServiceNow and JAMF.

Deployment Process

1. Admin sets up a SIEM. Azure Sentinel, ELK, QRadar or Splunk

2. They set up a ChainKit account through their Portal.

3. From their secure portal, they get a private endpoint for downloading hardened configurations. This is used to glue SIEM and Agent policies. They also get a clientKey which is secret and only shown to the administrator.

4. First, a Smoke Test / Tryout.

   • Smoke Test/Tryout
     Download agent from https://download.chainkit.com/
     or only from within the portal:
     https://customer-url-hardening.chainkit.com/download?key=clientId
   • We give a MSI file or EXE file. MSIs are preferred for group deployment.

   msiexec /i "Setup-Chainkit-SIEM-20211201-598327853289057.msi" /quiet
   WRAPPED_ARGUMENTS="/SETUP_URL=http://customer-url-hardening.chainkit.com/download?key=clientId”

   • Dotnet Service is created: Chainkit-SIEM-20211201-598327853289057
   • Start/Stop - Use EDR best practises
   • Admin Deployment
     • Setup Group Policy running MSIExec
       A sample guide for MSIExec is here: Deploy Lansweeper Agent

5. Mass deployment/update/patch process:

   • Admin downloads new Chainkit-SIEM-20220401-fabcde3522523532.msi
   • Setup Group Policy to Stop Service
   • Run

   msiexec /i "Setup-Chainkit-SIEM-20220401-fabcde3522523532.msi"
           /quiet WRAPPED_ARGUMENTS="/SETUP_URL=http://customer-url-hardening.chainkit.com/download?key=clientId"

   • MSI uploads new binaries, creates a new service item (versioned) and starts.
   • Admin uninstalls old service agent.