Breadcrumbs

Install Agent on Windows

Last Updated: September 08, 2025

PREREQUISITES

See Environment Requirements.

Installing New Agents

  1. Download Proxy Agent Package.

    Frame 1 (20)-20250501-175147.png

    .net 8 agent When upgrading to the .NET 8 Windows agent, D3 will provide a link to the .NET 8 Windows agent for installation on the .NET 4.8 vSOC site.

  2. Click on the lab134.d3securityonline.net_d3_staging_c2_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=d1e51d8d6e83a0fc6c2e7aa58f85a92895e8897fba65bd1e6a75b2f337f27582 (2) 2-20250501-175603.png button.

    Frame 2 (16)-20250501-175505.png

  3. Click on the lab134.d3securityonline.net_d3_staging_c2_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=d1e51d8d6e83a0fc6c2e7aa58f85a92895e8897fba65bd1e6a75b2f337f27582 (3) 2-20250501-180233.png button, then store the security token for later use.

    Frame 3 (12)-20250501-180118.png

    .net 8 agent When upgrading to the .NET 8 Windows agent, generate a new security token. The previously issued token must not be reused.

  4. Unzip the downloaded installation package.

  5. Ensure that the .zip file is 170+ MB in size, and is unblocked by security.

READER NOTE *

  • If the .zip file is is around 3 MB, please see the Troubleshooting section.

  • If blocked, unzipped files may remain locked, preventing successful installation.

    • Right-click the file, check its properties, and unblock it if applicable.

      Frame 4 (12)-20250501-181116.png

  1. Right click and run the D3PlaybookAgentInstaller executable as an administrator.

    Frame 5 (20)-20250501-183515.png

  2. Click on the Next button in the Agent Installation Wizard.

    Frame 6 (9)-20250501-183937.png

  3. Select the agent folder, then click on the Next button.

    Frame 7 (13)-20250501-184322.png

    .net 8 agent When upgrading to the .NET 8 Windows agent, the installation directory must be set to a new, unique folder. For example, change the ending directory from ...\D3PlaybookAgent to ...\D3PlaybookAgentN8.

  4. Input the required fields, then click on the Next button.

    Frame 11 (6)-20250501-192744.png

    1. Server URL – The URL of the server hosting the vSOC instance, ending with /VSOC.
      .net 8 agent When upgrading to the .NET 8 Windows agent, the Server URL is reused.

    2. Security Token – The token generated in step 3.

    3. Agent Service Name – The internal service name under which the agent runs. This name is used for identifying the agent process on the host machine.
      .net 8 agent When upgrading to the .NET 8 Windows agent, the Agent Service Name must be configured as a unique value. The service name acts as the unique identifier for a Windows service, and duplicating it would cause conflicts and block proper agent registration.

    4. Agent Name – The display name of the agent that will appear in the Agent Management sub-module of D3 vSOC.
      .net 8 agent When upgrading to the .NET 8 Windows agent, assign a unique agent name that distinguishes it from the previous .NET 4.8 agent.

  5. Allow installation to complete. This process may take a couple minutes. See the Troubleshooting section if the install does not complete.

    image 8 (2)-20250501-190458.png

  6. Click on the Finish button.

    Frame 9 (7)-20250501-191026.png

    .net 8 agent After installing the .NET 8 Windows agent, add it to all integration connections—in the Connections or Integrations modules, under the Agent Name field—that are using the .NET 4.8 Windows agent. During a later .NET 8 vSOC upgrade, the agent will be switched over automatically.

  7. Press Ctrl + Alt + Esc, then click on Task Manager > Services to verify that the agent service (established in step 9c) is running.

    Frame 10 (10)-20250501-192415.png

  8. Verify that the agent, as named in step 9d, appears in the Agent Management sub-module of D3 vSOC and displays a status of lab134.d3securityonline.net_d3_staging_c2_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=d1e51d8d6e83a0fc6c2e7aa58f85a92895e8897fba65bd1e6a75b2f337f27582 (4) 3-20250501-193953.png .

    Frame 12 (6)-20250501-193654.png
Checking Connection Status Logs

Check the the connection status logs at

  • C:\Program Files\D3security\D3PlaybookAgent\log\D3PlaybookAgent.log or

  • C:\Program Files (x86)\D3security\D3PlaybookAgent\log\D3PlaybookAgent.log

How to Configure Internet Proxy Settings

In some environments, the D3 Proxy Agent can NOT access the Internet directly, it has to access the Internet via a Proxy server.

Edit the D3PlaybookAgent.exe.config file, add Proxy setting as follows:

C:\Program Files (x86)\D3Security\D3PlaybookAgent14\D3PlaybookAgent.exe.config

Add proxy configuration between <system.net>..... </system.net> shown below.

att_32_for_15007789.png

READER NOTE

This example set the proxy server IP 192.168.1.10, port 3128

All local IP addresses 192.168.xxx.xxx are bypassed.

Troubleshooting

Package Download Unsuccessful

Agent Key

Download PlaybookAgent from vSOC GUI. The file size of D3PlaybookAgentInstaller14.0.xxx.x.zip should be at least 170MB or larger which includes the Python package. If the download does NOT include the Python package, its size may be around 3MB and requires troubleshooting.

On DB Server, in SSMS (SQL Server Management Studio), right click the database, run new query

  1. Run the following command to check if the Proxy Agent key exists or not.

    SQL
    SELECT *
FROM vSOC_Settings_Default
WHERE keyname LIKE 'Cyber.PythonInstallationFolderForPlaybookAgent';

  2. If the PlaybookAgent key does not exist, run the insert command to add it to the database.

    SQL
    INSERT INTO vSOC_Settings_Default (keyName, keyValue)
VALUES ('Cyber.PythonInstallationFolderForPlaybookAgent', 'C:\Python\Python38');

  3. Run the update command to update the key value.

    SQL
    UPDATE vSOC_Settings_Default
SET keyValue = 'C:\Python\Python38'
WHERE keyname LIKE 'Cyber.PythonInstallationFolderForPlaybookAgent';

READER NOTE *

C:\Python\Python38 is an example here.

It is the Python path on your vSOC server. Change it to your Python path where Python.exe resides.

  1. After updating the key into the Database, stop D3TaskManager services, stop App Pool, then restart the services and App Pool again.

  2. Delete Agent folder under C:\D3App\D3Temp\Agent or C:\D3App\Virtual_Dir\D3Temp\Agent
    See examples below. Your D3App folder may be on other disks like D:\ or E:\ as well.

    att_10_for_15007789.png
    att_23_for_15007789.png
No File Downloaded

When attempting to download the Agent, sometimes no file is downloaded. In this case, check your D3Temp directory properties. Make sure users have full control so the Agent software can be written into this folder.

  1. Set users with full control.

    att_11_for_15007789.png

  2. Go to vSOC to download the agent again. The correct zipped installation package size should be at least 170MB or larger.

READER NOTE *

If user vSOC was updated to a new version, you need to download and update your Proxy agent accordingly.
The Proxy Agent version should match the vSOC version.

  1. Download new Proxy Agent and install

READER NOTE *

You can install multiple Proxy Agents, each with a different Security Token.

Agent Installation Not Completing

If the installation stalls and does not complete, the root cause is that the Playbook Installation package was blocked by Windows when downloading from vSOC servers.

att_24_for_15007789.png

  1. Go to the .zip file and view Properties.

  2. Check the Unblock box before unzipping the file. Even if the file is able to unzip successfully without this permission, some files will still be blocked by Windows. Ensure that this is checked before proceeding.

    att_25_for_15007789.png

  3. Run the installation again.