Agent Installation on Windows

LAST UPDATED: MAY 1, 2025

Proxy Agent Installation on Windows

Environment Requirement

Server Hardware Requirements

Operating System

Firewall Ports

Please Note:

1. The server for D3 Proxy Agent must be able to communicate with D3 vSOC servers via TCP ports 443.

2. D3 Proxy Agent must be installed on servers that have direct access to all your internal resources, such as firewalls, SIEM, Exchange, etc.

3. If Web Proxy is enabled in your network environment, Web Proxy IP needs to be configured in the D3PlaybookAgent.exe.config during the installation. See How to Configure Internet Proxy Settings).

Installing New Agents

1. Download Proxy Agent Package.

   

2. Click on the button.

   

3. Click on the button, then store the security token for later use.

   

4. Unzip the downloaded installation package.

5. Ensure that the .zip file is 170+ MB in size, and is unblocked by security.

READER NOTE *

• If the .zip file is is around 3 MB, please see the Troubleshooting section.

• If blocked, unzipped files may remain locked, preventing successful installation.

  • Right-click the file, check its properties, and unblock it if applicable.

    

6. Right click and run the D3PlaybookAgentInstaller executable as an administrator.

   

7. Click on the Next button in the Agent Installation Wizard.

   

8. Select the agent folder, then click on the Next button.

   

9. Input the required fields, then click on the Next button.

   

   1. Server URL – The URL of the server hosting the vSOC instance, ending with /VSOC.

   2. Security Token – The token generated in step 3.

   3. Agent Service Name – The internal service name under which the agent runs. This name is used for identifying the agent process on the host machine.

   4. Agent Name – The display name of the agent that will appear in the Agent Management sub-module of D3 vSOC.

10. Allow installation to complete. This process may take a couple minutes. See the Troubleshooting section if the install does not complete.

    

11. Click on the Finish button.

    

12. Press Ctrl + Alt + Delete, then click on Task Manager > Services to verify that the agent service (established in step 9c) is running.

    

13. Verify that the agent, as named in step 9d, appears in the Agent Management sub-module of D3 vSOC and displays a status of .

    

How to Configure Internet Proxy Settings

In some environments, the D3 Proxy Agent can NOT access the Internet directly, it has to access the Internet via a Proxy server.

Edit the D3PlaybookAgent.exe.config file, add Proxy setting as follows:

C:\Program Files (x86)\D3Security\D3PlaybookAgent14\D3PlaybookAgent.exe.config

Add proxy configuration between <system.net>..... </system.net> shown below.

READER NOTE

This example set the proxy server IP 192.168.1.10, port 3128

All local IP addresses 192.168.xxx.xxx are bypassed.

Proxy Agent High Availability

Proxy Agent supports High Availability by installing multiple Proxy Agents in different servers. Each agent must use a unique Secure Token.

Example

1. Install the first Agent in \D3PlaybookAgent01 folder.

   

2. Each Agent needs a unique Security Token. Please generate the token in vSOC page.

   

3. Enter a unique Security Token, Agent Service Name and Agent Name for this Agent

   

4. Install the 2nd Agent by right clicking D3playbookAgentInstaller.exe and run as administrator. Choose Install a new agent.

   

   

5. Use a unique folder name, for example \D3PlaybookAgent02, Keep "Install Python" checked and leave the folder as it is. (That will configure the Python path for the 2nd Proxy Agent)

   

6. Use a Unique Security Token, Agent Service Name and Agent Name

   

Complete the installation.

7. After 2nd agent installation finished, you will see two folders

   

8. Check the service status in Windows Task Manager. Make sure the services are running.

   

   

9. Check the logs at C:\Program Files (x86)\D3security\D3PlaybookAgent01\log, State:Connected

   

10. Check the logs at C:\Program Files (x86)\D3security\D3PlaybookAgent02\log, State:Connected

    

11. From the vSOC Agent Management interface, both of the Proxy Agents Status should be Connected. Installation has finished and is successful.

    

Proxy Agent Windows Server Hardening

How Proxy Agent Works

In short, the Proxy Agent does NOT need incoming TCP connections. It always initiates TCP connections to vSOC server and RestfulAPI targets. So we can block all incoming connections to the Windows server where D3 Proxy Agent is running on. Just run the powershell scripts to disable all the default enabled incoming firewall rules on Windows Server.

Troubleshooting

Package download is NOT successful

Agent Key

Download PlaybookAgent from vSOC GUI. The file size of D3PlaybookAgentInstaller14.0.xxx.x.zip should be at least 170MB or larger which includes the Python package. If the download does NOT include the Python package, its size may be around 3MB and requires troubleshooting.

On DB Server, in SSMS (SQL Server Management Studio), right click the database, run new query

1. Run the following command to check if the Proxy Agent key exists or not.

select * from vSOC_Settings_Default where keyname like 'Cyber.PythonInstallationFolderForPlaybookAgent'

2. If the PlaybookAgent key does not exist, run the insert command to add it to the database.

insert into vSOC_Settings_Default (keyName, keyValue) values ('Cyber.PythonInstallationFolderForPlaybookAgent', 'C:\Python\Python38')

3. Run the update command to update the key value.

update vSOC_Settings_Default set keyValue = 'C:\Python\Python38' where keyname like 'Cyber.PythonInstallationFolderForPlaybookAgent'

READER NOTE *

C:\Python\Python38 is an example here.

It is the Python path on your vSOC server. Change it to your Python path where Python.exe resides.

4. After updating the key into the Database, stop D3TaskManager services, stop App Pool, then restart the services and App Pool again.

5. Delete Agent folder under C:\D3App\D3Temp\Agent or C:\D3App\Virtual_Dir\D3Temp\Agent
   See examples below. Your D3App folder may be on other disks like D:\ or E:\ as well.

   

   

No File Downloaded

When attempting to download the Agent, sometimes no file is downloaded. In this case, check your D3Temp directory properties. Make sure users have full control so the Agent software can be written into this folder.

1. Set users with full control.

   

2. Go to vSOC to download the agent again. The correct zipped installation package size should be at least 170MB or larger.

READER NOTE *

If user vSOC was updated to a new version, you need to download and update your Proxy agent accordingly.
The Proxy Agent version should match the vSOC version.

3. Download new Proxy Agent and install

READER NOTE *

You can install multiple Proxy Agents, each with a different Security Token.

Installing Agent Not Completing

If the installation stalls and does not complete, the root cause is that the Playbook Installation package was blocked by Windows when downloading from vSOC servers.

1. Go to the .zip file and view Properties.

2. Check the Unblock box before unzipping the file. Even if the file is able to unzip successfully without this permission, some files will still be blocked by Windows. Ensure that this is checked before proceeding.

   

3. Run the installation again.