Upgrade Agents

You can use one of the following methods to upgrade Endpoint agents. Select a method based on your current Endpoint agent version. If you have upgraded the endpoint server recently, you must restart it to see Upgrade Selected Agent and Upgrade All Agents options on the UI.

Upgrading 11.5.1 or Later Agents Versions Using UI

Note: To upgrade agent from UI, ensure the service user account has both endpoint-server.agentupdate.manage and endpoint-server.ca.manage permissions. For more information on how to assign roles and permissions, see "Add a Role and Assign Permissions" in the System Security and User Management Guide.

From 11.6, you can upgrade the Endpoint agents using the UI. Agent version must be 11.5.1 or later to upgrade using the UI.

You can upgrade agents using UI by going to Hosts and performing one of the following options.

Upgrade one or more agents from Hosts view

    1. Select one or more hosts and select More Actions > Upgrade Selected Agent

12.2_endpoint_UpgAgnts_1122.png

    1. In the Upgrade Agent dialog, click Upgrade.

netwitness_upgagntpp.png

Upgrade all agents from Hosts view

    1. Select More Actions > Upgrade All Agents from the toolbar, to perform bulk agent upgrade.

Note: For the upgrade all agents option, you do not need to select the hosts. Upgrade All Agents / Uninstall All Agents are the default options on the More Actions drop-down. When you select one or more hosts, the More Actions drop-down shows Upgrade Selected Agent / Uninstall Selected Agent as the available options.

12.2_endpoint_UpgAll_1122.png

  1. In the Upgrade All Agents dialog, click Upgrade.

    netwitness_upgallpp.png

    Note: Upgrade All Agents process will require more time to complete, depending upon the number of agents selected based on the filters applied.

Upgrade an agent from Hosts details page

  • Select the hostname to open the host details, click netwitness_moreicon.png (More Actions) beside the hostname, and select Upgrade Agent.
    12.2_endpoint_Upgrdagnt_hostdetails_1122.png
  1. In the Upgrade Agent dialog, click Upgrade.

Note: To upgrade an agent using UI, the agent must be a managed agent with version 11.5.1 or later.

The following upgrade status icons are displayed in the Agent Version column.

Icons Upgrade Status Description
netwitness_available_icon_35x30.png Upgrade Available An agent upgrade is available.
netwitness_pending_icon_28x34.png Agent Upgrade Pending The agent has not yet received the upgrade command.
netwitness_upgrading_icon_29x29.png In Progress The agent is being upgraded.
netwitness_failed_icon_30x31.png Failed Agent upgrade failed. View details in the agent history page.
No Icon No Upgrade Available No upgrade available for the agent. Refer to agent eligibility.

You can view the list of commands issued to the agents (by the server or actions performed by any analyst) in the Host view and Host details. By default, commands are sorted based on the command time.

To view the commands:

  1. Go to Hosts.
  2. Do any one of the following,
    • To view all commands, click netwitness_hisicon_30x32.png. You can also filter commands.
      The Agent History view is displayed.
    • To view commands specific to a particular host:
      • Click the host for which you want to view the commands.
      • In the Host details view, click History tab. You can also filter commands.
        The History view is displayed.

For more information on Agent History, see the "Investigating Hosts" topic in the NetWitness Endpoint User Guide.

Upgrading 11.3.x or Later Agents Versions

You can upgrade the 11.3.x and later versions of Endpoint agent to 11.6 or later.

Note: In a multi-server Endpoint deployment, during an agent upgrade, make sure that the correct Endpoint server is mentioned in the respective agent policy. In case the agent uses the default policy, ensure to use the agent packager downloaded from the respective Endpoint server to which it is communicating. Using Agent packager from different Endpoint server for agent upgrade will result in migrating the agents to another Endpoint server.

Note: For a subsequent installation or upgrade, use the same service and driver service name.

To upgrade from 11.3.x and later, download the 11.6 agent packager, deploy and verify agents. For more information, see Generate an Endpoint Agent Packager and Deploy and Verify Endpoint Agents.

Upgrade from 4.4.0.9 and 4.4.1.x is supported only for version 11.3. For more information, see NetWitness Endpoint 4.4.1.x to NetWitness Platform 11.3 Migration Guide.

To upgrade an agent from 4.4.0.x to 11.6, uninstall the agent and perform a fresh installation.