Installation

The probe is a single executable, CyberGuard-NetworkProbe.exe, signed by Inside Technologies Srl. It installs itself with an installation code that you generate in the portal: no scripts, no configuration files.

Before you start, check the requirements and configure the probe with at least one target.

#1. Download the probe

1. Open Networking › Devices and click Download Agent.
2. Copy CyberGuard-NetworkProbe.zip to the machine where the probe will run.
3. Extract it into a folder, for example C:\Temp\NetworkProbe.

The same package works for every probe and every site: what makes a probe yours is the installation code.

#2. Generate the installation code

1. Open Networking › Devices › Configure Probe and click the configuration icon of the probe.
2. Click Generate installation code. The button is active once the probe has at least one target.
3. Copy the Code, or directly the Installation command shown below it.

The code:

• is shown only once: if you leave the page without copying it, generate a new one;
• is valid for 24 hours and for a single installation;
• contains no password or secret: it only lets one machine register as this probe.

#3. Install

On the machine, open a command prompt or PowerShell with Run as administrator, go to the folder where you extracted the package and run the command shown in the portal:

cd C:\Temp\NetworkProbe
.\CyberGuard-NetworkProbe.exe --install <installation code>

The command:

1. registers the probe with Device Inventory Manager, using the code;
2. copies itself to C:\CyberGuard\DIM-NetworkProbe;
3. installs and starts the Windows service CyberGuard Device Inventory Manager - Network Probe (service name CGDIMNetworkProbe), which runs as Local System and starts automatically with Windows;
4. removes the previous CyberGuard SNMP agent, if it was installed on the machine.

When it ends, the command returns one of these exit codes:

If the message says that the installation was interrupted after the registration, the code has already been used: generate a new one and run the command again.

You can delete the extracted folder after the installation: the probe runs from C:\CyberGuard\DIM-NetworkProbe.

#4. Check the installation

On the machine:

Get-Service CGDIMNetworkProbe

The status must be Running.

In the portal, Probe Info in Networking › Devices shows the machine name, its operating system and IP address, the probe version and its update ring. The probe receives its configuration within a minute or two and then starts the first scan; the devices appear when the scan ends. A large network can take some time.

If no device appears, see Troubleshooting.

#Automatic updates

From version 1.7.1 the probe keeps itself up to date: nothing has to be done on the machine.

• Updates are mandatory. They cannot be turned off on the machine: the update ring decides when a probe receives a new version, not whether.
• About once an hour, always between two scans, the probe asks the CyberGuard service it already sends its results to whether a new version is available. It downloads it from the same address: there is nothing new to open on the firewall.
• Before installing it, the probe checks that the new version is digitally signed by Inside Technologies Srl and refuses anything else, then test-starts it. The Windows service restarts with the new version: during an update the System event log shows event 7031 for CGDIMNetworkProbe, which is expected.
• If the new version does not work, the probe goes back to the previous one by itself and does not try that version again.

Probes older than 1.7.1 do not update themselves: update them once by hand, generating a new installation code and running the same --install command again. From then on they stay up to date.

From version 1.7.2 --install refuses a code that would replace another probe: a probe with a different identity already on this machine, or a probe that is registered on another machine. The code stays valid and nothing changes on the machine. If the replacement is intended, for example when you move a probe to a new machine, run the same command again with --replace.

#Update rings

Each probe belongs to an update ring, which decides how long after its release a new version reaches it, and at what time of day it is installed:

• The night window exists because the service restarts and a scan in progress is postponed. A machine that is never on at night (for example a workstation switched off in the evening) installs the version at the first check after 3 days.
• Urgent versions — security fixes, or fixes for a problem that stops the probes — reach every ring at the first check, ignoring both the delay and the night window.
• A ring always receives the latest version: if a newer one is released while a delayed probe is still waiting, it receives the newer one when its delay ends.

The ring is chosen at installation; without the option it is standard:

.\CyberGuard-NetworkProbe.exe --install <installation code> --updatering delayed

To change it later, without reinstalling, run from an administrator prompt:

C:\CyberGuard\DIM-NetworkProbe\CyberGuard-NetworkProbe.exe --updatering pilot

The new ring applies from the next check. Reinstalling the probe without --updatering keeps the ring already chosen.

#Replacing the previous SNMP agent

If you used the previous CyberGuard SNMP agent, with its agent-config.json and scan-targets.json files, you do not need to uninstall it: install the probe as described above and the --install command removes the old scheduled task. The old folder and its files are not deleted: remove them by hand when the new probe works.