TDR Host Sensor Manual Installation

The end-of-life date for TDR is 30 September 2023. On this date, the TDR UI in WatchGuard Cloud will no longer be available. Host Sensors will continue to function, but remediation and report generation will be disabled. To upgrade your Host Sensors to Endpoint Security, go to the Host Sensor upgrade to Endpoint Security Knowledge Base article.

You can manually install a Host Sensor for Windows, Mac, or Red Hat Linux. After the initial installation, if Host Sensor Auto-Update is enabled in the General Settings page, Host Sensors for Windows and Mac update automatically when an update is available. The Host Sensor for Linux does not update automatically. You must manually update it.

For information about TDR Host Sensor OS compatibility, see the Threat Detection & Response Release Notes on the TDR Release Notes page.

Download the Host Sensor Installer

You can manually download the Host Sensor installation file from the Devices / Users > Hosts page. When you download the host sensor installer, you must also copy the Account ID and Controller ID address required to install the Host Sensor.

On the Host Sensor page you can also set the Age Off For Quarantined Files. This setting controls how long quarantined files remain on a host. For more information, go to Configure the Age Off For Quarantined Files.

To download the Host Sensor installer from the Devices / Users page:

  1. On the host where you want to install the Host Sensor, select Devices / Users > Hosts.
  2. Click Download Host Sensor.
    The Host Sensor Download dialog box opens.

Screen shot of the Host Sensor Download page

  1. From the Operating System drop-down list, select the host operating system:
    • Microsoft Windows
    • Red Hat Linux
    • Mac
  2. Click Download.
    The Host Sensor installer file is downloaded.
  3. Copy the Account ID and Controller Address from this page.
    You must provide this information when you run the installer.

Manually Install the Host Sensor

After you download the Host Sensor installer to the host, run the installer.

  1. Double-click the downloaded MSI installer file.
    The Threat Detection and Response Setup dialog box appears.

Screen shot of the Threat Detection and Response Setup dialog box

  1. Copy and paste the Account ID from the TDR Host Sensor page to the Account ID text box in the installer.
  2. Copy and paste the Controller Address from the TDR Host Sensor page to the Controller Address text box in the installer.
  3. Click Install.
  4. Click Finish.
  1. Log in to the Mac as a superuser.
  2. Double-click the downloaded .pkg installer file.
    The Install Threat Detection and Response Host Sensor Daemon opens.
  3. Click Continue.
    The installer shows the amount of disk space required to install the Host Sensor.
  4. Click Install.
  5. Type your Mac user ID and password to allow installation of the software.
  6. Click Install Software.
    The TDR Host Sensor Setup dialog box opens.

Screen shot of the Account UUID step

  1. Copy and paste the Account ID from the TDR Host Sensor page to the Account ID text box in the installer. Click OK.

Screen shot of the Controller Address step

  1. Copy and paste the Controller Address from the TDR Host Sensor page to the Controller Address text box in the installer. Click OK.
    A progress bar appears while the installation is in progress.
  2. After the installation is finished, click Close.
  3. Select Keep to keep the installer file or Move to Trash to delete it.

In macOS High Sierra 10.13 users must approve newly-installed kernel extensions. After you install the TDR Host Sensor on macOS 10.13, the System Extension Blocked message appears. To enable the TDR Host Sensor to function, the user must approve the kernel extension in the macOS System Settings > Security & Privacy settings. For more information, go to How to approve the TDR Host Sensor kernel extension on macOS High Sierra in the WatchGuard Knowledge Base.

To install a new Host Sensor for Red Hat Linux:

  1. Log in to the Red Hat Linux system as a user with root or root equivalent credentials.
  2. Copy and paste the commands from the page where you downloaded the Host Sensor. The commands include the controller address and account UUID for your account. In the install command, replace [SENSOR_RPM_PATH] with the name and path of the .RPM file you downloaded.

To update an existing Host Sensor for Red Hat Linux to a new version:

  1. Log in to the Red Hat Linux system as a user with root or root equivalent credentials.
  2. Type this command:
    yum update [SENSOR_RPM_PATH]
    Replace [SENSOR_RPM_PATH] with the name and path of the .RPM file you downloaded.

Verify Host Sensor Status

The first time the Host Sensor sends a heartbeat to your Threat Detection and Response account, the host is added to your TDR account and appears in the Hosts list.

To verify the Host Sensor status:

  1. Select Devices / Users > Hosts.

Screen shot of the Hosts page

  1. To verify that the Host Sensor is installed and operational, find the host in the list and review the Sensor Status column.

The icon in the Sensor Status column indicates the status of the Host Sensor on each host.

  • — Host Sensor is installed and operational
  • — Host Sensor is installed but has a problem
  • — Host Sensor is not communicating
  • — Host Sensor has shut down correctly
  • Paused icon — Host Sensor has protection paused
  • Host Contained icon — Host Sensor has contained the host

For more information about the Hosts page, go to Manage TDR Hosts and Host Sensors.

Related Topics

TDR Host Sensor CLI and GPO Installation

Uninstall TDR Host Sensors