Samurai Agent (BETA)

• 1: Support and Pre-requisites
• 2: Download and Installation
• 2.1: Agent Download
• 2.2: Microsoft Windows
• 3: Agent Management
• 4: Agent Uninstall

1 - Support and Pre-requisites

Listed below are supported Operating Systems and communication pre-requisites. If you do not see a specific OS version listed please reach out to us.

Supported Operating Systems

Communication Pre-Requisites

Ensure all agents have the following network connectivity:

What’s Next?

Now you have an understanding of support and pre-requisites, learn about Download and Installation of the SamurAI Agent.

2 - Download and Installation

Before you begin download and installation of the SamurAI Agent you must first select how you wish to manage Agent Updates and decide the settings for SamurAI Agent for Windows.

1. From the SamurAI MDR Portal select Telemetry and click SamurAI Agent

Upon first browsing to this page, the following will be displayed:

Figure 1: SamurAI Agent settings

SamurAI Agents Updates

By default, SamurAI Agents are updated automatically. However if you require flexibility to update individual or groups of agents you can select this option (leaving blank denotes automatic updates).

• Self Managed : Select this option should you wish to manage agent updates yourself. See Self Managed for more information.

SamurAI Agent for Windows

1. Determine whether to Accept Microsoft Sysinternals Software Licence Terms (Sysmon EULA).

2. If you accept the Sysmon EULA, you can select to Install Sysmon if missing

3. Click Apply SamurAI Agent Settings

The SamurAI Agent and Sysmon

For enhanced telemetry on Windows, the SamurAI Agent optionally leverages Microsoft System Monitor (Sysmon), a vital component for collecting detailed process and system activity. Read more about Sysmon from Microsoft Documentation.

Sysmon is not bundled with the SamurAI Agent therefore if you Accept Microsoft Sysinternals Software Licence Terms (Sysmon EULA) upon installation of the SamurAI Agent, sysmon will be downloaded and installed or updated silently using standard Microsoft provided installation flags.

The SamurAI Agent leverages a custom Sysmon configuration tuned and maintained by the SamurAI detection engineering team. This provides:

• Noise reduction: a default Sysmon deployment generates an extremely high volume of data, our tuned configuration filters out unnecessary events which are irrelevant for SamurAI Managed Detection and Response.

• High Fidelity detections: we selectively enable and enrich valuable event IDs (e.g process creation, network connections, registry modification etc) aligned with the MITRE ATT&CK framework.

• Consistency across environments: ensures standardized event coverage across deployment.

• Ongoing Tuning: we regularly update the configuration to reflect emerging attacker techniques, new ATT&CK mappings and lessons learned.

What’s Next

You can now proceed to Agent Download

2.1 - Agent Download

To download the SamurAI Agent follow the steps below:

1. Login go the Samurai MDR Portal

2. Click Telemetry and select SamurAI Agent from the main menu

3. Click SamurAI Agent installers

4. Select the relevant installer based on your operating system and click Download

Verify Download

Microsoft Windows

To ensure your download has not been corrupted or tampered with, you can validate it’s checksum using the built-in Windows tool ‘certutil’.

Run the following command and view the checksum to ensure it matches the installer within the SamurAI MDR Portal:

c:\certutil -hashfile spiral-windows-amd64.msi sha256

example:

c:\certutil -hashfile spiral-windows-amd64.msi sha256
SHA256 hash of spiral-windows-amd64.msi:
85193aa8c4e7a1eaba1da36251bc6ea78e0e62b2
CertUtil: -hashfile command completed successfully.

What’s Next?

Based on your Operating System jump to the relevant SamurAI Agent installation guide:

• Microsoft Windows

2.2 - Microsoft Windows

Manual Installation

Locate the Windows MSI installer file that you previously downloaded and simply double-click, a small progress window will appear which does not require any interaction.

Additional commands are available using the command line as outlined below. All commands can be used in combination as required.

Proxy Support

If your organization leverages a proxy then use the following command during install:

Example:

msiexec.exe /i "spiral-windows-amd64.msi" PROXY=http://<ip>:<port>

This will create a key in the Windows registry: ‘Computer\HKEY_LOCAL_MACHINE\SOFTWARE\NTT\Spiral’ with a parameter ‘Proxy’ with the proxy from the command line.

This can be added/changed/removed at a later time, if so the SamurAI Agent services must be restarted.

Quiet Mode Installation

Use the the following command for ‘quiet mode’ installation (i.e no progress window is displayed):

msiexec.exe /i "spiral-windows-amd64.msi" /qn

Verbose Installation Logs

If you wish to view installation logs you can use the following command to save logs to a file for review:

Example:

msiexec.exe /i "spiral-windows-amd64.msi" /L*vx output.txt

Validate installation

After the installation has completed, there will be a ‘Spiral’ entry under installed programs.

Figure 1: Windows apps & features

The installation folder is ‘C:\Program Files\Spiral’ with full control permissions to SYSTEM and Administrators.

This should apply to all subfolders and files with one exception ‘osquery.db’ which will have an additional read access to Everyone/World.

Figure 2: SamurAI Agent Windows install path and files

There will also be a service named ‘Spiral’ running.

Figure 3: Task manager service

The ‘Spiral’ process will also be visible.

Figure 4: Task manager process

Additionally osquery processes will be running.

Figure 5: osquery processes

The following files are created by the installer:

C:\Program Files\Spiral\bin\spiral.exe: The Spiral launcher (more details what it does and functions further down)
C:\Program Files\Spiral\bin\osqueryd.exe: The Osqueryd binary that will be launched by spiral.exe (more details further down)
C:\Program Files\Spiral\config.yaml: The configuration for Spiral launcher
C:\Program Files\Spiral\secret: The embedded tenant/enrollment secret
C:\Program Files\Spiral\ca.pem: Spiral CA bundle used to communicate with the SamurAI platform. Will download new if missing or if outdated. Used by both spiral.exe and osqueryd.exe.

The following files are created by either the ‘Spiral’ or ‘Osquery’ process:

C:\Program Files\Spiral\server.crt: Exported server certificate chain from Spiral Node API (typically excluding Root CA). 
C:\Program Files\Spiral\sysmon.xml: The sysmon configuration downloaded from Spiral Node API.
C:\Program Files\Spiral\data\osquery.db: RocksDB data folder used by Osquery for state keeping. Osquery sets this with read access to Everyone/World at intervals.
C:\Program Files\Spiral\data\extensions.load: Purposely left empty
C:\Program Files\Spiral\data\osquery.flags: Osquery startup flags (generated by Spiral), extended configuration is fetched by Osquery over HTTPS.
C:\Program Files\Spiral\data\osquery.log: Stdout/stderr log output from osqueryd.exe
C:\Program Files\Spiral\data\osquery.pid: Osquery PID
C:\Program Files\Spiral\data\osquery.uuid: UUID for this specific node
C:\Program Files\Spiral\data\spiral.log: Stdout/stderr log output from spiral.exe
C:\Program Files\Spiral\data\shell: A folder created if running spiral.exe with "shell" command which is an interactive mode to run Osquery commands.

Dependant on your selection for SamurAI Agent for Windows the agent may:

1. Download Sysmon from Microsoft official servers.
2. Install or update Sysmon silently using standard Microsoft provided installation flags.
3. Modify Sysmon with the SamurAI Agent configuration.

Review Deployed SamurAI Agents

Review and Manage within the SamurAI MDR Portal.

3 - Agent Management

View Agents

To view all deployed agents:

1. Login go the Samurai MDR Portal

2. Click Telemetry and select SamurAI Agent from the main menu.

Agent Dashboard

The SamurAI Agent dashboard panel displays summary information as:

• Nodes: the total deployed and seen by the SamurAI platform
• Online: the total currently online (have communicated with the SamurAI platform within five minutes)
• Offline: the total number offline (have not communicated with the SamurAI platform for five minutes)
• Platforms: the total number of platforms i.e Windows / MacOS / Linux

A table displays all deployed agents with node specific information:

Delete Agent(s)

The SamurAI platform does not remove or delete offline agents that are displayed. For example you may have uninstalled or removed the agent from a node but it will still be displayed as offline.

You can delete SamurAI Agents from the table:

1. Select the nodes you wish to Delete
2. Click Actions and select Delete selected nodes
3. To ensure you intended to delete the agents you will need to type DELETE in the field and select Delete

Agent Settings

You can change the SamurAI Agent Update and Sysmon EULA selections by clicking Settings.

• Auto Managed : Auto updates of agents is enabled by default, select this option if you want the agent updates to occur automatically without any action needed on your part.
• Self Managed : Select this option should you wish to manage agent updates yourself.

Self Managed

If Self Managed is selected a new option entitled Update Tasks is displayed.

Update Tasks

Selecting Update Tasks allows you to configure tasks for updating your deployed agents.

1. Click on Create Update Task

2. Enter a Name for the task e.g Windows 10 Pro Update

3. Toggle whether you wish to Start immediately. If you do not start the task immediately you have the option to update the status at a later date/time. See Update the Task.

4. Select whether you wish to update:

• SamurAI agent version (the latest version will always be displayed)
• Sysmon version (applicable to Windows only)

5. Select if you wish to Rate Limit the update task. Read more about Rate Limiting

6. Once complete, select Review Selection and review your tasks

7. Click on Create Update Task

Rate Limiting

Rate limiting allows you to roll out updates to endpoint agents gradually instead of updating all systems at once. This controlled approach reduces risk of disruption, avoids overloading networks and ensures that if an unexpected issue occurs, only a small number of endpoints are affected.

Enabling rate limiting allows you to configure the number of agents to update per time duration (which can be set as minute/hour/day/month/week/year).

When rate limiting is recommended:

• Large fleets (typically 500+ endpoints)
• Networks with remote sites, VPN’s or limited bandwidth
• Critical workloads where uptime and stability are essential
• Major agent version upgrades or significant configuration changes

When rate limiting may not be necessary:

• Small fleets with a few hundred endpoints
• Minor, low-risk updates

View Update Tasks

1. From the SamurAI Agent view, click Update Tasks.

A table displays all Update Tasks with specific information:

Select an Update Task from the list to display status of individual agent updates.

A summary will be displayed including:

• Update task status
• Number completed
• Number failed
• Target
• Rate Limit

Additional details for each agent are also included:

Update the Task

You can update the State of an Update Task to either Paused or Running.

For example, if you previously set an Update Task NOT to Start Immediately you can set the state to Running to begin the update:

1. Select More Options ().

2. Click Update the Task

3. Select the State to Paused to pause the update task or to Running to begin or resume the update task.

4 - Agent Uninstall

Follow the steps to uninstall the SamurAI Agent based on your Operating System:

Microsoft Windows

1. Go to Add or remove programs

2. Find Spiral Agent

3. Click Uninstall

4. When uninstalled, program files and registry entries are removed from the endpoint/node, however some files may remain:

   • All files not added by the installer itself such as the Data folder in C:\Program Files\Spiral\Data
   • Files server.crt and sysmon.xml in C:\Program Files\Spiral remain after uninstall.

5. It is safe to delete C:\Program Files\Spiral after the uninstall has completed.