Install Ransomware Prevention

Task 1: Download the Insight Agent with Ransomware Prevention

You will need to download a bundle with the Insight Agent and Ransomware Prevention add-on. To attain the files required for this step, create a support ticket for your Customer Advisor.

Task 2: Decide which installation option to use

There are two main Agent Installation options available that can be used interchangeably:

• Token
• Certificate

What is a Token?

A token is your organization’s unique identifier that links the installed Insight Agents to your organization. When installing using the token, the Insight Agent reaches out to the Insight Platform to download the certificate files necessary for successful installation. This installation option requires connectivity to the Insight Platform directly through a Rapid7 Endpoint or a Collector.

If you are installing the agent in an environment with stricter network requirements, we recommend using the Certificate Package.

Your token consists of two parts:

• The region identifier - This portion identifies the region where your organization is located. For example, us is the region identifier for the United States, while ca is the region identifier for Canada.

• The Universally Unique Identifier (UUID) - The UUID represents the token itself. The API request initiated by the installer sends this UUID to the Insight Platform in order to retrieve the JSON document that contains all the necessary dependencies noted previously.

A fully generated token appears in the following format:

<region_id>:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

Note that the process of installation with a token, the Insight Agent installer will download the following dependencies onto your asset. All together, these dependencies are no more than 20KB in size:

• client.key
• client.crt
• config.json
• cafile.pem

If you intend to install the Insight Agent using your organization’s token:

• Your assets must be able to communicate with the Insight Platform in order for the installer to download its necessary dependencies.
  • As long as you verify the network connectivity requirements noted previously, this communication channel will be available for use.
• If your assets are deployed in a network with strict URL filtering rules in place, you may need to allowlist the following token resource endpoint to ensure that the installer can pull its configuration files from the Insight Platform. Substitute <REGION> with the code that applies to your data region: https://<REGION>.deployment.endpoint.ingress.rapid7.com/api/v1/get_agent_files
  • To determine your region, view the Insight Platform home for one of the following regions:

What is the Certificate Package?

The Certificate Package contains your unique organization's configuration files, which are required for successful installation of the agent. These files are downloaded seamlessly when installing with a token, but are provided here for easy access in case some of the assets in your environment don't have direct connectivity the Insight Platform through a Rapid7 Endpoint or a Collector. We recommend installing the Insight Agent using the Certificate Package in environments with stricter network requirements.

Your Certificate Package ZIP file contains the following security files in addition to the installer executable:

• client.key
• client.crt
• config.json
• cafile.pem

Expired Certificates

If you use the certificate package installation option to install the Insight Agent, your certificates will expire after 5 years. Insight Agents that were previously installed with a valid certificate are not impacted and will continue to update their SSL certificates. New installations of the Insight Agent using an expired certificate will not be able to fully connect to the Insight Platform to run jobs in InsightVM, InsightIDR, or InsightOps.

Refresh your Certificates

If you host your certificate package on a network share, or if it is baked into a golden image for a virtual machine, redownload your certificate package within 5 years to ensure new installations of the Insight Agent run correctly.

Task 3: Install the Insight Agent with Ransomware Prevention

Once you have determined which option you would like to use in task 2, you’re ready to install the Insight Agent with the Ransomware Prevention add-on.

Installation services and folders

Ransomware Prevention is installed as a service on your assets named Rapid7 Endpoint Prevention. Ransomware Prevention runs as two services on a 64-bit OS and as a single service on a 32-bit OS.

The Ransomware Prevention installation folder is located in C:\Program Files\Rapid7\Insight Agent\components\armor. Refer to the Endpoint Prevention overview for more information on how Ransomware Prevention works.

 
1
rapid7_endpoint_prevention_installer.bat CUSTOMTOKEN={token}

 
1
 rapid7_endpoint_prevention_installer.bat

1. Obtain the ZIP file with the latest version of Ransomware Prevention.
2. Locate (or generate, if necessary) your organization's token by navigating to insight.rapid7.com > Data Collection > Agents > Agent Installer > Token Management.
3. Extract the contents of the ZIP file to a directory that you can easily access with a command prompt.
4. Open a command prompt as an Administrator and navigate to the extracted folder, which contains the rapid7_endpoint_prevention_installer.bat file.
5. Run this command, replacing the <token> and the <passcode or password> parameters with the installer token and either the one-time passcode or a fixed password:

 
1
rapid7_endpoint_prevention_installer.bat CUSTOMTOKEN=<token> stop_service_password= <passcode or password>

1. Obtain the ZIP file with the latest version of Ransomware Prevention.
2. Download the latest Certificate Package from insight.rapid7.com > Data Collection Management > Agent Installer > Install the Insight Agent using the Certificate Package > Download Certificate.
3. Extract the contents of the ZIP file you downloaded in step 1 add the files included in the Certificate Package from step 2 to the same folder that you can easily access with the Windows command prompt (cmd). Once both ZIP files are extracted, the folder will contain these files:
   • client.key
   • client.crt
   • config.json
   • cafile.pem
   • agentinstaller-x86_64.msi
   • rapid7_endpoint_prevention_installer.bat
   • armor (folder)
4. Open the Windows command prompt (cmd) as an Administrator and navigate to the extracted folder, which contains the rapid7_endpoint_prevention_installer.bat file.
5. Run this command, replacing the <passcode or password> parameter with either the one-time passcode or a fixed password:
   • If you extract the contents of the ZIP file to a different directory than the default one, you will need to run the following command when running the batch script, substituting <PATH> with the path to the certificate directory. CUSTOMCONFIGPATH=<PATH>

 
1
rapid7_endpoint_prevention_installer.bat stop_service_password= <passcode or password>