Defendx - Unified XDR and SIEM | AI-Powered Cybersecurity

Defendx Central Components

Defendx consists of three main central components that work together to provide comprehensive security monitoring and analysis.

Defendx Indexer

The Defendx indexer is a highly scalable, full-text search and analytics engine that indexes and stores alerts generated by the Defendx server.

Storage & Analytics

Defendx Server

The Defendx server analyzes data received from the agents and processes it using threat intelligence. A single server can analyze data from thousands of agents.

Processing Engine

Defendx Dashboard

The Defendx dashboard is the web user interface for data visualization, analysis, and management with dashboards for regulatory compliance, vulnerabilities, and more.

Web Interface

Single Universal Agent

Defendx agents are installed on endpoints such as laptops, desktops, servers, cloud instances, or virtual machines. They provide threat prevention, detection, and response capabilities across all supported operating systems.

Supported Operating Systems

Windows macOS Linux Solaris HP-UX AIX

Agent Installation

Windows

                                                # Download MSI installer
wget https://packages.defendx.com/4.x/windows/defendx-agent-4.7.0-1.msi

# Install with manager IP
msiexec /i defendx-agent-4.7.0-1.msi /q DEFENDX_MANAGER='defendx-server-ip'
                                            

Linux

                                                # Ubuntu/Debian
wget https://packages.defendx.com/4.x/apt/pool/main/d/defendx-agent/defendx-agent_4.7.0-1_amd64.deb
sudo dpkg -i defendx-agent_4.7.0-1_amd64.deb

# Configure manager
sudo /var/ossec/bin/agent-auth -m defendx-server-ip
                                            

Agent Features

Lightweight and efficient resource usage
Automatic updates from central manager
File integrity monitoring
Log collection and analysis
Rootkit and malware detection
Vulnerability detection

Configuration Guide

Configure your Defendx installation for optimal performance and security. These settings will help you customize the platform to meet your specific requirements.

Basic Configuration

Manager Configuration

                                                # Edit manager configuration
sudo nano /var/ossec/etc/ossec.conf

# Set manager IP address
<address>your-manager-ip</address>
                                            

Agent Configuration

                                                # Register agent with manager
sudo /var/ossec/bin/agent-auth -m manager-ip -A agent-name

# Start agent service
sudo systemctl start defendx-agent
                                            

Advanced Settings

Configure email alerts for security notifications
Set up integration with SIEM systems
Configure custom rules for threat detection
Set up automated responses to security events

Troubleshooting Guide

Common issues and solutions for Defendx installation and operation. If you encounter problems, check these solutions first.

Common Issues

Service Not Starting

If Defendx services fail to start:

                                                # Check service status
sudo systemctl status defendx-manager

# View detailed logs
sudo tail -f /var/ossec/logs/ossec.log
                                            

Agent Connection Issues

If agents cannot connect to manager:

                                                # Check firewall settings
sudo ufw status

# Verify manager is reachable
telnet manager-ip 1514
                                            

Diagnostic Commands

Check system resource usage: top
Verify network connectivity: ping manager-ip
Check disk space: df -h
Restart all services: sudo systemctl restart defendx-*

Install Defendx