Note: If the Sensor Auto-Upgrade is enabled, replace canary-forwarder and the canary_forwarder below with cwp.

RPM

1. Place the information below into a file titled redcanary.repo in /etc/yum.repos.d/.
   

   [RedCanary]
   name=Red Canary Cloud Workload Protection
   username=<username>
   password=<password>
   baseurl=https://redcanary.jfrog.io/artifactory/forwarder-rpm-prod-local/
   enabled=1
   gpgcheck=0
   repo_gpgcheck=1 
   9gpgKey=https://<subdomain>.my.redcanary.co/keys/artifactory.gpg.public
   

2. Run the following, sudo yum install canary_forwarder.
3. Place the information below into a file titled config.json in /opt/redcanary/.

{"access_token": "<access_token>",
  "subscription_plan": "Managed"
}

Debian

1. Place the information below into a file titled redcanary.list in /etc/apt/sources.list.d/.

Note: Use the contents specific to the system whether it is x86_64/amd64 or AArch64/arm64.

x86_64/amd64

deb [arch=amd64] https://<subdomain>:<password>@redcanary.jfrog.io/artifactory/forwarder-debian-prod-local main restricted

AArch64/arm64

deb [arch=arm64] https://<subdomain>:<password>@redcanary.jfrog.io/artifactory/forwarder-debian-prod-local main restricted

2.  Place the information below into a file titled redcanary_auth.conf in /etc/apt/auth.conf.d/ :.

machine redcanary.jfrog.io
login <username>
password <password>

3.  Install the GPG key with the following command below.

wget -qO - https://<subdomain>.my.redcanary.co/keys/artifactory.gpg.public | sudo apt-key add -

4.  Run the content below.

sudo apt-get update
sudo apt-get install canary-forwarder

5.  Place the information below into a file titled config.json in /opt/redcanary/.

{
  "access_token": "<access_token>",
  "subscription_plan": "Managed"
}

AMI/VM Setup

1. Start the instance.

2. Install Red Canary Linux EDR via the Debian or RPM instructions.

• Follow the instructions from the RPM or Debian tabs. Place the config.json file into /opt/redcanary/.

3. Stop the cfsvcd service.

• sudo systemctl stop cfsvcd or sudo initctl stop cfsvcd

4. Run the following to delete any saved state. sudo rm /opt/redcanary/state.json

5. Shut down the instance.

6. Create the AMI or clone from the VM instance.

Manual Setup

1. Begin by downloading the relevant package.
2. To find the download links in Red Canary, click the dropdown arrow next to Endpoints, and then click Deploy sensors. 
3. Select your desired platform, and then select your desired sensor technology. 
4. Scroll down to the Installation Instructions section and click Manual Setup.
5. Find your desired operating system and reference Uninstalling the package.