Balbix Host Analyzer Deployment Guide

‌Overview

Balbix can harvest data from several different sources using various methods including sensors, connectors, and collectors that allows Balbix to be deployed in a variety of environments. The Balbix Host Analyzer (HA) is an endpoint software that gathers detailed, real-time information related to installed software, configurations, and logged in users. The Balbix HA also gathers information from logs such as Windows AD, RDP sessions, SSH sessions, and others. Balbix HA software can be installed on desktops, laptops, and servers and accommodates Windows, MacOS, AIX and most Linux distributions.

‌Balbix HA Functionality‌

When you install the Balbix HA software, it immediately establishes a baseline for the asset by gathering data. The HA will continuously observe and gather any further updates in a differential manner.

‌Baseline Analysis and Differential Updates‌

The Balbix HA collects over 350 asset attributes from the system on which it is installed. These attributes can be classified into broad observation categories as shown in the table below.

‌

Installation‌

Because the Balbix HA is deployed in a device’s OS and does not include any kernel or driver modules, interoperability is seamless, and a system reboot is not required for installation or subsequent updates.

‌Minimum System Requirements‌

The minimum recommended system requirements for the Balbix HA software include:

*Unless otherwise defined, the Balbix HAs communicate directly with the Balbix brain. A unique client certificate is issued to each Balbix HA for secure communication.

Contact Balbix Technical Support for additional details.

‌Whitelisting‌

If your company has proxies or other security controls in place, you need to whitelist Balbix URLs and their corresponding IP addresses:

‌Resource Usage‌

Balbix HA software is designed to be extremely lightweight to keep resource usage very low— the data collection points are not inline and only minimal processing is done on the endpoint. The average consumption is as follows:

• CPU: ~0.5%*

• RAM: 200MB*

• Storage: 800MB

• Internet Data Usage: ~4MB per day

*Benchmarked using a dual core Windows 10 Virtual Machine with 4GB RAM.

‌Software Updates‌

HA software leverages the lightweight Google Omaha protocol which enables automatic HA software updates thereby eliminating the need for IT interaction for updates or maintenance.

‌Download and Install‌

Balbix HA software modules are downloadable from the Balbix dashboard.

Follow this procedure:

‌

Windows Installation‌

This section provides a list of supported platforms/versions, installation information, supported endpoint deployment tools, proxy configurations, and FAQs specific to your Balbix HA deployment for Microsoft Windows.

‌Platform(s) & Version(s)

‌Before you get started

NOTE: The bx-troubleshooter-xx.exe utility and README.md file is included in Balbix HA package. The README.md text file includes brief Installation instructions for the troubleshooter utility and Balbix Host Analyzer Installer.

‌How to Install

1. Download the Host Analyzer Windows Installer .zip package to the asset you want Balbix to monitor.

2. Extract the Host Analyzer Windows Installer .zip package to a directory.

3. Change the current directory to the extracted directory using one of the following methods: Method 1 Double click on Balbix Host Analyzer Windows Installer (*.msi) file to start the installation. Method 2 Run the command (shown below) from the admin command line using the extracted .msi installer file name. msiexec /i Balbix-Host-Analyzer Installer_win_<cust_name>_<network_name>_<installer_version>.msi To install in silent or quiet mode, add /quiet to the options of the msiexec command. NOTE: The .msi package can also be used with specific software management and deployment automation tools. Balbix HA software can be deployed at scale for Windows using several methods: KACE SCCM Casper GPO

‌Proxy Configuration for Windows

The Balbix HA requires Microsoft Windows HTTP (WinHTTP) for successful deployment and communication with Balbix Cloud services.

The WinHTTP proxy settings can be specified using following methods:

• Auto-discovery: Uses Transparent Proxy and Web Proxy Auto-Discovery Protocol (WPAD). If a transparent proxy or WPAD is used in your network, there is no special configuration required. The WinHTTP auto-proxy service will automatically obtain the proxy settings using DHCP/DNS servers.

• Static Proxy Configuration: WinHTTP provides a netsh command to configure static proxy settings. You can get a list of netsh contexts by opening either the command prompt or Windows PowerShell, then type netsh /? or netsh help and press Enter.

‌How to Uninstall

To uninstall the Balbix HA, use the command (legacy) that follows:

‌FAQs for Windows Deployment

How do I know which version of the Balbix HA is installed?

How much memory does the Balbix HA use?

The HA uses 80 to 130MB of memory for a deployment on Windows.

What is the CPU consumption of the Balbix HA for Windows?

After HA installation, ~0.5% is the average consumption.

What is the location of the Balbix HA log directory for Windows?

C:\ProgramData\Balbix

How many and what services/daemons does the Balbix HA run?

‌How many, and what processes, does the Balbix HA use when running on Windows?

‌Linux Installation‌

This section provides a list of supported platforms/versions, installation information, supported endpoint deployment tools, and FAQs specific to your Balbix HA deployment for Linux.

‌Platform(s) & Version(s)

‌How to Install

1. Run the command, as shown below, for the .deb software package file: sudo dpkg -i <name_of_installer>.deb OR sudo apt-get install -f <name_of_installer>.deb

2. Run the command, as shown below, for the .rpm software package file: rpm -ivh <name_of_installer>.rpm

‌Supported Endpoint Deployment Tools

Balbix HA software can be deployed at scale for Linux using the methods as follows:

1. Puppet Chef Ansible

‌How to Uninstall

To uninstall the Balbix HA, use the command for RPM package-based Linux platforms as shown below:

To uninstall the Balbix HA, use the command for Debian package-based Linux platforms as shown below:

‌FAQs for Linux Deployment

How do I know which version of the Balbix HA is installed?

To check which version of the Balbix HA is installed, use the command:

How much memory does the Balbix HA use?

The HA uses 20MB on average and a maximum of 100MB of memory for a deployment on Linux.

What is the CPU consumption of the Balbix HA for Linux?

After HA installation, CPU consumption is as follows:

• <0.5% average

• Nice value of 10 (runs with a low priority)

• All systems’ tasks have a higher precedence than the Balbix HA

What is the location of the Balbix HA log directory for Linux?

/var/log/bxha/

How many and which services/daemons does the Balbix HA run on Linux?

How many and which processes does the Balbix HA use on Linux?

‌MacOS Installation‌

This section provides a list of supported platforms/versions, installation information, supported endpoint deployment tools, and FAQs specific to your Balbix HA deployment for macOS.

‌Platform(s) & Version(s)

‌How to Install

1. Download the macOS Installer from the Balbix dashboard.

2. Open the Balbix-Host-Analyzer-Installer_macos.dmg.

3.      Open the BxA.pkg and follow the installer steps necessary to install the software. Balbix HA software can be deployed at scale for macOS using the methods that follow: Munki Jasper

‌How to Uninstall

1. Download the macOS installer from the Balbix dashboard.

2. Open the Balbix-Host-Analyzer-Installer_macos.dmg.

3. Open uninstall_BxA.pkg and follow the installer steps necessary to uninstall the software.

‌FAQs for macOS Deployment

How do I know which version of the Balbix HA is installed?

To check which version of the Balbix HA is installed, use the command:

How much memory does the Balbix HA use?

The HA uses 50MB on average and a maximum of 200MB of memory for a deployment on macOS.

What is the CPU consumption of the Balbix HA for macOS?

After HA installation, CPU consumption is on average <0.5%.

What is the location of the Balbix HA log directory for macOS?

• /Library/Balbix/Logs

How many and which services/daemons does the Balbix HA run on macOS?

How many and which processes does the Balbix HA use on macOS?

‌AIX Installation‌

This section provides a list of supported platforms/versions, installation information, supported endpoint deployment tools, and FAQs specific to your Balbix HA deployment for AIX.

‌Platform(s) & Version(s)

‌How to Install

‌Supported Endpoint Deployment Tools

For endpoint management tools, contact Balbix Technical Support.

‌How to Uninstall

1. To uninstall the Balbix HA, use the command for Debian-based Linux platforms as shown below: dpkg -r bxha

1. To uninstall the Balbix HA, use the command for RPM package-based Linux platforms as shown below:

‌FAQs for AIX Deployment

How do I know which version of the Balbix HA is installed?

To check which version of the Balbix HA is installed, use the command:

How many and which services/daemons does the Balbix HA run on AIX?

How many and which processes does the Balbix HA use on AIX?

‌General HA FAQs‌

How much network bandwidth does Balbix consume? The Balbix HA uses 200KB of network bandwidth per day. How frequently does the Balbix HA perform a scan?

The Balbix HA performs a thorough scan of the system within an hour after installation. Because the scan is set to run at a lower priority, it should not interrupt or interfere with any critical, or user interaction-based, activities or tasks.

After the initial scan, the Balbix HA only performs a differential scan when it observes a change in the software on the system, such as installation of new software applications, updates, or patches. Additionally, the Balbix HA is constantly monitoring or observing the system; it does not perform timed or manually enabled scans. Therefore, the Balbix HA is more like an

“observational” agent, instead of an agent that actively performs timed or manually enabled scans.

When is it necessary to reboot the system on which the Balbix HA is installed?

All updates of the Balbix HA are silent, seamless and do not require any reboot or downtime. In a rare circumstance when the Balbix HA restarts, no reboot will be necessary.

Does the Balbix HA perform any packet modification or hook into other application layer protocols?

No, the Balbix HA does not perform packet modification for other application layer protocols and does not hook into OS kernels. The software architecture is dependent only on the APIs that are available.

‌Troubleshooting‌

Rarely, the Balbix HA may experience connectivity or installation issues. If you experience either of these, there are a few simple things you can check prior to contacting Balbix Technical Support.

‌Identify the Issue(s)‌

The first step in troubleshooting your installation issues is to consider answers to the questions that follow:

• How many asset(s) are experiencing issues?

• Was the HA installation completed on the asset(s) experiencing issues?

• Is there a Balbix icon in the system tray?

• Is the Balbix folder at C:\ProgramData\Balbix present?

• Are the asset(s) able to reach https://rs003tra.balbix.net (US Customers) or https://rs003tra.eu.balbix.net (EU Customers)?

• Are the asset(s) leveraging a proxy for internet connectivity?

• Are there any antivirus or other security products, such as Digital Guardian, potentially blocking the installation or connection?

‌Analyze the Balbix HA Logs‌

In most cases, an efficient way to troubleshoot issues is to analyze the Balbix HA log data. You can find the log files in the directories that follow:

‌Run the Balbix Troubleshooter (Windows Only)‌

To observe any potential problems or obstacles in the customer host/network environment, we recommend running bx-troubleshooter-xx.exe utility for Windows platforms (included in the Balbix HA Windows zip package). Run the bx-troubleshooter-xx.exe utility as an administrator from the Windows command line shell. The troubleshooter will perform a host environment check, communication verification, and will print out any error conditions and corresponding resolution recommendations. Implement the recommended issue resolutions before installing the Balbix HA.

‌Connectivity Issues‌

Troubleshoot any issues using the *.bak file first if it is present on your system.

The first step in troubleshooting is to look for the first Send and Send response or Send FAILED!! messages. If an error message has been received, start there to troubleshoot any issues.

‌

‌Case Example Analysis

A few issues are apparent in the case example:

Common Descriptive Error Messages (in Send FAILED!! lines)

Some common descriptive error messages and recommended ways to resolve them are as follows:

Error: ERROR_WINHTTP_NAME_NOT RESOLVED indicates that the HA was unable to connect to the Balbix brain, or the DNS name of the Balbix server could not be resolved.

Resolution: Check to make sure the asset can reach both https://rs003tra.balbix.net and https://rs002tra.balbix.net. From a command prompt or terminal, enter the command:

If the asset can’t resolve this domain, check your network settings to confirm this is permitted.

Error: ERROR_WINHTTP_CLINET_AUTH_CERT_NEEDED indicates the installer certificate is not valid. This is likely due to an old installer.

Resolution: Go to the Balbix dashboard, fetch the latest installer, and try installing again.

Error: ERROR_WINHTTP_SECURE_FAILURE indicates the asset does not have DigiCert Root CA installed or it cannot be reached.

Resolution: If this error appears, please contact Balbix Technical Support for further assistance.

‌Partial Installation‌

If the installation completes but the HA software is left in a partial state, the installation process may have been halted or corrupted by antivirus or other behavior-centric security solutions in your environment.

Indicators of a partial installation vary, but they can include:

• Tray icon is present but install file is missing (typically quarantined)

• Missing or stopped processes (see HA processes)

• Alerts generated from other security solutions from Balbix files (typically will begin with “bx” or “bxha”). If you receive an alert, please ensure the following Balbix executables are whitelisted:

  bx_na.exe	BalbixUpdateBroker.exe
  bxtray_win.exe	Balbixcrashhandler.exe
  bxtray_win.exe	Balbixcrashhandler64.exe
  bx_ha_chrome_connector.exe	BalbixUpdateWebPlugin.exe
  setup.exe	BalbixUpdateOnDemand.exe
  mini_installer.exe	BalbixUpdateComRegisterShell64.exe
  Balbixupdate.exe

  
  NOTE: Often there are multiple installation attempts in a single log. If this is the case, search for the DllEntry line, as this indicates the start of a fresh installation.

  If you are still experiencing installation issues after initial troubleshooting, or would like assistance with your troubleshooting, contact Balbix Technical Support.
  

  ‌Balbix Technical Support‌

  Balbix technical support options are available as follows:

  
  

• Contact your local account team

• Use the following form

• Send an email to support@balbix.com

• Call Balbix toll-free (US) at +1-866-936-3180 during regular U.S. business hours

‌Appendix A‌

‌Balbix HA Deployment using SCCM‌

‌Installation‌

The Balbix Host Analyzer (HA) can be deployed to a large group of assets or enterprise wide using endpoint management software such as Microsoft’s System Center Configuration Manager (SCCM), now known as Microsoft Endpoint Configuration Manager (MECM).

Follow the steps below to install the Balbix Windows HA using SCCM:

1. Download the Host Analyzer Windows Installer .zip package from the Balbix dashboard.

2. Extract the Host Analyzer Windows Installer .zip package to a directory.

3. Open the Create Application Wizard in SCCM.

4. Click General and choose .msi as the Type specifying the location of the extracted Balbix HA .msi file.

5. Click Next.

6. In the Installation Program dialog box, enter the following command by using the extracted .msi file name: msiexec /i Balbix-Host-Analyzer-Installer_win_*.msi /q

7. In Install Behavior, specify Install for System.

8. Complete deployment.

See Also:

Subnet Management