User Guide

Installing CheckLight on Linux

Razvan Raschitor -

Before you start: Have your CheckLight sign-in and an account with sudo access ready. CheckLight's Linux agent is named ThreatResponder. Use a supported 64-bit Linux system with kernel 4.7 or later and systemd 237 or later.

Download from the CheckLight portal

Open Endpoints and add an endpoint

  1. Open CheckLight in Chrome and sign in.
  2. Select Endpoints in the navigation bar, then select Add Endpoint.
CheckLight portal: Endpoints → Add Endpoint.

Download the Linux bundle

Open the Linux download view. If the page shows Windows or Mac downloads, select the Linux icon under Also available for.

Select the Debian or RPM bundle for your Linux distribution.
  • Download for Linux (Debian Distributions): Debian, Ubuntu, and Kali.
  • Download for Linux (Rpm Distributions): RHEL, CentOS, Fedora, and Amazon Linux.

To prepare a download link for another Linux computer, select Generate Link → Linux .Deb or Linux .Rpm, matching its distribution family.

After downloading, follow the bundle installation steps below.

Install and verify on Linux

The download is a ZIP bundle containing install.sh, CompanyID.cfg, and the .deb or .rpm package. Keep these files together so the installer can load your Company ID.

Debian, Ubuntu, and Kali

Extract the Debian bundle, enter the extracted folder, and run the installation script:

unzip threatresponder-linux-deb.zip
cd threatresponder-linux-deb
chmod +x install.sh
sudo ./install.sh

RHEL, CentOS, Fedora, and Amazon Linux

Extract the RPM bundle and run the installation script:

unzip threatresponder-linux-rpm.zip
cd threatresponder-linux-rpm
chmod +x install.sh
sudo ./install.sh

Use the actual archive and folder names from your download if they differ from these examples.

Optional installer parameters

  • --package <path>: select the package when the folder contains more than one .deb or .rpm file.
  • --company-id <path>: provide a different CompanyID.cfg file. This parameter takes a file path.

Registration

The bundle preloads your Company ID. A separate registration command is not required for a normal bundle installation. If you need to re-register the agent, use the Company ID from your CompanyID.cfg file:

sudo /opt/threatresponder/bin/ThreatResponderAgent --SetupAgent "Company ID"

Replace Company ID with your actual Company ID and keep the quotation marks.

Verify both services

sudo systemctl status threatresponder-agent.service
sudo systemctl status threatresponder-maintenance.service

Confirm that both services are active and running. Return to CheckLight > Endpoints and confirm that the Linux computer appears and reports its status.

Maintenance and diagnostics

Use systemctl to manage the two services. Run only the commands needed for your maintenance task.

Start services

sudo systemctl start threatresponder-agent.service
sudo systemctl start threatresponder-maintenance.service

Stop services

sudo systemctl stop threatresponder-agent.service
sudo systemctl stop threatresponder-maintenance.service

Stopping the agent stops monitoring. Start the services again when maintenance is complete, then check their status.

View logs

The systemd journal records service lifecycle events. View the latest 200 entries for each service:

sudo journalctl -u threatresponder-agent.service -n 200
sudo journalctl -u threatresponder-maintenance.service -n 200

Runtime logs are stored in /var/log/threatresponder. To follow a log as new entries arrive, run one of these commands; press Ctrl+C to stop following it:

sudo tail -f /var/log/threatresponder/agent.log
sudo tail -f /var/log/threatresponder/maintenance.log

Uninstall from Linux

The Linux packages include removal scripts that stop the services, send an uninstall notification, and clean up the ThreatResponder directories after the binaries exit.

Debian, Ubuntu, and Kali (.deb)

Remove the package, then purge its remaining configuration and state:

sudo apt remove threatresponder
sudo dpkg --purge threatresponder

RHEL, CentOS, Fedora, and Amazon Linux (.rpm)

Use one of the following commands, according to the package manager available on your system. Each triggers the package cleanup scripts.

With DNF:

sudo dnf remove threatresponder

With YUM:

sudo yum remove threatresponder

With RPM:

sudo rpm -e threatresponder