Double-click the downloaded file Snare-Epilog-Agent-v{Version}-{Architecture}.exe where {Version} is the most recent version of the file available. This is a self extracting archive, and will not require WinZip or other programs. You will be prompted with the following screens:

Welcome to the Snare Enterprise Epilog Setup Wizard

This screen provides a brief overview of the product you are about to install. Where available, select "Next" to continue the installation, "Back" to return to the previous screen or "Cancel" to abort the installation.

License Agreement

The License Page displays the link to the End User License Agreement (EULA). Please read the document carefully and if you accept the terms of the agreement, select "Accept". If you do not accept the EULA conditions, click "Decline" and do not proceed with the installation.

Existing Install (Upgrade only)

If the Wizard detects a previous install of the Snare agent, you will be asked how to proceed.

Selecting "Keep the existing settings" will leave the agent configuration intact and only update the Snare files. The Wizard will then skip directly to the Ready to Install screen.

Selecting "Reinstall" will allow the configuration wizard to continue and will replace your existing configuration with the values you input. Note that replacing the configuration does not happen immediately; it takes place after selecting the "Install" button on the Ready to Install screen (further down).

Service Account

The Snare agent requires a service account to operate. The default option is to use the in-built SYSTEM account.

Select a License

If Snare license files are found in the current directory where the Snare installation file exists, an option to select the license will be available.

Network Destination

This screen provides configurations for network destination. Following configurations can be configured.

Destination address The name or IP address can be entered and comma delimited when several addresses are required.
Port Configure the port, for example Snare Server users should only send events to port 6161 in native UDP or TCP, or 6163 for TLS/SSL, and Syslog via port 514.
Protocol Select the network protocol (UDP,TCP,TLS and TLS_AUTH) you would like the agent to use when sending events.
TLS Authentication Key This option is available only for TLS_AUTH protocol. TLS authentication key should be the same as configured in destination. A valid TLS Authentication Key must be between 8-4096 characters and allowed characters include A-Za-z0-9~!@$%^*\()_+=`-
Use Host IP Address Override for source address Enabling this setting will use the first network adaptor as listed in the network configuration as the source of the IP address.

Web User Interface

This screen provides a means to configure the Snare Agent's web interface for first time use. Select from the following options to configure the Snare web interface:

Enable Web Access

Select this option to enable the web user interface.

A user/password combination will be required to access the web interface. The user is always "snare" and the password will be set to text supplied in the "Password" field.

If the Enable Web Access option is NOT selected, all configuration changes will need to be made by directly modifying registry settings and the service will need to be restarted for any changes to take effect.

Password: Enter the login password for the agent website.
Password complexity rules

The password must meet the following criteria:
Between 10 and 128 characters in length.

Not more than 2 identical characters in a row (e.g. 111 not allowed).

And 3 out of the following 4 complexity rules:

At least 1 uppercase character (A - Z),

At least 1 lowercase character (a - z),

At least 1 digit (0 - 9),

At least 1 special character (e.g. punctuation).

Local access only? Selecting "Local access only" will configure the web interface to restrict access to local users only. Remote users will be unable to contact the web interface.

Select Destination Location

This screen provides a means to select the folder where the Snare Agent will be installed. If the folder name specified does not exist, it will be created. It is important that this folder has at least enough space available to install the agent.
By default, the installation wizard will install Snare under the Program Files folder. If a different destination is desired, one may be selected via the "Browse" button, or by typing the full path name directly into the box.

Select Start Menu Folder

Select the program group within the Start Menu under which a shortcut to Epilog's Remote Control Interface will be created

Ready to Install

This screen provides a final summary of the chosen installation options. If the options listed are incorrect, select the "Back" button to return to previous screens and change their configuration.
Select the "Install" button to proceed with the listed choices, or "Cancel" to abort the installation without making any changes. The "Back" button may be used to return to the previous screen.

Information

This screen provides basic copyright information and last minute documentation which may not be included within this manual.

Completing the Snare Setup Wizard

This is the final screen of the installation wizard. By default, a Readme.txt file will be opened after selecting "Finish". Please review this readme for details of the changes made to the agent.

Browser not supported