Skip to main content

Endpoint Agent Downloads

If a term is unfamiliar, open the Glossary.

This guide explains exactly how to use the Endpoint Agent Downloads workspace and enroll hosts safely.

Workspace: #/edr-agent

What you can do in this page​

  • Start on an Overview screen before moving into downloads or activation work.
  • Download the latest EDR bundle.
  • Download the latest Windows installer (.exe) when published.
  • Download Linux/macOS standalone binaries when published.
  • Download checksum (.sha256) and signature (.sig) files.
  • Copy OS-specific quick start commands from the dedicated Activate section (Windows/Linux/macOS binaries plus script fallback).
  • Verify package integrity before installation.

Published Windows installers are generated by Dralvia's Windows build pipeline, so the download should arrive as a ready-to-run .exe without requiring local Python tooling.

Step-by-step: secure download and install​

  1. Open #/edr-agent.

  2. Review the Overview screen and confirm version/date.

  3. Open Artifacts and download:

    • Windows installer (.exe) for Windows endpoints (recommended)
    • Linux standalone binary for Linux endpoints (recommended when available)
    • macOS standalone binary for macOS endpoints (recommended when available)
    • Zip bundle
    • Checksum file
    • Signature file (if present)

  4. Verify checksum locally.

  5. Deploy on a test host first.

  6. Open Activate for the generated Windows/Linux/macOS command variants when you need scripted rollout.

  7. For Windows, preferred zero-command flow:

    • Double-click the installer (dralvia-edr-agent-*.exe).
    • Complete the first-run setup prompts once (API base, license token, workspace API key, host ID, disable password).
    • Keep Start with Windows enabled so the agent persists after reboot.
    • The app then runs in background automatically; no recurring command is needed.

    Expected first-run dialog:

Dralvia EDR first-time setup dialog

If you see a dialog that says: First-time setup is required before telemetry can start. Missing: license token, tenant API key or pre-provisioned agent credentials this is expected on first launch. Click OK and continue with setup prompts.

Setup field mapping:

  • API base URL: https://dralvia.tech/api
  • License token: your signed workspace JWT license token (issued by your workspace owner/internal admin)
  • Tenant API key: from workspace UI #/api-keys
  • Host ID: unique endpoint ID (for example georgepc1)
  • Disable password: workspace-admin disable secret used for backend disable authorization
  • Start with Windows: Yes (recommended)

Saved config location on Windows:

  • %LOCALAPPDATA%\\DralviaEdr\\agent_config.json

Optional operator flow (scripted launch):

  • Fill in command helpers in the page:
    • Workspace API key
    • Host ID
    • Disable password (workspace-admin-only secret used by backend disable authorization)

In PowerShell, set your license token first (required):

$env:EDR_LICENSE_TOKEN = "CHANGE_THIS_TO_YOUR_LICENSE_TOKEN"

Then launch the EDR binary (dralvia-edr-agent-*.exe, not dralvia-device-agent-*.exe) as a background process:

Start-Process -FilePath .\dralvia-edr-agent-windows.exe -ArgumentList '--api https://dralvia.tech/api --api-key CHANGE_THIS_TO_YOUR_API_KEY --host-id CHANGE_THIS_TO_YOUR_HOST_ID --platform windows --activate --disable-password CHANGE_THIS_TO_TENANT_ADMIN_DISABLE_PASSWORD' -WindowStyle Hidden

The process keeps running after PowerShell/CMD closes. Confirm in Task Manager. If your build includes tray UI, use Debug Bundle from tray menu for diagnostics. Disable requires local admin privileges and backend authorization with the workspace-admin disable password.

  1. For script fallback / non-Windows platforms, set required environment variables:
    • EDR_API_BASE
    • EDR_LICENSE_TOKEN
    • EDR_HOST_ID
    • EDR_PLATFORM
  2. Start collector and confirm host appears in #/edr-console.

Minimal validation checklist​

  • Host is visible in Endpoint Protection.
  • Last check-in is recent.
  • No auth/license errors in host output.

Common failures and fixes​

EDR activation failed when using --activate​

Meaning:

  • The API key is invalid, missing workspace scope, or activation endpoint rejected the request.

Action:

  1. Confirm API key belongs to the correct workspace.
  2. Confirm host ID is provided and valid.
  3. Retry with the exact command generated in #/edr-agent.

Could not find a suitable TLS CA certificate bundle / certifi\cacert.pem​

Meaning:

  • You are running an older/bad installer build that did not include the bundled CA certificate file.

Action:

  1. Re-download the latest Windows installer from #/edr-agent (current fixed line is 2026.03.03.2 or newer).
  2. Verify checksum before running.
  3. Retry activation.

Notes:

  • A local certificate install is not required for normal public TLS to https://dralvia.tech.
  • Only if your environment uses TLS interception/proxy, set:
    • PowerShell: $env:REQUESTS_CA_BUNDLE = "C:\\path\\to\\corp-root-ca.pem"

No EDR agent release available yet​

Meaning:

  • Workspace has no published EDR bundle at this time.

Action:

  • Contact support to publish/assign release for your workspace.

Read timeout while sending batch​

Meaning:

  • Connectivity or service latency issue.

Action:

  1. Confirm endpoint reachability.
  2. Increase timeout only if advised by support.
  3. Retry after short delay.

Disable action is blocked in tray UI​

Meaning:

  • The endpoint was installed without a disable password, wrong password was entered, or local user lacks admin privileges.

Action:

  1. Re-run installer command with --disable-password <tenant-admin-password>.
  2. Confirm the password is managed by workspace admins only.
  3. Retry from a local admin session.
  4. Use Debug Bundle in tray and attach to support ticket if still blocked.

Who this is for​

This guide is for workspace owners, workspace admins, and security operators who need clear, repeatable steps without support intervention for day-to-day execution.

Role-based start here​

  • Workspace Owner: Start with Before you start, then complete Step-by-step and Known limits and rate limits.
  • Workspace Admin: Focus on Step-by-step, What each button does, and API and automation.
  • Security Analyst: Start at Day-2 operations and Troubleshooting, then use API error quick reference.
  • Integrator/Engineer: Start at API and automation, then validate with Step-by-step and FAQ.

Before you start​

Use this short checklist before making changes:

  1. Confirm you are signed into the correct workspace account.
  2. Confirm your role includes the permissions needed for this page.
  3. Confirm your browser session is fresh (if pages behave unexpectedly, sign out/in once).
  4. Confirm required prerequisites (API keys, agent enrollment, license, upstream integrations) are already in place.

Step-by-step​

Follow this sequence for predictable results:

  1. Open the workspace from the workspace menu.
  2. Review current status/health/last update indicators before making changes.
  3. Apply one change at a time and save.
  4. Run the available validate/probe/refresh action.
  5. Confirm the expected output appears (status change, new event, successful result).
  6. If behavior is not as expected, use Troubleshooting below before repeating actions.

Day-2 operations​

After initial setup, keep this surface healthy with a simple routine:

  1. Daily: verify data freshness and error banners.
  2. Weekly: review trends, limits, and failed actions.
  3. Monthly: review permissions, keys/tokens, and stale entities.
  4. After any incident: capture evidence and update your internal operating notes.

What each button does​

Button labels can vary by module, but behavior is consistent:

  • Refresh: reloads the latest data from backend APIs without changing configuration.
  • Save: persists workspace-scoped configuration changes.
  • Run/Probe/Validate: executes a non-destructive health or verification action.
  • Download: fetches workspace-scoped artifact(s) (for example bundle, checksum, signature, or report).
  • Verify: checks integrity/consistency and returns pass/fail details.
  • Enable/Disable: toggles module behavior for your workspace; audit evidence should be recorded.

If a button appears disabled, check role permissions, required fields, and workspace license/feature entitlement first.

Self-check playbook​

Use this 5-step isolation flow before escalating:

  1. Configuration: confirm required inputs are present and formatted correctly.
  2. Permission: confirm your role can perform the action (401/403 usually indicates authz/authn mismatch).
  3. License/feature: confirm the feature is enabled for your workspace plan and module toggles.
  4. Quota/rate limit: check for 429 responses and cooldown windows.
  5. Service health: if you see 5xx, retry once after 30-60 seconds and capture exact error text.

If still failing, escalate with workspace ID, UTC timestamp, route, action, payload shape (no secrets), and screenshot/error response.

Troubleshooting​

Use this quick triage order to reduce time-to-fix:

  1. Auth/session: refresh token by signing out/in.
  2. Workspace context: confirm you are in the correct workspace.
  3. Inputs/config: verify required fields and formats.
  4. Quota/license: confirm limits and feature entitlement.
  5. Service health: retry after short delay if backend is transiently degraded.

For escalation, include workspace ID, timestamp (UTC), route name, action attempted, and full error message.

API and automation​

Everything in this page should remain workspace-scoped. If your team prefers automation, use the corresponding API endpoints with the same guardrails as the UI:

  • Use authenticated requests bound to your workspace context.
  • Use idempotency/retry controls where available.
  • Validate outcomes in the UI after automated runs.

If your endpoint mapping is not obvious, start from Help Center and follow the linked API docs.

Next best actions​

After finishing this page, continue with related workflows so your workspace setup stays end-to-end complete:

FAQ​

Q: I clicked save but nothing changed. A: Refresh once, confirm permissions, and verify required fields.

Q: Why do I see missing API key/unauthorized errors? A: Confirm your workspace API key/session is valid and mapped to the correct workspace scope.

Q: Can non-admin users use this page? A: Usually read-only access is possible; write actions require workspace-admin or equivalent roles.

Next steps​

After finishing this guide:

  1. Validate the result in the related dashboard/workspace.
  2. Export or capture evidence if this affects compliance/incident operations.
  3. Share the same runbook internally so other operators follow identical steps.
  4. Return to Help Center for adjacent workflows.

API error quick reference​

Use this matrix when a UI action fails with an HTTP/API error.

ErrorMeaningWhat to do now
401 UnauthorizedSession token is missing/expired or request is not authenticated.Sign out/in, refresh once, then retry. Confirm your session is active in the correct workspace.
403 ForbiddenYou are authenticated but your role is not allowed to perform this action.Confirm your role includes the required permission for this button/action. Ask workspace admin to grant access.
404 Not FoundThe route/resource does not exist in current workspace context (or feature not enabled).Confirm URL/route, workspace context, and feature availability. Refresh and retry; if persistent, capture timestamp and route and contact support.
429 Too Many RequestsRate limit/quota window was exceeded.Wait for cooldown/reset window, retry once, then reduce burst traffic/backoff if automated.
500 Internal Server ErrorBackend failed unexpectedly while processing the request.Retry after 30-60 seconds. If still failing, escalate with workspace ID, UTC time, route, action, and full error text.

Known limits and rate limits​

These limits can vary by plan and feature, but behavior is consistent:

  • Burst traffic can trigger 429 Too Many Requests.
  • Workspace quotas apply per feature/module and reset on configured windows.
  • Repeated retries without backoff can extend recovery time during saturation.

Recommended operator behavior:

  1. Retry once after cooldown for 429 responses.
  2. Use exponential backoff in automation.
  3. Monitor usage/quota dashboards for sustained high utilization.
  4. Request quota review when normal workload regularly approaches limits.