Home
Arc
Learn how Arc provides endpoint security in high availability environments.
Arc
Preparation
Information on how to import Arc packages, and install a license.
Dependencies
To enable all the functions of Arc, you need to have certain items installed on the host machine.

Arc
Learn how Arc provides endpoint security in high availability environments.
- Arc
  - Introduction
    An overview of Arc.
  - Requirements
    The machine and network requirements necessary to use Arc.
  - Preparation
    Information on how to import Arc packages, and install a license.
    - Arc licenses
      Before you can deploy and use Arc, you will need to buy a license. How Arc licenses are installed will depend on the existing installation that you have. Arc and Arc Embedded require separate licenses.
    - Install a license in Guardian or CMC
      Before you can use Arc you must install the applicable license.
    - Import Arc through the update service in Guardian or CMC
      Before you can deploy Arc, you must import it first. There a two methods you can use to do this, one method is through the Nozomi Networks Update Service. The alternative method is through a manual contents upload.
    - Import Arc through a manual contents upload in Guardian or CMC
      Before you can deploy Arc, you must import it first. There a two methods you can use to do this, one method is through a manual contents upload. The alternative method is through the Nozomi Networks Update Service.
    - Dependencies
      To enable all the functions of Arc, you need to have certain items installed on the host machine.
      - Enable security log events
        Before you can use Sigma rules related to security log events, you will need to enable them.
      - Enable printservice log events
        Before you can use Sigma rules related to printservice log events, you will need to enable them.
      - Install EaseFilter manually
        If your Arc installation was updated from an older version, EaseFilter may not have been installed automatically. You can install it manually using the Arc setup wizard.
    - Local services
      It is important to understand the different local services that are necessary for the different operating systems.
    - User permissions
      Arc collects a diverse set of information from the hosting machine, and can take control of the network interfaces. To grant full functionality, Administration/root permissions are needed.
    - Connectivity
      Arc connects to Guardian and Vantage through designated protocols and ports.
    - Enable Audit Policy on Microsoft Windows
      If you want Arc to detect user logon activities, you must enable Audit logon events of Microsoft Windows.
  - Configuration
    Details on how to configure Arc.
  - Deployment
    Information on how to deploy Arc. This includes details for manual and automatic deployments, and deployment through a mobile device management (MDM) system.
  - Execution
    Information on the different modes that you can use with Arc.
  - Troubleshooting
    Troubleshooting procedures to help you solve problems that might occur when you use Arc.
- Arc Embedded
  Arc Embedded is a cybersecurity sensor built into PLCs to provide real-time visibility and deep threat detection within industrial control systems.
- Print format documentation
  A list of all the print-format documentation that is available for Arc and Arc Embedded.

Dependencies

To enable all the functions of Arc, you need to have certain items installed on the host machine.

Table 1. Windows dependencies
Sigma rules	Sysmon
	PowerShell-script block-logging
	PowerShell Core-script block-logging
USB detections	USBPcap
Traffic monitoring	Npcap
Asset details	Not needed
Threat Prevention	EaseFilter (optional, for enhanced real-time performance)

Table 2. Linux dependencies
Sigma rules	Not supported
USB detections	Not supported
Traffic monitoring	Not needed
Asset details	dmidecode

Table 3. macOS dependencies
Sigma rules	Not supported
USB detections	Not supported
Traffic monitoring	libpcap
Asset details	Not needed

During Automatic deployment, dependencies are also installed. To install the dependencies manually, download them and install them individually. Alternatively, you can use a mobile device management (MDM) tool to install them across the managed network.

Windows

On Windows, you can use the command install_dependencies to automatically install these dependencies on the target machine:

PowerShell-script block-logging
PowerShell Core-script block-logging
USBPcap
Npcap

Attention:

For security reasons, since Arc v1.17.0, WinPcap is no longer supported. For traffic monitoring, use Npcap instead.

Since Windows 11 24H2 (build 26100.8037) or Windows Server 2025 (build 26100), Windows includes Sysmon as a native component. Neither Arc nor Guardian can install it, and you cannot install it manually either.

Windows 7, 8, 10, and Windows 11 builds earlier than 26100.8037 do not include Sysmon, so you must install it. For Sysmon, the installation is semi-automatic. First, you must upload the latest Sysmon bundle to the applicable Guardian page. Guardian then uses the bundle for automatic installation during subsequent deployments.

If you are connected to Vantage, or to a Guardian with Vantage as upstream, Vantage automatically fetches Sysmon from the Microsoft website. You do not need to take any further action.

Note:

After you have installed USBPcap, you must reboot the host machine to make the dependency active.

Note:

After a dependency is installed, you must restart Arc to make it active. When Guardian automatically installs dependencies during deployment, no user actions are necessary.