Skip to content
Forestall

Installation

Copy page

Before you start, make sure the server meets the Requirements.

  1. Log in the license.forestall.io with given credentials.
Forestall License Portal login page

Forestall License Portal

  1. Download the license file from Licenses page.

  2. Download the installation package of last release from Releases page.

  3. Run the installation package with Administrator privileges on the deployment server. The installer and binaries are signed with an EV code-signing certificate. You can check the signature in the file’s Properties > Digital Signatures tab before running it.

Install Forestall on a domain-joined server. Some checks need domain membership, so a server outside the domain gives incomplete results. See Requirement 7.

Running the installation package as administrator

Running Installation Package

  1. Click Next button to install requirements first.
Prerequisites welcome page of the installer

Installing Forestall Requirements

  1. The package installs the prerequisites that are missing on the server:

    • .NET Framework 4.7.2
    • Java(TM) Platform SE 15, used by the Neo4j graph database
    • Python 3.13 (64-bit), installed to C:\Python
    • PostgreSQL 15, installed under the installation folder (PostgreSQL\15)
    • IIS URL Rewrite 2.1 (see step 10)

    The Neo4j 4.4.8 graph database is bundled with Forestall and installed under the installation folder. It does not need a separate download. The installer also enables the pgvector extension in PostgreSQL, which the AI Assistant uses.

  2. Click Next to install Forestall services.

Welcome page of the Forestall installer

Installing Forestall

  1. Select the installation folder and click Next. The default folder is C:\Forestall\FSProtect\.
Select Installation Folder page with C:\Forestall\FSProtect\

Forestall Installation Folder

  1. Click the Install button to start the installation.
Ready to Install page of the installer

Starting the Installation

  1. After installation is finished, package installs the IIS URL Rewrite Module. To install this module Accept the License Agreement and click Install.
IIS URL Rewrite Module license agreement

Installing the IIS URL Rewrite Module

  1. Click the Finish button to complete installation.
Installation completed page

Finishing the Installation

  1. The installer configures HTTPS for all Forestall sites in IIS:
Site Port Purpose
FSProtect-Frontend 443 Web interface. Port 80 stays open and redirects to HTTPS.
FSProtect-Django 8443 REST API, called by the web interface and by API clients.
FSProtect-Core 5443 Core service, called by the REST API on the same server.

If the server has no certificate for its host name, the installer creates a self-signed certificate (Forestall Self Signed Certificate, valid for 10 years) and trusts it on the server. A Forestall shortcut on the desktop opens https://<server IP address>. Browsers on other computers show a certificate warning until you replace the certificate (see Changing the certificate and address).

The default username and password for the web interface are both forestall (lowercase). Change the password after the first login.

Forestall login page

Logging In the Forestall Web Interface

  1. Until a license is installed, the web interface opens only the About > License page. Upload the license file you downloaded in step 2 to start scanning. See About for the license table and multi-license details.
About page, License tab with the license upload area

Uploading the License

  1. Change the default password: open the avatar menu in the upper-right corner and select Profile. See Profile.
Avatar menu with Profile, API Tokens and Logout

Opening the Profile Page

Profile page with the password change form

Changing the Password

  1. Configure the environments you want to scan in Configuration Center, then start a scan from Scans > New Scan.

Changing the certificate and address

The installer copies maintenance scripts to C:\Forestall\FSProtect\setup-files\scripts\utils\. Run them in an elevated PowerShell session.

  • Change-Certificate.ps1: lists the certificates in the computer’s personal store and binds the one you select to the Forestall sites. Import your certificate into Cert:\LocalMachine\My first.
  • Change-IpAddress.ps1: updates the address the web interface, API and Core use to reach each other. Set $NEW_ADDRESS at the top of the script to the new IP address or host name before running it.
  • Set-IIS-SecurityHardening.ps1: removes the HTTP response headers that disclose server and framework versions.
  • Backup-All.ps1: backs up the databases, reports and configuration files (see Update).

Was this page helpful?

Thank you for your feedback.