AlienVault USM Anywhere Deployment Guide

USM Anywhere is a SaaS security monitoring solution that centralizes threat detection, incident response, and compliance management across your on-premises, cloud, or hybrid environments. Data collection, security analysis, and threat detection are centralized in the AlienVault Secure Cloud and provide you with a single view into all of your critical infrastructure.

PDF
Document
AlienVault USM Anywhere Deployment Guide | Manualzz

Advertisement

Advertisement

USM Anywhere™
Deployment Guide
Updated August 21, 2017
Copyright © 2017 AlienVault. All rights reserved.
AlienVault, AlienApp, AlienApps, USM Appliance, USM Anywhere, Open Threat Exchange, OTX,
OSSIM, Unified Security Management, and USM are trademarks of AlienVault and/or its affiliates.
Other names may be trademarks of their respective owners.
2 USM Anywhere™Deployment Guide
Contents
About USM Anywhere Deployment 6
USM Anywhere Deployment Overview 7
USM Anywhere Architecture 7
USM Anywhere Data Security 9
USM Anywhere Deployment Types and Scalability 10
Deployment Requirements 12
USM Anywhere Deployment Process 13
About USM Anywhere Upgrades 14
USM Anywhere Sensor Deployment on VMware 16
VMware Sensor Deployment 17
Requirements for VMware Sensor Deployment 18
Importing the VMware OVF Package 19
USM Anywhere Setup on the VMware Virtual Machine 20
VMware Sensor Connection to USM Anywhere 23
Completing the VMware Sensor Setup 25
USM Anywhere Sensor Deployment on Microsoft Hyper-V 38
About Hyper-V Sensor Deployment 39
Requirements for Hyper-V Sensor Deployment 39
Creating the Hyper-V Virtual Machine 41
USM Anywhere Setup on the Hyper-V Virtual Machine 46
Hyper-V Sensor Connection to USM Anywhere 49
Completing the Hyper-V Sensor Setup 51
USM Anywhere Sensor Deployment on AWS 64
About AWS Sensor Deployment 65
Requirements for AWS Sensor Deployment 66
Deploying the AWS Sensor 68
USM Anywhere™ Deployment Guide 3
AWS Sensor Connection to USM Anywhere 72
Completing the AWS Sensor Setup 76
Adding Another Sensor to Other AWS Accounts 82
Enabling syslog Connections in an AWS VPC 85
AWS Log Discovery in USM Anywhere 86
Creating a New CloudWatch Collection Job 89
Creating a New AWS S3 Access Collection Job 92
USM Anywhere Sensor Deployment on Microsoft Azure 97
About USM Anywhere Deployment on Azure 98
Requirements for USM Anywhere Sensor Deployment on Azure 98
Deploying the USM Anywhere Sensor from the Azure Marketplace 99
Deploying the USM Anywhere Sensor in the Web Interface 102
Creating an Application and Obtaining Azure Credentials 105
Completing the Azure Sensor Setup 108
Creating a New Azure Collection Job 121
Plugin Management 124
USM Anywhere Plugin Integration and Enablement 125
Enabling Plugins Manually 128
Requesting a New Plugin or an Update to an Existing Plugin 132
Supported Plugins 134
Device Port Mirroring Configuration 425
About Port Mirroring 426
Configuring VMware ESX Virtual Switches for Port Monitoring 426
Configuring a Hyper-V Virtual Machine for Port Mirroring on a Windows Server 2012+ 432
Configuring the ADTRAN (AOS) Switch for Port Mirroring 434
Configuring the Check Point Gateway for Port Mirroring 435
Configuring the Cisco ASA 5505 for Port Mirroring 436
Configuring the Cisco Nexus for Port Mirroring 437
Configuring the Cisco SGxxx Series for Port Mirroring 438
Configuring the Dell Networking Force10 Switch for Port Mirroring 440
Configuring the Fortinet-FortiGate Switch for Port Mirroring 441
Configuring SonicWALL Port Mirroring 442
4 USM Anywhere™ Deployment Guide
/

Advertisement

Key features

  • Centralized threat detection

  • Incident response management

  • Compliance management

  • Centralized data collection

  • Security analysis

  • Threat detection

  • Single view of critical infrastructure

Frequently asked questions

USM Anywhere is a SaaS security monitoring solution that centralizes threat detection, incident response, and compliance management across your on-premises, cloud, or hybrid environments.

USM Anywhere offers on-premises, cloud, and hybrid cloud deployment types. On-premises deployments use VMware EXSi and Microsoft Hyper-V sensors. Cloud deployments use Amazon Web Services (AWS) and Microsoft Azure sensors. Hybrid cloud deployments combine private and public cloud sensors.

You need access to VMware ESXi 5.1 or later, four cores, 12 GB of memory, 150 GB of disk space, Internet connectivity, and administrative credentials for devices from which you want to forward logs. Port mirroring setup is also required for network monitoring.

Navigate to Network Configuration > Configure Management Interface > Set a Static Management IP Address and enter the IP Address, subnet, and gateway information.

After obtaining the IP address of your USM Anywhere web portal, you must provision your USM Anywhere instance from the AlienVault Secure Cloud. Open a web browser and enter the IP address. Click Start Setup, and use the initial Authentication Code (starts with a "C") to register the sensor and provision the instance.

The Setup Wizard guides you through the initial configuration of your USM Anywhere Sensor. You can access it by clicking Get Started on the WELCOME TO USM ANYWHERE page, or by selecting SETTINGS > DEPLOYMENT and clicking the configure icon for the sensor.

User questions

I L

James I.

What are the firewall requirements for USM Anywhere Sensor communication?

No votes

Outbound port 443 must be opened to allow traffic to *.alienvault.cloud for all sensor deployment types to communicate with the cloud environment.

Preparing document for printing…
0%