Alert Logic Threat Manager for Microsoft Azure IaaS Manual Deployment (Linux)

Alert Logic recommends the Alert Logic Threat Manager - Bring your own license (BYOL) deployment through the Azure Marketplace as the preferred deployment method. This method is intended for expert-level users who need to install manually for control or customization purposes.

Deployment overview

This following sections provide an overview of manually deploying Threat Manager in Azure.

Azure Resource Manager (ARM) template

Threat Manager deployment in Azure uses an Azure Resource Manager (ARM) custom template to deploy its appliance on a virtual machine. The Threat Manager ARM template handles many of the details of the deployment automatically for you, including the following:

Creates the virtual machine which serves as the Threat Manager virtual appliance. The Threat Manager virtual appliance collects events from the agent and performs threat analysis.
Creates an availability set.
Creates the required Network Security Group and defines all necessary inbound and outbound rules.

The rules defined with manual deployment differ from those defined through the Azure Marketplace deployment.

You can deploy the ARM template through the Azure portal or the Azure Command Line Interface (CLI).

For more details on the Threat Manager ARM template, see the following:

To review ARM template README: Threat Manager ARM template README
To view ARM template: Threat Manager ARM template
To graphically display the ARM template: Threat Manager ARM template in ARM Template Visualizer (ArmViz).

ARM deployment is the only supported method for the Threat Manager Virtual Machine (VM) in Azure. Classic deployment is no longer supported.

Process Overview

The following list describes the overall process of manually deploying Threat Manager in Azure:

Review Prerequisites. Make sure you have your Azure account created and have reviewed requirements.
Prepare for deployment. In this step, you set up Azure CLI, create required resources, and copy the Threat Manager vhd to your Azure environment.
Deploy Threat Manager VM. You can deploy using the Azure Portal or Azure CLI.
Claim your appliance.
Download and install the agent.
Create and apply assignment policy.

Prerequisites

Azure account—Microsoft Azure account used to deploy Threat Manager VM
Requirements—Requirements specific to the deployment of Threat Manager in Azure, including firewall rules, virtual machine sizing specifications, endpoints and Access Control List (ACL) entries

Prepare for deployment

Preparing for deployment requires steps in both the Azure CLI 1.0 and the Azure Portal. Use the following processes to prepare for deployment:

Set up Microsoft Azure Command Line Interface (CLI).
Create required resources in Azure portal:.
Copy Alert Logic Threat Manager vhd to your storage account.

Set up Microsoft Azure Command Line Interface (CLI)

To set up Azure CLI:

Install Azure CLI 1.0, and open a session.
Authenticate your CLI session with your Azure account as follows:
1. Using the CLI, enter the following command:
```
# azure login
```
  The following response appears:
```
info:    Executing command login
info:    To sign in, use a web browser to open the page https://aka.ms/devicelogin.
Enter the code XXXXXXXXX to authenticate.
```
2. As described in the response, use a browser to open the provided page, enter the provided code, and then log into your Azure account.
  The following response appears in the CLI:
```
info:    Added subscription Your Subscription
info:    Setting subscription "Your Subscription" as default
+
info:    login command OK
#
```

Required resources

The following Azure resources are required and must exist prior to Threat Manager VM deployment:

Resource group—A container, or logical grouping, of resources related to your Threat Manager deployment.
- Storage account—The location in Azure where your containers, Threat Manager vhd, and Alert Logic security appliances are stored and deployed.
  - Storage account access key—When you create a storage account, Microsoft Azure creates a primary and secondary 512-bit storage access key. Use the primary key to transfer the Threat Manager appliance image from Alert Logic to your Azure environment.
  - Blob container—The container to store the virtual machine and Threat Manager virtual appliance image.
Virtual Network—Threat Manager VM becomes part of a virtual network in your Azure account.
- Subnet—A subnet within the specified virtual network.
- Virtual network resource group—The resource group that contains the virtual network and subnet. The virtual network resource group must be in the same region as the resource group you are deploying your VM instances to.

This list of resources is comprehensive. You may already have some of these resources defined in your Azure environment which you can use; if not, you must create them before you can create your VM.

Create required resources in Azure portal:

Log in to the Azure portal.
Create a new storage account (and resource group, if needed) using the following steps.
Note: See Azure Storage Account for more information.
1. On the Hub menu, select New, Data + Storage, Storage account.
2. Enter the following information on the Create storage account resource management page (blade):
  - Name—Type a unique descriptive name for the storage account.
  - Deployment model—Select Resource Manager. (Classic deployment is not supported.)
  - Account kind—Select General purpose.
  - Performance—Select the type of storage you prefer: Standard or Premium.
  - Replication—Select Geo-Redundant storage, which replicates your data to a secondary location within the same region, providing failover protection.
  - Subscription—Select the subscription in which you want to create the new storage account.
  - Resource group—Specify a new resource group or select an existing resource group.
  - Location—Select the geographic location for your storage account. The appliance must be created in the same virtual network where the agents are located. This enables network communication between the appliances and agents.
3. Click Create to create the storage account.
The new storage account and resource group (if applicable) are created.
After your storage account has been created, copy your storage account access key, as follows:
Note: See Azure storage access key for more information.
1. Locate your storage account and open its resource management page.
2. Click the Keys icon.
3. On the Access keys blade, click the copy button to copy your primary key (key1) and paste it into a plain text editor. You will need this information later.
Create a Blob storage container within your storage account, as follows:
1. On your storage account blade, under Services, click Blobs.
2. On the Blob service blade, click the + Container icon.
3. Enter the following information on the New container blade:
  - Name—Type a name for your new container.
  - Access type—Select Private.
4. Click Create.
The new Blob storage container is created.
Create your virtual network, as follows:
1. On the Hub menu, select New, Networking, Virtual Network.
2. On the Virtual Network blade, select Resource Manager for the deployment model, and click Create.
3. Enter the following information on the Create virtual network blade:
  - Name—Enter a descriptive name for your virtual network.
  - Address space—Enter the address range for your virtual network.
  - Subnet name—Enter the name for a subnet.
  - Subnet address range—Enter the address range for the subnet.
  - Subscription—Select the subscription in which you want to create the new virtual network.
  - Resource group—Specify a new resource group or select an existing resource group. This resource group must be in the same region as the resource group where your storage account exists.
    Alert Logic recommends the you use the same resource group for all your Threat Manager resources.
  - Location—Select the geographic location for your virtual network.
  The virtual network resource group must be in the same region as the resource group you are deploying your instances to.
4. Click Create.
  The new virtual network and resource group (if applicable) are created, which completes the creation of all required resources prior to VM deployment.

Copy Alert Logic Threat Manager vhd to your storage account

Alert Logic maintains the Threat Manager appliance image as a .vhd file in the Microsoft Azure environment.

To copy the Alert Logic Threat Manager vhd to your storage account:

In an Azure CLI session, enter the following command to set mode to Azure Service Management (asm):
```
# azure config mode asm
```
The following response appears:
```
info:    Executing command config mode
info:    New mode is asm
info:    config mode command OK
#
```
Copy the Alert Logic Threat Manager vhd to your storage account, as follows:
1. Locate the following information for the upload command:
  - Storage account name/URL (for example, http://storageaccountname.blob.core.windows.net)
  - Blob container name
  - Target file name (for example, al-tmc-image_latest.vhd)
  - Storage account key
  The following command shows the required syntax:
  azure vm disk upload http://alertlogic.blob.core.windows.net/tmcimage/al-tmc-image_latest.vhd [storage account URL]/[blob container name]/[filename.vhd] [storage-account-key]
2. Use a plain text editor to construct your command, replacing the variables.
3. Enter your upload command, similar to the following example:
```
# azure vm disk upload http://alertlogic.blob.core.windows.net/tmcimage/al-tmc-image_latest.vhd http://storageaccountname.blob.core.windows.net/blobcontainername/al-tmc-image_latest.vhd [your-storage-access-key]
```
  The following response appears:
```
info:    Executing command vm disk upload
warn:    Any existing blob will be overwritten at 
http://storageaccountname.blob.core.windows.net/
blobcontainername/al-tmc-image_latest.vhd
+  Copying image: 100% (42949673472/42949673472)
info:    vm disk upload command OK
#
```

Deploy Threat Manager VM

To deploy your Threat Manager VM, Alert Logic provides a custom Azure Resource Manager (ARM) template. You can deploy the template from the Azure portal or the Azure CLI.

Deployment of the Threat Manager VM using the provided ARM template assumes the following prerequisites have been addressed:

The following Azure resources exist:
- Resource group, storage account, blob container, virtual network resource group, virtual network, subnet
The Threat Manager vhd has been copied to your storage account.

You can use the Azure Resource Manager Template Visualizer (ArmViz) to graphically display the deployment template.

The provided ARM template performs the following actions for you:

Creates virtual machine, which serves as the Threat Manager appliance
Creates availability set
Creates Network Security Group and defines necessary inbound rules. Alert Logic requires inbound access to the appliance over SSH port 22 and HTTP port 80.
The rules defined with manual deployment differ from those defined through the Azure Marketplace deployment.

Deployment Parameters

When using the Threat Manager ARM template, you must supply values for required parameters. Refer to the following table when using the deployment procedures.

Some of the parameters are slightly different between Azure Portal deployment and Azure CLI deployment methods, as shown in the following table.

Field - Portal deployment	Field - CLI deployment	Description	Example
Resource group	myResourceGroup	Enter the resource group where the VM instance will be created.	myresourcegroup
Resource group location	-	If you are creating a new resource group, provide the location. Note: The resource group that you are deploying your VM instances to and the resource group containing your virtual network and subnet must be in the same region.	West US
STORAGEACCOUNTNAME	storageAccountName	Name of storage account where the Threat Manager VM will be deployed	mystorageaccount
BLOBCONTAINERNAME	blobContainerName	Blob container within your storage account where to deploy Threat Manager	myblobcontainer
OSDISKVHDURI	osDiskVhdUri	Fully qualified URL for Threat Manager VHD, which was copied to your account	http://mystorageaccount.blob.core.windows.net/myblobcontainer/al-tmc-image_latest.vhd
AVAILABILITYSETNAME	availabilitySetName	Availability Set name for the Threat Manager VMs Note: Availability set will be created if it does not exist.	myavailabilityset
NUMBEROFINSTANCES	numberOfInstances	Number of virtual instances to deploy	1
VMNAME	vmName	Name of the new Threat Manager VM being deployed	awesome-new-threat-manager-vm
VIRTUALNETWORKNAME	virtualNetworkName	Name of your Virtual Network	myvnet
VIRTUALNETWORKRESOURCEGROUP	virtualNetworkResourceGroup	Name of an existing resource group containing your virtual network Note: The resource group that you are deploying your VM instances to and the resource group containing your virtual network and subnet must be in the same region.	myresourcegroup
SUBNETNAME	subnetName	Existing subnet within your selected virtual network.	mysubnet
VMSIZE	vmSize	Size of the new Threat Manager VM being deployed Default: Standard_A3 Alert Logic recommends the A3 (4 cores, 7 GB memory) size. For more information, see Instance type sizes.	Standard_A3

Deploy from Azure portal

Use the following procedure to deploy your Threat Manger VM from the Azure portal.

To deploy Threat Manager VM from the Azure portal:

(Optional) View the Threat Manager ARM template.
Log in to the Azure portal.
Load the Threat Manager ARM template in the Azure portal. Click here to perform this step.
On the Parameters blade, enter values for the required fields, and then click OK.
On Custom deployment blade, enter values for the required fields, and then click Create.
Your new deployment should successfully create the new Threat Manager VM.