Set up Alert Logic Threat Manager for Microsoft Azure IaaS Marketplace

The Alert Logic Threat Manager deployment from the Microsoft Azure Marketplace creates your virtual appliance in an Azure virtual machine. The Threat Manager virtual appliance collects events from the agent and performs threat analysis.

Before you begin

Review the Requirements for Alert Logic Threat Manager for Microsoft Azure . For your convenience, the Alert Logic agent activates collection for Threat Manager, Log Manager, and Web Security Manager. For more information, contact Technical Support: US:(877) 484-8383, EU: +44 (0) 203 011 5533.

Integrate Threat Manager with Azure deployments

For Alert Logic to protect assets in Microsoft Azure, you must create a user account with specific permissions. Role-Based Access Control (RBAC) enables fine-grained access management for Azure accounts. Assigning a RBAC role to the user account you create grants the minimum access required to allow Alert Logic to monitor your environments.

Configure RBAC roles in Azure

Deploy Alert Logic Threat Manager

To deploy Alert Logic Threat Manager from the Azure Marketplace:

1. Log in to the Microsoft Azure portal.
2. Click Marketplace.

3. In Search Everything, type Alert Logic, and then press Enter.
4. Click Alert Logic Threat Manager - BYOL.
5. In the Alert Logic Threat Manager - BYOL blade, in Select a deployment model, select Resource Manager.

6. Click Create.
   
7. On the Basics blade, complete the following fields:
   • Name: Type a descriptive name for your virtual machine.
   • User name: Type a user name for logging in to your virtual machine.
   • Authentication type: Click your preferred authentication type for logging in to your virtual machine:
     • Password: If selected, provide password information.
     • SSH public key: If selected, provide SSH public key.
   • Subscription: Select the subscription under which to create your virtual machine.
   • Resource group: Specify the resource group to contain all your Azure Threat Manager VM resources. You can create a new resource group, or select an existing resource group. Alert Logic recommends that you create a resource group to manage all your Alert Logic assets.
   • Location: Select the geographic location for your virtual machine. You should select the same region as the virtual machines you plan to monitor.
   Microsoft requires users to fill out the authentication fields (Authentication type and SSH public key/Password). For security purposes, Alert Logic does not allow client access to appliances. The provided credentials for the authentication fields do not grant access to the Alert Logic  appliance. If this is an issue, please contact Alert LogicTechnical Support.
8. Click OK.
9. On the Choose a size blade, select a size and pricing tier for your virtual machine, and then click Select.
   
   Alert Logic appliances require a minimum virtual machine size of 4 cores and 7 GB memory.
10. On the Settings blade, review the preconfigured values for each field, and then click OK.
    Most fields have additional settings that are not displayed on the Settings blade. To see all settings, expand each field.
11. After validation, review the Summary information, and then click OK.
12. On the Purchase blade, review the details, and then click Purchase.
    

Update Network Security Group rules

Once the appliance runs, you must create rules that allow inbound and outbound communication with Alert Logic.

To update Network Security Group rules for the Threat Manager virtual appliance:

1. Log in to the Microsoft Azure portal.
2. In the left navigation, click Resource groups.
3. Click your resource group.
4. On your resource group blade, click your Network security group resource.
   
5. On the Settings blade, click either Inbound security rules, or Outbound security rules.
6. Click Add on the top banner of the blade.
7. Enter the information for the rules according to the tables:
   • US firewall rules
   • EU firewall rules
8. Click OK.

Repeat this procedure for each of the listed inbound and outbound rules.

Claim your appliance

To claim with a RBAC role

With an RBAC role, Threat Manager automatically claims the appliance.

When an appliance is automatically provisioned, the system creates one or two assignment policies, using the following guidelines:

• Alert Logic creates an assignment policy for each appliance during the provisioning process.
• If no VNet assignment policy exists, Alert Logic creates one and assigns the appliance to it.
• If a VNet assignment policy exists, Alert Logic assigns the appliance to it.

To claim manually

To manually claim your appliance, contact Alert Logic. As part of the onboarding process, Alert Logic creates your customer account and claims your appliance.

To contact Alert Logic to claim your appliance: 

• In the US, call (877) 484-8383 and select the appropriate option.
• In the EU, call +44 (0) 203 011 5533 and do the same.

After you set up an account with Alert Logic, you can claim additional appliances with the manual claim process.

To manually claim additional appliances:

1. In the Alert Logic console, click the Settings icon (), and then click Support Information.
2. Click the Details tab.
3. Copy your unique registration key.
4. Open another browser window, and then navigate to http://[your-vm-ip-address].
5. Enter the unique registration key you copied, and then click Claim Appliance.

Download and install the agent

After the deployment of the virtual machine is complete, you must download and install the agent. See Install the Alert Logic agent for Windows or Install the Alert Logic agent for Linux.

Create and apply assignment policy

An assignment policy is a set of rules that indicates to appliances how to handle incoming traffic; the appliance will either accept or ignore the traffic. An assignment policy directs protected hosts to encrypt traffic and send traffic to specific appliances. In a dynamic environment where IP addresses often change, an assignment policy ensures that hosts always correspond to their appliances.

To create an assignment policy:

1. In the Alert Logic console, click CONFIGURATION, and then click Deployments.
2. In the left navigation area, click Policies.
3. Click the Assignment tab.
4. Click the Add icon ().
5. In Appliance Assignment Policy Name, enter a name.
6. In Appliances, select an appliance.
7. Click Save.

To assign a policy to a protected host:

1. In the Alert Logic console, click CONFIGURATION, and then click Deployments.
2. Click the All Deployments tile.
3. In the left navigation pane, click Networks and Hosts, and then click the Protected Hosts tab.
4. Click the pencil icon ( ) for the desired protected host.
5. Select Use an Existing Assignment Policy.
6. From the Existing Assignment Policy drop-down menu, select the assignment policy you want to use.
7. Click SAVE.

Related topics