Set up Alert Logic Threat Manager for Amazon Web Services Marketplace (Windows)

This topic describes set up procedures for Alert Logic Threat Manager with and without ActiveWatch. If you have Threat Manager with ActiveWatch, in addition to the activation and login credentials emails discussed below, you will also receive a service contract for ActiveWatch.

If you signed up for Threat Manager for AWS Marketplace (Windows) prior to April 19, 2017, use the documentation located here.

Before you begin

Before you set up Threat Manager, you should review the Requirements for Alert Logic Threat Manager for Amazon Web Services.

To set up Threat Manager for AWS Marketplace, you must perform tasks in the AWS console, and in the Alert Logic console.

In addition, note the following:

• As an AWS marketplace customer, you can use the Alert Logic agent and CloudTrail. For more information about cross-account CloudTrail access, see Set up AWS CloudTrail.

• For your convenience, the Alert Logic agent activates collection for Threat Manager, Log Manager, and Web Security Manager. For more information, please contact Technical Support: US:(877) 484-8383, EU: +44 (0) 203 011 5533.

Sign up for an Alert Logic user account and ActiveWatch service

After you sign up and fill out the contact information form to create your Alert Logic account, check your inbox for your Alert Logic activation email and click the link to activate your account. You will then receive an additional email with your login credentials that will allow you to log in to our platform where you can complete your Threat Manager configuration.

Create a deployment

To create a deployment:

1. In the Alert Logic console, click CONFIGURATION, and then click Deployments.
2. Click the add icon ().
3. Select the appropriate cloud service.
4. Enter the requested information.

• For an AWS deployment:
  • Enter the Role ARN.
  • Check the box at the bottom if you want to use cross-account CloudTrail to centralize CloudTrail log collection, and then enter the Role ARN for the receiving account.
• For a Microsoft Azure deployment:
  • Enter the Environment Name
  • Enter the Subscription ID
  • Enter the Active Directory ID
  • Enter the User Name
  • Enter the Password

5. Click SAVE.

Set up AWS cross-account roles

Before Alert Logic can manage the protection of your AWS accounts, you must:

1. Log into your AWS account to create a cross-account role to allow Alert Logic to access your AWS accounts.
2. Log into the Alert Logic console to configure credentials for each discovered AWS account.

For more information about setting up cross-account roles, see Configure Alert Logic Cloud Defender AWS cross-account role access.

Create a Threat Manager for AWS instance

To create a Threat Manager for AWS instance:

1. Log into the AWS EC2 Console.
2. From the menu bar, click the Region drop-down, and then select the region where you want to deploy your Threat Manager virtual appliance.
3. From the menu bar, click the Services drop-down, and then select EC2.
4. In the left navigation area, under Images, click AMIs.
5. Select Private Images.
6. From the list of AMIs, select "AlertLogic TMC - P13," and then click Launch.
7. Select an instance type based on factors described in Virtual appliance types in AWS, and then click Next: Configure Instance Details.
8. Fill out the instance details, and ensure you:
   • Select a VPC.
   • Provide subnet information.


The subnet must be a public subnet.

9. Click Next: Add Storage.
10. Click Next: Add Tags.
11. Click Next: Configure Security Groups.
12. On the Configure Security Group page:
    1. Select Create a new security group.
    2. Provide a name for your security group.
    3. Provide a description for your security group.
    4. Click Add Rule for each inbound appliance rule you need to add, as outlined below.
    • US Data Center
    • EU Data Center
    

    Rules with source of 0.0.0.0/0 allow all IP addresses to access your instance. Alert Logic recommends limiting access to only known IP addresses.
    After you claim your appliance, you can edit your security group inbound and outbound rules with settings recommended by Alert Logic.

13. Click Review and Launch.
14. Review choices and click Launch.
15. From the Key Pair drop-down menu, select Launch without key pair, and then click Launch Instances.
16. Click Accept Terms.
17. If you have a VPC, associate an elastic IP to the instance. Retain your elastic IP address for troubleshooting purposes, and for reference during calls to Alert LogicTechnical Support.
18. Set up outbound appliance rules.
    1. Return to the EC2 Console, and then click Security Groups.
    2. Select the Threat Manager security group you want to edit.
    3. Click the Outbound tab.
    4. Click Edit.
    5. Set up the appropriate rules, as outlined below.
    • US Data Center
    • EU Data Center
19. Click Save.

When an appliance is automatically provisioned, the system creates one or two assignment policies, using the following guidelines:

• Alert Logic creates an assignment policy for each appliance during the provisioning process.
• If no VPC assignment policy exists, Alert Logic creates one and assigns the appliance to it.
• If a VPC assignment policy exists, Alert Logic assigns the appliance to it.

Download and install the agent

After you create and install the AWS instance, you must download and install the Alert Logic agent.

Download the agent for Windows

To download the agent: 

1. In the Alert Logic console, click the Settings icon (), and then click Support Information.
2. From the Details page, click Install Guides & Downloads.
3. Download the appropriate agent and follow the on-screen instructions.
   • For Windows users, click Windows Agents, and then select the desired agent.
   • For Linux users, click Linux Agents. Linux users can select either Debian-based agent installers or RPM-based agent installers. Both installers are available in a 32-bit or 64-bit format.
     
4. Click the Details tab.
5. Copy your unique registration key. You will need this later to install the remote collector.

Install the agent for Windows

Alert Logic allows you to install the agent through a GUI, or through a command line.

Install the agent through a GUI 

To install the agent:

1. Run the MSI package.
2. Leave the Provisioning API Key field blank.
3. In Proxy Setting, select a connection method if you want traffic to pass through a proxy. You can connect via Direct Connection or a web proxy. You can also enter the URL of the proxy server.
   
4. In Provision, select After Setup.
5. Click Install.

Install the agent through a command prompt with image capture

To install the agent:

1. Copy the MSI file to the target machine.
2. Type the following command: 
   

   msiexec /i [path to MSI file] install_only=1 /q

   • /i installs the agent normally
   • Command prompt example:
     msiexec /i c:\downloads\al-agent-1.0.33.msi install_only=1 /q
3. (Optional) If you have set up a NAT or virtual appliance and you want to use it as a single point of egress, enter the corresponding host name or IP address or port via the following command prompt parameters:
   • sensor_host=[host] indicates the IP address where the agent should forward logs.
   • sensor_port=[port] indicates the TCP port where the agent should connect.
4. Type the following command to configure the agent to start automatically when the instance restarts:

   sc config al_agent start= auto

5. In the EC2 console, stop the running instance.
6. To create a new AMI, right-click on the stopped instance, then click Image, and then click Create Image. In Create Image enter a name and description for the new AMI, and then select No Reboot.
7. (Optional) Start an instance from the newly created AMI, and verify that the agent has registered with the Alert Logic console.
   If you need to edit your OS image, then do not register the agent in the Alert Logic console.
   • To stop the agent, enter sc stop al_agent
   • If the following files are present, remove the files: %CommonProgramFiles(x86)%\AlertLogic\host_crt.pem and %CommonProgramFiles(x86)%\AlertLogic\host_key.pem where %CommonProgramFiles(x86)% refers to "C:\Program Files\Common Files" for x86 versions of windows and "C:\Program Files (x86)\Common Files" for amd64 and ia64 versions.

Create security group for protected hosts

A security group acts as a firewall that controls the traffic allowed to reach one or more instances. After you set up your Alert Logic account, create a security group to protect hosts and appliances and, if necessary, you should update the assignment rules.

To create a security group for protected hosts:

1. Log into the AWS EC2 console.
2. In the navigation pane, click Security Groups.
3. Click the Security Group tab.
4. In Create Security Group:
   • In Name, type Alert Logic TM Protected.
   • In Description, type Alert Logic Threat Manager Protected Hosts.
   • In VPC,
     • If you do not have a VPC, select No VPC from the drop-down menu.
     • If you have a VPC, select the desired VPC ID from the drop-down menu.
5. Click Yes, Create.

Update rules for protected host security group

After you create your AWS security group, you must configure it to allow communication with the Alert Logic appliances, agents, and the back end used for incident analysis and correlation.

To update your security group:

1. Select VPC Security Groups, from the Viewing pull-down menu.
2. Click the Outbound tab, and apply the following rules, as necessary:
   
   To use the US data center:

   Create a new rule	Port range	Destination
   Custom TCP Rule	7777	<Appliances>*
   Custom TCP Rule	443	204.110.218.96/27
   Custom TCP Rule	443	204.110.219.96/27
   Custom TCP Rule	443	208.71.209.32/27

   To use the EU data center:

   Create a new rule	Port range	Destination
   Custom TCP Rule	7777	<Appliances>*
   Custom TCP Rule	443	185.54.124.0/24

   * In the above examples, replace <Appliances> with the Alert Logic TM Appliances security group ID.

3. Click Apply Rule Changes.
4. Repeat these instructions for every protected host security group associated with the appliance you configure.

Related topics