USM Appliance Deployment Guide

249 Pages·2017·17.64 MB·English

USM Appliance™
Deployment Guide
Copyright © 2023 AT&T Intellectual Property. All rights reserved.

AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T
Intellectual Property and/or affiliated companies. A ll other marks are the property of their
respective owners.

Updated March 02, 2023
2 USMAppliance™DeploymentGuide
Contents
System Overview 8
About USM Appliance 9
About USM Appliance System Architecture and Components 16
Event Collection, Processing, and Correlation Workflow 18
USM Appliance Deployments 23
USM Appliance Deployments 24
USM Appliance Deployment Types 25
USM Appliance Deployment Requirements 31
Firewall Permissions 34
Configure the USM Appliance Hardware 37
Deploy USM Appliance in VMware 53
Deploy USM Appliance Using Hyper-V Manager 58
Deploy USM Appliance with AMI 64
Configure the USM Appliance Sensor after Deployment 67
Configure the USM Appliance Logger after Deployment 69
Configure the USM Appliance Enterprise Server and Enterprise Database 74
Set Up the Management Interface 77
Register USM Appliance 79
USM Appliance Initial Setup 83
Access the AlienVault Setup Menu 84
Configure Network Interfaces 86
Configure the Search Domain 89
Configure a Hostname for USM Appliance 90
Change the Default Time Zone 91
Configure USM Appliance to Use a DNS 92
Configure Synchronization with an NTP Server 92
USMAppliance™ D eploymentGuide 3
Configure USM Appliance to Recognize Your Local Keyboard 93
Configure Custom HTTPS Certificates in USM Appliance 94
Create the Default Admin User 96
Configure Mail Relay in USM Appliance 97
Configure USM Appliance to Use a Proxy 100
Getting Started Wizard 103
Running the Getting Started Wizard 104
Skipping the Getting Started Wizard 104
Configuring Network Interfaces 105
Discovering Assets in Your Network 108
Deploying HIDS to Servers 112
Enabling Log Management 116
Connecting to AlienVault Open Threat Exchange® 118
IDS Configuration 121
Intrusion Detection Systems 122
AlienVault HIDS 124
AlienVault NIDS 163
VPN Configuration 175
Prerequisites 176
Configure a VPN Between USM Appliance Systems 176
Building a VPN Tunnel Without a Client-Server Connection 180
Verifying the VPN Connection 183
Disabling a VPN Configuration 183
High Availability Configuration 185
How Does the High Availability Solution Work? 186
High Availability Prerequisites and Restrictions 187
Configuring High Availability in USM Appliance Standard Systems 189
Configuring High Availability in USM Appliance Enterprise Systems 202
4 USMAppliance™ D eploymentGuide
Disabling High Availability 206
Upgrading a USM Appliance Deployment Configured for High Availability 207
Plugin Management 210
Plugin Fundamentals 211
Enable Plugins 227
Configure Plugins 237
Customize and Develop New Plugins 258
Update Process 284
USM Appliance Updates 285
Update USM Appliance Online 286
Update USM Appliance Offline 290
Operating System Upgrade in Version 5.8.0 295
Error Codes When Updating from Version 5.8.0 to Version 5.8.x 299
Backup and Restoration 304
Back Up and Restore Alarms 305
Back Up and Restore Events 308
Back Up and Restore MongoDB 311
Back Up and Restore NetFlow Data 313
Back Up and Restore Raw Logs 316
Back Up and Restore System Configuration 319
Migrate Your USM Appliance Deployment 327
Restore Software on a USM Appliance Hardware 333
Update Your AlienVault License Key 339
System Maintenance and Remote Support 342
Message Center 343
Remote Support 348
Locate the AlienVault License and System ID 352
Purge Old System Logs 353
USMAppliance™ D eploymentGuide 5
Replace Disk Drives or Power Supplies 354
6 USMAppliance™ D eploymentGuide
USMAppliance™ D eploymentGuide 7
SystemOverview
System Overview
This is a basic overview of AlienVault USM Appliance as it is deployed and used in your
environment. Individual subjects covered in the System Overview include the following:
  About USM Appliance — describes c urrent risks in the business environment due to security
l
threats and vulnerabilities, the role of risk assessment, an overview of USM Appliance secur-
ity management capabilities for organizations to assess and mitigate risks, to detect
threats and prioritize response, and to achieve compliance.
  About USM Appliance System Architecture and Components — provides description of the
l
USM Appliance architecture, including major system components and functionality.
  USM Appliance Deployments — provides description of best practices for installation and
l
configuration of USM Appliance.
  Event Collection, Processing, and Correlation Workflow — describes the overall
l
USM Appliance workflow, from collection of raw log data from networked devices to ana-
lyzing and determining risk from various threats and vulnerabilities.
8 USMAppliance™ D eploymentGuide
AboutUSM Appliance
About USM Appliance
Businesses today are exposed to an ever-increasing number of threats:
  Network-based threats — Aimed at networks and network infrastructure.
l
  Host-based threats — Aimed at individual hosts.
l
  External threats — Coming from external attackers.
l
  Internal threats — Coming from internal attackers.
l
Although the goal of security solutions is to detect and prevent such threats, no network can
be completely protected from them all. For this reason, USM Appliance focuses on mitigating
risk, identifying vulnerabilities, detecting threats, and prioritizing response to the highest
priority threats and vulnerabilities. Measures for mitigating risk, identifying vulnerabilities, and
detecting threats include the following:
  Identifying p atterns of events that indicate a possible threat or vulnerability.
l
  Determining the risk of potentially harmful attacks or compromise.
l
  Implementing controls to address reported vulnerabilities.
l
  Taking action to respond to identified attacks.
l
  Performing ongoing monitoring and reporting of network and host-based activities.
l
The Role of Risk Assessment
To properly secure your infrastructure, f irst conduct a risk assessment of your assets. Risk
assessment helps you determine the relative importance of the assets within your network,
the vulnerabilities of those assets in relation to specific exploitation threats, and the likelihood
of security events taking place against those assets. After completing these analyses, you can
design security policies in response to the relative asset values and exploitation risks that
various threats and vulnerabilities pose.
Strong security policies focus on how best to protect your most vital and at-risk assets. For
example, if a network resource is critical and the likelihood of an attack against it is high, f ocus
your efforts on creating security policies that monitor for such attacks, and develop response
plans to them.
USMAppliance™ D eploymentGuide 9
AboutUSM Appliance
How USM Appliance Helps with Risk Assessment and Mitigation
USM Appliance provides you with the ability to identify your critical assets and to set policies to
alert you when those assets have vulnerabilities or are subjected to attacks. U SM Appliance will
generate alarms based upon the risk associated with any given security event captured in
USM Appliance.
The importance given to any given security event depends on three factors:
  The value of the asset associated with the event
l
  The threat represented by the event
l
  The probability that the event will occur
l
These factors are the building blocks for the traditional definition of risk: a measure of the
potential impact of a threat on your assets and the probability a threat will be carried out.
Each event generated in USM Appliance is evaluated in relation to its associated risk; in other
words, in proportion to the assets at risk, the threat represented by the event, and the
probability the threat is real. Accordingly, USM Appliance provides you the capability to
identify all high risk events, some of which will result in alarms, and allow you to properly
prioritize your response.
How USM Appliance Helps Detect Threats and Prioritize Responses
The following illustration highlights the capabilities and related tools that USM Appliance
provides to help you perform security management tasks in your own environment.
10 USMAppliance™ D eploymentGuide