USM Anywhere™ Deployment Guide Copyright © 2020 AT&T Intellectual Property. All rights reserved. AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or affiliated companies. All other marks are the property of their respective owners. Updated November 24, 2020 2 USM Anywhere™ Deployment Guide Contents About USM Anywhere Deployment 6 USM Anywhere Deployment Overview 7 USM Anywhere Architecture 7 USM Anywhere Data Security 10 USM Anywhere Log Data Enhancement 12 USM Anywhere Deployment Types and Scalability 17 USM Anywhere Deployment Requirements 19 USM Anywhere Deployment Process 20 USM Anywhere Updates 21 USM Anywhere Sensor Deployment on VMware 23 About VMware Sensor Deployment 24 Requirements for VMware Sensor Deployment 25 Creating the VMware Virtual Machine 29 The OVF Package Is Invalid and Cannot Be Deployed - SHA256 Error 37 USM Anywhere Setup on the VMware Virtual Machine 38 VMware Sensor Connection to USM Anywhere 40 Completing the VMware Sensor Setup 43 USM Anywhere Sensor Deployment on Microsoft Hyper-V 56 About Hyper-V Sensor Deployment 57 Requirements for Hyper-V Sensor Deployment 57 Create the Hyper-V Virtual Machine 60 USM Anywhere Setup on the Hyper-V Virtual Machine 70 Hyper-V Sensor Connection to USM Anywhere 72 Completing the Hyper-V Sensor Setup 75 USM Anywhere Sensor Deployment on AWS 88 About AWS Sensor Deployment 89 USM Anywhere™ Deployment Guide 3 Requirements for AWS Sensor Deployment 90 Deploying the AWS Sensor 96 Setting the AWS Sensor Connection to USM Anywhere 99 Completing the AWS Sensor Setup 103 Enabling Connections in an AWS VPC 110 Mirroring VPC Traffic with an AWS Sensor 111 Adding an Additional Sensor for Other AWS Accounts 114 Configure Amazon GuardDuty for the AWS Sensor 117 AWS Log Discovery and Collection in USM Anywhere 118 USM Anywhere Sensor Deployment on Microsoft Azure 131 About Azure Sensor Deployment 132 Requirements for Azure Sensor Deployment 134 Deploying the USM Anywhere Sensor from the Azure Marketplace 138 Setting the Azure Sensor Connection to USM Anywhere 141 Completing the Azure Sensor Setup 145 Creating an Application and Obtaining Azure Credentials 159 Adding Another Sensor for Other Azure Subscriptions 162 Azure Log Discovery and Collection in USM Anywhere 165 USM Anywhere Sensor Deployment on Google Cloud Platform 180 About GCP Sensor Deployment 181 Requirements for GCP Sensor Deployment 183 Preparing Your GCP Environment for Sensor Deployment 186 Deploying the GCP Sensor 190 Setting the GCP Sensor Connection to USM Anywhere 191 Completing the GCP Sensor Setup 195 Adding Another Sensor for Other GCP Subscriptions 205 GCP Log Discovery and Collection in USM Anywhere 207 Network Setup and Configuration 216 Configure Network Interfaces for On-Premises Sensors 217 Configure USM Anywhere to Receive ERSPAN Traffic 227 Port Mirroring Configuration on Network Devices 228 Granting Access to Active Directory for USM Anywhere 239 4 USM Anywhere™ Deployment Guide Data Sources and Log Processing 251 Log Collection from Your Data Sources 252 File Integrity Monitoring 297 Running Active Directory Scans 306 Alarm and Event Notifications 309 Sending USM Anywhere Notifications to Slack 310 Sending USM Anywhere Notifications to Datadog 320 Sending USM Anywhere Notifications to PagerDuty 327 Sending Notifications Through Amazon SNS 334 Troubleshooting and Remote Sensor Support 343 Checking Connectivity to the Remote Server 344 Creating a Remote Support Session 346 Collecting Debug Information 349 View Network Testing Information 351 Retrieve Unique Identifier Information 355 USM Anywhere™ Deployment Guide 5 About USM Anywhere Deployment USM Anywhere is a software as a service (SaaS) security monitoring solution that centralizes threat detection, incident response, and compliance management across your on-premises, cloud, or hybrid environments. Data collection, security analysis, and threat detection are centralized in the AlienVault Secure Cloud and provide you with a single view into all of your critical infrastructure. This section includes the following topics. USM Anywhere Deployment Overview 7 USM Anywhere Architecture 7 USM Anywhere Data Security 10 USM Anywhere Log Data Enhancement 12 USM Anywhere Deployment Types and Scalability 17 USM Anywhere Deployment Requirements 19 USM Anywhere Deployment Process 20 USM Anywhere Updates 21 USM Anywhere™ Deployment Guide 6 USM Anywhere™ USM Anywhere Deployment Overview USM Anywhere consists of a modular, scalable, two-tier architecture to manage and monitor every aspect of cloud security. Software sensors collect and normalize data from all of your on-premises and cloud environments, while USM Anywhere provides centralized cloud security management, analysis, correlation, detection, alerting, log management, and reporting. Purpose-built USM Anywhere Sensors deploy natively into each environment and help you gain visibility into all of your on-premises and cloud environments. These sensors collect and normalize logs, monitor networks, and collect information about the environments and assets deployed in your hybrid environments. USM Anywhere™ USM Anywhere Architecture USM Anywhere has a modular and scalable two-tier architecture. 7 USM Anywhere™ Deployment Guide USM Anywhere Architecture Diagram Tier 1 — USM Anywhere Sensors and Agents USM Anywhere Sensors deploy natively into each environment and help you gain visibility into all of your on-premises and cloud environments. Sensors collect and normalize logs, monitor networks and collect information about the environments and assets deployed in your hybrid environments. Sensors are a key component of the USM Anywhere solution. They operate either on-premises or in the cloud, performing the following tasks: l Discovering your assets. l Scanning assets for vulnerabilities. l Monitoring packets on your networks and collecting data. l Collecting log data and normalizing it before securely sending it to USM Anywhere. USM Anywhere Agents deploy on your network host and provide the following: l Endpoint detection and response l Network asset monitoring l File integrity monitoring (FIM) l Log collection USM Anywhere™ Deployment Guide 8 Tier 2 — USM Anywhere Cloud USM Anywhere receives the previously described data sent to it by the USM Anywhere Sensor and uses it to provide essential security capabilities in a single SaaS platform: l Centralized system security management l Log data analysis and correlation l Detection l Alerting l Log management l Reporting USM Anywhere also integrates log management and securely retains raw logs long-term for forensic investigations and compliance mandates. AWS Deployment Regions The USM Anywhere cloud instance will be deployed in one of the following AWS endpoint regions based on your location. The following table lists the code and name of each region: Supported AWS Regions Code Name Reserved Static IP Address Blocks ap-northeast-1 Asia Pacific (Tokyo) 18.177.156.144/28 ap-south-1 Asia Pacific (Mumbai) 3.7.161.32/28 ap-southeast-2 Asia Pacific (Sydney) 3.25.47.48/28 ca-central-1 Canada (Central) 3.96.2.80/28 eu-central-1 Europe (Frankfurt) 18.156.18.32/28 eu-west-1 Europe (Ireland) 3.250.207.0/28 eu-west-2 Europe (London) 18.130.91.160/28 sa-east-1 South America (São Paulo) 18.230.160.128/28 us-east-1 US East (N. Virginia) 3.235.189.112/28 us-west-2 US West (Oregon) 44.234.73.192/28 us-gov-west-1 AWS GovCloud (US-West) 3.32.43.32, 3.32.43.33, 3.32.43.34, 3.32.43.35 9 USM Anywhere™ Deployment Guide USM Anywhere™ USM Anywhere Data Security As a security-first organization, AT&T Cybersecurity makes your data protection and privacy a top priority. USM Anywhere architecture and processes are designed to protect your data in transit and at rest. Data Collection All data sent from the USM Anywhere Sensor deployed in your on-premises or cloud environment to the USM Anywhere service in the AlienVault Secure Cloud is encrypted and transferred over a secure TLS 1.2 connection. Each sensor generates a certificate to communicate with the USM Anywhere service. This means that all communication is uniquely encrypted between each sensor and USM Anywhere. All forensic data (raw logs) is backed up on an hourly basis. The data collected in USM Anywhere is secured using AES-256 encryption for both hot (online) storage and cold (offline) storage. Data Access Your data in USM Anywhere is treated as highly confidential, and only a select few AT&T Cybersecurity staff members have access. This group of employees uses multi-factor authentication (MFA) to access the AlienVault Secure Cloud. Strict internal controls and automation enable support for the service while minimizing administrative access. AT&T Cybersecurity also has a formal information security program that implements various security controls to the National Institute of Standards Technology (NIST) Cyber Security Framework. Key controls include: Inventory of Devices, Inventory of Software, Secure Configurations, Vulnerability Assessment, and Controlled Use of Administrative Privileges. Additionally, AT&T Cybersecurity conducts security self-assessments on a regular basis. Single-Tenant Data Store Unlike other SaaS solutions that use a multi-tenant architecture, AT&T Cybersecurity uses a single- tenant data store architecture to securely store your data. With USM Anywhere, your data is stored in its own dedicated data store, which is completely isolated from other customers’ data. Unlike multi-tenancy, which is prone to data leakage and breakage that can affect multiple customer accounts, single-tenancy ensures that all customers’ data is kept separate and leak-proof. USM Anywhere™ Deployment Guide 10 Cold Storage Data Integrity USM Anywhere offers secure long-term log retention, known as cold storage. By default, USM Anywhere stores all data associated with a customer’s subdomain in cold storage for the life of the active USM Anywhere subscription at no additional charge. USM Anywhere uses a write once, read many (WORM) approach to log storage to prevent log data from being modified or otherwise tampered with. You can download your raw logs at any time.