So now you have a server instance of Alienvault in your network and you need to get your sensors up and running.
While a majority of small deployment can do with an All-In-One, there are reasons why you might need a separate server/sensor config. Remote sites for instance; where you want the sensor located onsite to perform log normalization, vulnerability assessments, availability etc. The sensor does quite a fair bit of work as well – and on top of that, it balances out the EPS. Remember, the AIO has a limit on EPS, so if you are looking at anything beyond 1,000 EPS, you are going to struggle to keep up with the events without a sensor.
Deploying a sensor is straightforward.
First, it’s important to understand a sensor does not have a GUI frontend, so all config is done on the Alienvault Setup Menu or CLI. This doesn’t make it any more difficult – in fact the hardest part of it is to include in the License Key in the menu – since we can’t cut and paste, so you need to make sure you do it correctly.
Second, you should always have a server instance before you go around setting up the sensor.
In the Alienvault Setup, go to Configure Sensor->Configure Alienvault Server IP. Now this should be your server IP. Some have asked should it be the management IP or the Logging IP. It should be the management IP, unless of course your management IP is not reachable, in that case, the only reachable IP is the logging IP of your server.
So go ahead and do the same for your framework IP address as well. Apply all changes and you are set.
Head back to the server, and go to the UI
Configuration->Deployment->Sensors
You will see the following message
Warning: The following sensors are being reported by as enabled by the server, but aren’t configured
Don’t worry about this, just click on Insert and you are done. It’s that straightforward. You will see the sensor listed, with the context it’s under, version and the status should have a checkbox next to t.
The final part is to get the Logger up and running.
Opposite from the sensor, the Logger is setup via the UI.
What’s important to understand here is that the flow is Sensor -> Server -> Logger.
So the logger is actually the end of the flow where all your logs are forensically stored and archived and validated. As far the server is concerned, it sees the Logger as a Parent.
ON THE LOGGER
Head over to the Logger UI (having already set it up as you did the server initially with IP Addresses, Licenses etc)
Go to Configuration->Deployment-> Servers and use “Add Server”
Again go ahead and use the IP address you have been using to define your server during your sensor config.
Once you have added the server and saved, head back to the Server screen and click on your logger instance (which should be there by default already)
Now select “NO” for everything except “LOG” in the form.
That’s it. You shouldn’t be type in the REMOTE USER and all that as this is done later in the Server.
ON THE SERVER
Now, back to the Server UI. Go to the same Configuration->Deployment->Servers.
It sometimes can get confusing here as the UI is the same, so make sure you name your Logger and Server appropriately!
On the server, you should see both the SERVER and LOGGER under the UI.
Modify the LOGGER (remember, you are on the SERVER UI, NOT THE LOGGER UI).
You won’t be able to change anything in there but you can set the Remote Admin and password to log into the Logger. Use the admin credentials (not the root) and let the URL populate itself by clicking on it.
Set “Remote Logger”
Finally, go back to the server screen and click on the SERVER -> Modify
You can now opt to set up Log to NO. Under that, in the Forward Servers option, click Add Server and go ahead add in your Logger.
Save and Apply all changes.
Click on Server Hierarchy and we have a nice primitive depiction of the Server pointing to the Logger. Well Done!
Now – a note: If you are using an AIO UA as a server instance, you can set up the Log to YES in the AIO. That means you are logging in both locations.
In your logger, interface you will see that you have two different color boxes, depicting which Logger it is sent to.
If for some reason you want to say, OK, for asset 1 – 20 send to AIO, and for Asset 21 – 100, send to the Logger, you can disable the forwarding we set up above, and do it via policies. The great thing about Alienvault is that it allows that granular flexibility to control where your AIO wants to forward (or not forward) logs to.
We will explore Policy Setup in the future.
For now, enjoy your three piece band – Sensor, Server and Logger!
