USM Anywhere includes out-of-the-box AlienVault Agent configuration profiles to manage the queries that it runs for an asset An IP-addressable host, including but not limited to network devices, virtual servers, and physical servers. associated with a deployed agent. For each configuration profile, you can view the list of queries, a description of the collected logs, and the query frequency. Depending on your needs, you can change the default configuration profile so that you collect the log data and generate the events Any traffic or data exchange detected by AT&T Cybersecurity products through a sensor or external devices such as a firewall. for the newly deployed agents.

USM Anywhere provides two configuration profiles for each of the agent deployment types: optimized and full. There are both preferable and less-than-preferable data security and data consumption reasons for choosing either configuration profile. Use the following information to help you determine which configuration profile works best for your setup.

In the Configuration Profiles view, you can click the individual profile name to display the queries executed by the agent and their frequencies. If you are looking for a specific type of log, enter text in the search field and click the search icon () to filter the query list. If you want to see the specific file paths included in the profile's file integrity monitoring (FIM), click the File Integrity tab to display these paths by category.

To display the agent configuration profiles

1. Go to Data Sources > Agents.
2. Click Configuration Profiles.

3. Review and select the configuration profile you want to use by default.

   Important: The Experimental Profiles are temporary and internal. Do not use them unless you have instructions from the AlienVault Technical Support department.

Assign AlienVault Agent Configuration Profiles to Assets

You can assign a specific AlienVault Agent configuration profile to an asset, and you can do it from the assets list page or asset details page.

To assign an agent profile using the actions list

1. Go to Environment > Assets.
2. Select the asset and click Actions > Assign Agent Profile.

3. Choose the agent profile you want to assign to the selected asset.

   

USM Anywhere displays an informative message if assets exist but do not have agents deployed.

4. Click Save.

To assign an agent profile from the asset details page

1. Go to Environment > Assets.
2. Locate the asset and click the icon next to name of the asset you want to assign the specific agent configuration profile, and then select Full Details.
3. Click Agent.

4. Click the Configuration Profile combo and select the profile you want to assign.

   

To assign an agent profile from the Configure Asset dialog box

1. Go to Environment > Assets.
2. locate the asset, click the icon next to the name of the asset you want to assign the specific agent configuration profile, and select Configure Asset.

Important: The Agent Profile field displays if the agent is connected and if the user has the role Manager.

3. Choose the agent profile you want to assign to the selected asset.

   

USM Anywhere displays an informative message if assets exist but do not have agents deployed.

4. Click Save.

Assign AlienVault Agent Configuration Profiles to Asset Groups

To assign an AlienVault Agent configuration profile to an asset group

1. Go to Environment > Asset Groups.
2. Next to the asset group that you want to assign the profile, click the icon and select Full Details.
3. Select Actions > Assign Agent Profile.

4. Choose the agent profile you want to assign to the selected asset group.

   

5. Click Save.