To install the AlienVault Agent on your hosts, generate an installation script in USM Anywhere that is specific to your USM Anywhere environment. When you run the installation script on the host system, the installed agent automatically registers with your USM Anywhere instance and configures the system to automatically collect data from the endpoint for threat detection. AT&T Cybersecurity recommends that the host system has a minimum of 4 GB memory and 2 CPU cores for the agent. See Microsoft Windows, Linux, or Apple macOS installation for operating system (OS)-specific requirements.
The AlienVault Agent uses osquery. Other endpoint security products may use osquery for similar tasks, perhaps with different paths or file locations. In theory, osquery running under a different process or service name should present no issues, but AT&T Cybersecurity doesn't support installing a second agent that uses osquery. Additionally, it may be necessary to whitelist the service or process that the AlienVault Agent uses in other endpoint security products so that the AlienVault Agent can operate normally. The following table lists the osquery service and process used by the AlienVault Agent and the AlienVault Agent script.
|USM Anywhere Component||Platform||osquery Service||osquery Process|
|AlienVault Agent Script||Linux||N/A||osqueryi|
Agent Deployment Details
Click the displayed numbers to view the agents in the Assets page (Environment > Assets). If there are unassociated agents, this page displays an alert to help you resolve them. See AlienVault Agent and Asset Associations for more information.